nova-status upgrade check fail

admin

cat /etc/nova/nova.conf |grep -v ^# | grep -v ^$
[DEFAULT]
+ i4 B' f0 L7 Q+ Sfirewall_driver = nova.virt.firewall.NoopFirewallDriver
8 F  T" O; U' ]  r, iuse_neutron = True
my_ip = 192.168.221.30
: Y# o/ m5 A9 Btransport_url = rabbit://openstack:rabbitpwd@ocataControl
) o6 f6 m2 G6 M: Uenabled_apis = osapi_compute,metadata
, I, Y! J1 _2 I9 T; m3 p8 @" n[api]
0 i$ _0 A& T9 R1 ^auth_strategy = keystone
[api_database]
[barbican]
[cache]
[cells]
[cinder]
% I4 m  c3 }/ p2 \# d[cloudpipe]
" S6 a8 x9 H" k5 ~6 B( c3 g& r[conductor]
[console]
$ c# Z$ E+ y7 ^$ z. a, b, j( z" i$ Y6 k[consoleauth]
8 N# @+ P9 A# g5 N( X3 `2 W[cors]
[cors.subdomain]
[crypto]
[database]
  ]1 A: O0 }5 J8 [* X$ \" \[ephemeral_storage_encryption]
- }% _$ R% F* t0 m: _/ I[filter_scheduler]
/ h( }/ c, S/ _/ ^/ a+ Q9 ^[glance]
api_servers = http://ocataControl:9292
[guestfs]
: x1 B9 Y' R/ r  z9 z* `& G! S/ t[healthcheck]
[hyperv]
- B4 C) B5 w8 s$ B5 V8 X( t" {[image_file_url]
[ironic]
[key_manager]
; h/ M" f8 s  Q6 [[keystone_authtoken]
7 G2 l8 h% |& [) H/ M8 jpassword = novapass
) }$ Y2 r8 {6 Q8 h0 I3 [2 @' [7 pusername = nova
project_name = service_test
user_domain_name = default
project_domain_name = default
1 }  G& I- y+ V: \) }auth_type = password
memcached_servers = ocataControl:11211
auth_url = http://ocataControl:35357
auth_uri = http://ocataControl:5000
[libvirt]
; o9 s1 ^$ y9 G1 b" Q9 r3 L[matchmaker_redis]
[metrics]
[mks]
[neutron]
3 v6 X( o2 U. g0 e[notifications]
[osapi_v21]
  Q: v2 x1 E: W& p' _. R% Q[oslo_concurrency]
; x' R& E* r1 C# t1 [lock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
6 R! F& S3 k7 W; W1 I5 b[oslo_middleware]
[oslo_policy]
[pci]
[placement]
auth_url = http://ocataControl:35357/v3
password = placementpass
username = placement
# Z& |4 |1 ?  m" L1 U# |1 x0 ?user_domain_name = Default
& r' e9 [& ?- D9 p& xauth_type = password
$ L% ~' Y# ~7 \$ w% I; Z' _  nproject_name = service_test
- Y3 G$ s5 R) U1 Nproject_domain_name = Default
% P) @* \4 J4 P7 ]/ ~os_region_name = RegionTWO
[quota]
[rdp]
[remote_debug]
[scheduler]
; O8 L; h) Z, y[serial_console]
) u- m1 |. U7 y6 K: B. X# F/ m[service_user]
[spice]
3 s& f: i7 Y: {1 x% W/ F[ssl]
[trusted_computing]
[upgrade_levels]
( w8 x, p& b* J[vendordata_dynamic_auth]
- `( j( h% A7 J+ c& I* ?[vmware]
) B4 O( K# h0 f3 q* S2 D  b[vnc]
novncproxy_base_url = http://ocataControl:6080/vnc_auto.html
vncserver_proxyclient_address = 192.168.221.30
& S6 A# B  j5 }% Cvncserver_listen = 0.0.0.0
enabled = True
( D& R. j+ Z  J! m5 M5 ^+ w[workarounds]
. x' t) ?0 d2 x/ d5 V[wsgi]
[xenserver]
[xvp]

admin

ConfigFilesPermissionDeniedError: Failed to open some config files: /usr/share/nova/nova-dist.conf,/etc/nova/nova.conf.

admin

# vim /usr/share/nova/nova-dist.conf

[DEFAULT]
log_dir = /var/log/nova
state_path = /var/lib/nova
- {' {+ L2 q) B- k" _lock_path = /var/lib/nova/tmp
dhcpbridge = /usr/bin/nova-dhcpbridge
4 b. `# ?& s* p- y: ddhcpbridge_flagfile = /usr/share/nova/nova-dist.conf
dhcpbridge_flagfile = /etc/nova/nova.conf
force_dhcp_release = True
6 Z+ x2 p" _+ G' |$ R1 F8 Cinjected_network_template = /usr/share/nova/interfaces.template
libvirt_nonblocking = True
libvirt_inject_partition = -1
( Q2 b( g% ^& e) u5 K3 \+ bnetwork_manager = nova.network.manager.FlatDHCPManager
compute_driver = libvirt.LibvirtDriver
! Z: N3 [, g. k0 C% n8 u8 bfirewall_driver = nova.virt.libvirt.firewall.IptablesFirewallDriver
# r2 J; l; i; D. N4 P0 k! r# [. G& O" g# Rrootwrap_config = /etc/nova/rootwrap.conf
9 h% c& R6 ?, g9 t( T$ M' {  H! yuse_stderr = False
5 {9 `2 D! q# ^- K5 C6 ^
[database]
8 F5 q$ G% x% n6 econnection = mysql://nova:92e672789c1b9e@controller/nova
. V" o& p$ V' l" l" Rmax_retries = -1
- Y" }( o% x: T6 z. O
' X0 r8 p8 x  ?  i; Y[keystone_authtoken]
+ L8 M2 C  ?9 k/ G' W. Xauth_host = 192.168.2.20
auth_port = 35357
auth_protocol = http

admin

# nova-status --log-file /var/log/nova/status.log upgrade check
Error:
  ?. D! A/ h4 E% nTraceback (most recent call last):
' g' x5 a: u/ b  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 459, in main
; m- J2 m7 h9 j( I2 o    ret = fn(*fn_args, **fn_kwargs)
5 D5 Y) D& S; g* m4 u  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 389, in check
    result = func(self)
- @/ m# X' X) \, q& l$ w- s  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 203, in _check_placement
' F7 k3 R' y/ B+ X    versions = self._placement_get("/")
+ a$ u/ |0 b$ l2 b6 O0 i8 I  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 191, in _placement_get
    return client.get(path, endpoint_filter=ks_filter).json()
2 K1 y% p7 K' v6 k/ A! d: \  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 845, in get
5 |4 b+ j! ~2 x8 T  O    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
, ^$ R8 A! y$ G/ W9 W( z  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 742, in request
- ]: @  V6 k1 v& |2 v! j' A    raise exceptions.from_response(resp, method, url)
ServiceUnavailable: Service Unavailable (HTTP 503) (Request-ID: req-b587bc53-eb59-4976-b0c7-27dcddd14260)

admin

ausearch -c httpd
# A  X/ Q$ x  ?. G5 o: Lshows

type=AVC msg=audit(1498146726.488:879): avc: denied { name_connect } for pid=6299 comm="httpd" dest=35357 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket permissive=0
4 T: r5 |( |3 KThis will make it work:
. r/ r/ \8 P2 r% D& z* W) S
setsebool -P httpd_can_network_connect 1