nova-status upgrade check fail

admin

cat /etc/nova/nova.conf |grep -v ^# | grep -v ^$
[DEFAULT]
firewall_driver = nova.virt.firewall.NoopFirewallDriver
use_neutron = True
my_ip = 192.168.221.30
transport_url = rabbit://openstack:rabbitpwd@ocataControl
enabled_apis = osapi_compute,metadata
3 i' O5 Y. p* d& p0 i5 p( o[api]
auth_strategy = keystone
[api_database]
[barbican]
2 a% {" c; h  Z( U* Y& S) P* t. c2 B[cache]
[cells]
# r; ^$ n/ A" \6 p! }/ P[cinder]
[cloudpipe]
0 j4 S7 n. N* h* {( G0 H[conductor]
1 U. F/ l- }7 d+ d$ i9 H: `[console]
$ K; p3 i' @& z; `  s  y! e[consoleauth]
! A1 v' p& M1 @: l! ^[cors]
/ b) T6 l# o2 l. d# T" m2 n[cors.subdomain]
* O/ X0 P  Y0 u' q- |4 W[crypto]
( i3 E2 K4 r% s0 D[database]
5 J+ |0 f" ^: V& S0 `[ephemeral_storage_encryption]
[filter_scheduler]
5 ?) X( C4 K, z1 n( t1 W[glance]
3 G. t* m4 D8 Z6 ~  aapi_servers = http://ocataControl:9292
[guestfs]
8 g* ?9 m- Q+ k  X[healthcheck]
+ p6 O6 H1 x9 V[hyperv]
[image_file_url]
7 z" k- m5 h! l9 T. O& ?[ironic]
[key_manager]
) u7 F( C' Q: }3 ][keystone_authtoken]
password = novapass
- t9 \: h% G7 h1 h1 }+ }5 K9 ousername = nova
project_name = service_test
' a1 l9 j" h9 m( f6 _8 _user_domain_name = default
project_domain_name = default
auth_type = password
memcached_servers = ocataControl:11211
- F5 N7 s# p" y; \auth_url = http://ocataControl:35357
auth_uri = http://ocataControl:5000
[libvirt]
[matchmaker_redis]
1 w: Y4 _; g% i9 R4 v6 J5 Z[metrics]
8 E; L: ]* i+ i1 K1 D[mks]
3 O) P8 W7 a' [& G[neutron]
4 X5 n3 M! U, o' C[notifications]
+ K$ @1 W/ l1 t0 J' E  u# l[osapi_v21]
[oslo_concurrency]
3 N; B+ h- R5 a: t# clock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
2 D; a+ E2 m' k6 T- l9 p; d[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
# y* S2 i3 T& J0 r, i[oslo_middleware]
% w7 C& x& h+ p  t% c, C: H8 V+ `[oslo_policy]
[pci]
/ N; I3 c7 j& Q1 g2 ^+ {5 I3 ~[placement]
auth_url = http://ocataControl:35357/v3
- }3 M6 t1 T  a1 D8 a, Spassword = placementpass
username = placement
. P8 _7 t+ V+ W% V/ `' Auser_domain_name = Default
+ r5 ]6 G: r! ^9 r# l/ T, [auth_type = password
: t% k7 G) H. d7 z' q" wproject_name = service_test
* Q5 J0 d1 n" J9 }  uproject_domain_name = Default
# |' i0 x3 U# e& p" [: Aos_region_name = RegionTWO
( h: Z$ ]3 d- z' h; A[quota]
[rdp]
9 [; ]2 n3 Q4 O- X# u( a2 O[remote_debug]
[scheduler]
[serial_console]
9 I, e  ]( I. W# o) ]& }[service_user]
$ I2 h7 |/ g, C! r7 v; c2 m[spice]
[ssl]
7 ~5 q4 l3 E; i[trusted_computing]
[upgrade_levels]
+ f; h$ W# t# Y. W$ @" N9 @( M[vendordata_dynamic_auth]
[vmware]
- V9 p$ q" _* `[vnc]
- g5 v$ z4 H4 I) ~novncproxy_base_url = http://ocataControl:6080/vnc_auto.html
, {  i- m! F5 s$ Svncserver_proxyclient_address = 192.168.221.30
vncserver_listen = 0.0.0.0
enabled = True
[workarounds]
[wsgi]
! A/ R$ h1 l+ M5 A) U; e, K& M[xenserver]
[xvp]

admin

ConfigFilesPermissionDeniedError: Failed to open some config files: /usr/share/nova/nova-dist.conf,/etc/nova/nova.conf.

admin

# vim /usr/share/nova/nova-dist.conf

2 n+ M+ M2 M( |, i. p5 t[DEFAULT]
+ j5 Q" F# x6 K& y5 Xlog_dir = /var/log/nova
state_path = /var/lib/nova
lock_path = /var/lib/nova/tmp
& @" J7 e5 ^" m' ]dhcpbridge = /usr/bin/nova-dhcpbridge
/ A, S5 ]$ n$ ], ]; i0 Xdhcpbridge_flagfile = /usr/share/nova/nova-dist.conf
1 \/ ~: m: e: |( J+ R0 S. s; fdhcpbridge_flagfile = /etc/nova/nova.conf
! T' e$ V! c5 l) C4 w2 {force_dhcp_release = True
0 j" N4 }  M# c/ [; \( ]; Einjected_network_template = /usr/share/nova/interfaces.template
libvirt_nonblocking = True
libvirt_inject_partition = -1
network_manager = nova.network.manager.FlatDHCPManager
4 G- [, J- a1 f0 `, Xcompute_driver = libvirt.LibvirtDriver
9 k8 U1 g/ n8 K: Bfirewall_driver = nova.virt.libvirt.firewall.IptablesFirewallDriver
rootwrap_config = /etc/nova/rootwrap.conf
$ G9 W9 s0 ^% y# Nuse_stderr = False
2 x0 [$ o+ M5 Q
[database]
connection = mysql://nova:92e672789c1b9e@controller/nova
max_retries = -1

, g- `: ~, ~/ s  y6 `5 Q" b- V' [  U[keystone_authtoken]
* ?7 t3 [' K4 g( K+ J! Hauth_host = 192.168.2.20
( O& v; m( i  |6 Mauth_port = 35357
auth_protocol = http

admin

# nova-status --log-file /var/log/nova/status.log upgrade check
Error:
Traceback (most recent call last):
1 h3 _! i/ ?: c2 A  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 459, in main
    ret = fn(*fn_args, **fn_kwargs)
. a# i8 ?* i* q5 d  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 389, in check
$ |; X  \1 D! Z" E, J& c& |# N    result = func(self)
6 ~4 e6 V2 V! m6 K5 |! @  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 203, in _check_placement
% P8 |) t: _7 `8 H* k    versions = self._placement_get("/")
: U6 C1 m4 e' g3 |  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 191, in _placement_get
    return client.get(path, endpoint_filter=ks_filter).json()
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 845, in get
/ y2 R- V, i5 ]+ d% U& V3 w* G    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
& j) e2 A9 }3 c    return wrapped(*args, **kwargs)
- x' `3 R, W; Q! n+ Y  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 742, in request
3 @6 g% ~- J2 G    raise exceptions.from_response(resp, method, url)
2 g, J- |6 b" ~  W# l% Q2 fServiceUnavailable: Service Unavailable (HTTP 503) (Request-ID: req-b587bc53-eb59-4976-b0c7-27dcddd14260)

admin

ausearch -c httpd
0 N! c4 O" c7 N% ]" d. lshows

type=AVC msg=audit(1498146726.488:879): avc: denied { name_connect } for pid=6299 comm="httpd" dest=35357 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket permissive=0
3 Y! h  ?- V8 L9 A/ UThis will make it work:

# `) T+ S, Q5 k9 Rsetsebool -P httpd_can_network_connect 1