diff --git a/firstboot/userdata_root_password.yaml b/firstboot/userdata_root_password.yaml
new file mode 100644
index 0000000000..63dd5a9c66
--- /dev/null
+++ b/firstboot/userdata_root_password.yaml
@@ -0,0 +1,38 @@
+heat_template_version: ocata
+
+description: >
+  Uses cloud-init to enable root logins and set the root password.
+  Note this is less secure than the default configuration and may not be
+  appropriate for production environments, it's intended for illustration
+  and development/debugging only.
+
+parameters:
+  NodeRootPassword:
+    description: Root password for the nodes
+    hidden: true
+    type: string
+
+resources:
+  userdata:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: root_config}
+
+  root_config:
+    type: OS::Heat::CloudConfig
+    properties:
+      cloud_config:
+        ssh_pwauth: true
+        disable_root: false
+        chpasswd:
+          list:
+            str_replace:
+              template: "root:PASSWORD"
+              params:
+                PASSWORD: {get_param: NodeRootPassword}
+          expire: False
+
+outputs:
+  OS::stack_id:
+    value: {get_resource: userdata}