Open port 16509 for libvirt for live migration

Port 16509 should be opened for tcp traffic to enable live migration.

See Also:
http://docs.openstack.org/admin-guide/compute-configuring-migrations.html

Previously, we were not enabling any iptables rules on the Compute
Roles, so this is a regression.

Change-Id: Ie4abf53dc2a8171af48d02e34a1a3ad43f27cfb3
Closes-Bug: #1635427
(cherry picked from commit 1c4ade1d66)

puppet/services/nova-libvirt.yaml

@@ -50,6 +50,10 @@ outputs:
             tripleo::profile::base::nova::libvirt_enabled: true
             nova::compute::libvirt::services::libvirt_virt_type: {get_param: NovaComputeLibvirtType}
             nova::compute::libvirt::libvirt_virt_type: {get_param: NovaComputeLibvirtType}
+            tripleo.nova_libvirt.firewall_rules:
+              '200 nova_libvirt':
+                dport:
+                  - 16509
 
       step_config: |
         include tripleo::profile::base::nova::libvirt