From bc9c1c8cc8efe698694aaf0b47413bdb0569ab9a Mon Sep 17 00:00:00 2001
From: Derek Higgins <derekh@redhat.com>
Date: Fri, 8 Jul 2016 23:47:31 +0100
Subject: [PATCH] Enable root login on single use slaves

Since glean only configures the ssh key for the root
user on instances, this is needed so that the nodepool
generated images can be used by users who don't have their
ssh keys baked into the image.

Change-Id: Id09c63920b5565e1cc011eb98cfb132a11060bcc
Depends-On: I704453c6d3091a24e68509650c61efb638aea601
---
 modules/openstack_project/manifests/single_use_slave.pp | 1 +
 modules/openstack_project/manifests/template.pp         | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/modules/openstack_project/manifests/single_use_slave.pp b/modules/openstack_project/manifests/single_use_slave.pp
index df7c227e4e..b268de3c66 100644
--- a/modules/openstack_project/manifests/single_use_slave.pp
+++ b/modules/openstack_project/manifests/single_use_slave.pp
@@ -26,6 +26,7 @@ class openstack_project::single_use_slave (
     install_users             => $install_users,
     install_resolv_conf       => $install_resolv_conf,
     enable_unbound            => $enable_unbound,
+    permit_root_login         => 'yes',
     iptables_rules4           =>
       [
         # Ports 69 and 6385 allow to allow ironic VM nodes to reach tftp and
diff --git a/modules/openstack_project/manifests/template.pp b/modules/openstack_project/manifests/template.pp
index 7e50f47f24..d31f81759a 100644
--- a/modules/openstack_project/manifests/template.pp
+++ b/modules/openstack_project/manifests/template.pp
@@ -21,6 +21,7 @@ class openstack_project::template (
   $sysadmins                 = [],
   $pypi_index_url            = 'https://pypi.python.org/simple',
   $purge_apt_sources         = false,
+  $permit_root_login         = 'no',
 ) {
 
   ###########################################################
@@ -35,6 +36,7 @@ class openstack_project::template (
 
   class { 'ssh':
     trusted_ssh_source => $puppetmaster_server,
+    permit_root_login => $permit_root_login,
   }
 
   if ( $afs ) {