It sounds like your problems aren't a problem with your firewall-cmd commands, but something to do with OpenStack?
For reference, I'll post the final response (by James Slagle, presumably this one) on the Bugzilla report you made - just in case it helps someone:
As suggested by Eric, this issue is related to OSP deployment, thus changing bug owners to TripleO.
Note that it is known to effect OSP 14 and bellow.
No, this is not correct based on how I interpret the bug. You're trying to add firewall rules on the host (titan08) that is hosting a vm called undercloud-0.
undercloud-0 is where OpenStack is installed. But there are no OpenStack rpm's or configuration done on the physical host itself (titan08).
In that case, it seems that this is entirely about the configuration of the firewall of the physical host and not the OpenStack vm.
As Eric pointed out, the rules you are trying to add with firewalld are not getting saved on the physical host (titan08).
Is my understanding correct?
When you install OpenStack on a VM, it makes no changes to the physical host itself.
