nova-status upgrade check fail

admin

cat /etc/nova/nova.conf |grep -v ^# | grep -v ^$
[DEFAULT]
firewall_driver = nova.virt.firewall.NoopFirewallDriver
use_neutron = True
my_ip = 192.168.221.30
, q0 ~" u4 l+ _) m5 e0 f. k% Z& Ptransport_url = rabbit://openstack:rabbitpwd@ocataControl
. y) J( _# p' ^: Z5 u5 Benabled_apis = osapi_compute,metadata
& u2 P- k3 z  I/ F) Y[api]
; k  v8 R. }2 ?' [auth_strategy = keystone
[api_database]
[barbican]
( V( L& y4 V/ m3 i0 K, o4 Y8 G5 O[cache]
[cells]
8 d2 I: A6 _) n8 f[cinder]
& {/ c3 i) G2 Q  r5 D  ^9 s4 w[cloudpipe]
6 i" a" a( A: _6 s[conductor]
[console]
[consoleauth]
- o7 A+ _* n9 B5 b6 p1 }6 n[cors]
; p* a0 U8 ~; J0 R5 c/ _& Y, [[cors.subdomain]
[crypto]
[database]
[ephemeral_storage_encryption]
* n; G7 R; n0 R[filter_scheduler]
$ e) u9 c% O' B1 ?2 R2 N[glance]
api_servers = http://ocataControl:9292
+ S, n1 M2 A* a: U/ i[guestfs]
[healthcheck]
[hyperv]
8 d9 c( j% t! S. _( \% t" U[image_file_url]
[ironic]
[key_manager]
[keystone_authtoken]
; [0 U" g! B/ I. Upassword = novapass
9 A2 I+ b2 C4 z4 P$ eusername = nova
# U& i3 Q) y1 J* J" `project_name = service_test
user_domain_name = default
. G- c9 Y( V7 H6 v* w9 ?0 Jproject_domain_name = default
auth_type = password
4 Y2 n: [8 U' V$ c. z, i( ^* f8 zmemcached_servers = ocataControl:11211
auth_url = http://ocataControl:35357
! v5 F7 B  e$ g1 C4 Wauth_uri = http://ocataControl:5000
2 c9 {2 E8 Z' Y' Q7 z[libvirt]
[matchmaker_redis]
! `7 H! [, P" u[metrics]
[mks]
[neutron]
2 k& G* {/ a& a% b) H[notifications]
[osapi_v21]
[oslo_concurrency]
lock_path = /var/lib/nova/tmp
+ [5 T5 a2 @. O( k& `# G[oslo_messaging_amqp]
[oslo_messaging_kafka]
[oslo_messaging_notifications]
[oslo_messaging_rabbit]
[oslo_messaging_zmq]
& n+ z: z3 ^/ d+ ~; r[oslo_middleware]
[oslo_policy]
[pci]
0 m8 {2 h: ~. w! |[placement]
auth_url = http://ocataControl:35357/v3
password = placementpass
- ^$ u' ?( p1 Dusername = placement
  z; b+ M' v% s; b1 v& M* R1 @user_domain_name = Default
auth_type = password
project_name = service_test
3 E- Y" R% {; |: G% e  Pproject_domain_name = Default
os_region_name = RegionTWO
[quota]
[rdp]
[remote_debug]
[scheduler]
[serial_console]
8 i1 i( o: O4 |) U* @+ h  h[service_user]
[spice]
[ssl]
& A) i, {' Y. p; U2 h$ T8 f. @[trusted_computing]
7 d3 P7 t, w0 _  |2 h) p% I[upgrade_levels]
[vendordata_dynamic_auth]
[vmware]
# s8 |9 ?+ _( H5 H[vnc]
' O9 a4 ?1 @- ~( Qnovncproxy_base_url = http://ocataControl:6080/vnc_auto.html
vncserver_proxyclient_address = 192.168.221.30
9 X* e# H! q4 ^) `& ~vncserver_listen = 0.0.0.0
" l" y& z+ E8 Menabled = True
[workarounds]
[wsgi]
% b; v) R' ^7 a9 Y) ~, H$ g# x- s[xenserver]
- e5 y5 u2 b/ J' I% L( s+ W/ H[xvp]

admin

ConfigFilesPermissionDeniedError: Failed to open some config files: /usr/share/nova/nova-dist.conf,/etc/nova/nova.conf.

admin

# vim /usr/share/nova/nova-dist.conf

- D* t9 y* a$ ][DEFAULT]
% F  p! C, V# \& @* J: Clog_dir = /var/log/nova
% ?0 {/ ]1 |: J! j5 |state_path = /var/lib/nova
: I* V# ?% B; s0 b; xlock_path = /var/lib/nova/tmp
dhcpbridge = /usr/bin/nova-dhcpbridge
/ I! l; t7 p' |- r" cdhcpbridge_flagfile = /usr/share/nova/nova-dist.conf
' ^5 Q/ A7 [; R* U6 @; w( bdhcpbridge_flagfile = /etc/nova/nova.conf
force_dhcp_release = True
injected_network_template = /usr/share/nova/interfaces.template
. j! q4 q! J$ A- |/ I/ Dlibvirt_nonblocking = True
libvirt_inject_partition = -1
network_manager = nova.network.manager.FlatDHCPManager
6 A9 N- J7 [4 j; u  A5 j5 w1 acompute_driver = libvirt.LibvirtDriver
firewall_driver = nova.virt.libvirt.firewall.IptablesFirewallDriver
rootwrap_config = /etc/nova/rootwrap.conf
use_stderr = False

[database]
1 A4 k, n1 ^  H9 i$ |& e9 V" r7 k3 zconnection = mysql://nova:92e672789c1b9e@controller/nova
max_retries = -1
: n, ^# D4 x7 Q8 ]- \0 E$ [
  z# r% V: o8 ]6 l9 z& p3 A[keystone_authtoken]
' {3 F. k; M0 f+ w' S1 j! |0 o  sauth_host = 192.168.2.20
( @5 {" R' L6 b- u/ X- W5 oauth_port = 35357
auth_protocol = http

admin

# nova-status --log-file /var/log/nova/status.log upgrade check
Error:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 459, in main
4 ~4 `2 A* ?* ~. r& d4 H$ ?    ret = fn(*fn_args, **fn_kwargs)
; T% N0 S9 S7 A4 H( l- U  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 389, in check
6 E6 H( e; K' W/ V& H* p+ @    result = func(self)
6 v2 Y/ p2 _* v/ Q( ^6 Z  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 203, in _check_placement
    versions = self._placement_get("/")
; B( C$ T/ N6 s, F8 H1 i  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 191, in _placement_get
    return client.get(path, endpoint_filter=ks_filter).json()
3 ]6 P* a0 i# S0 @- z  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 845, in get
% ?/ H1 A* v+ f# G. ~4 w, b    return self.request(url, 'GET', **kwargs)
' h; V" @  D9 c% \+ }/ l  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
# [6 B1 Y7 c  g/ r    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 742, in request
    raise exceptions.from_response(resp, method, url)
- C. W4 G5 a1 @ServiceUnavailable: Service Unavailable (HTTP 503) (Request-ID: req-b587bc53-eb59-4976-b0c7-27dcddd14260)

admin

ausearch -c httpd
shows
$ I0 a% u8 _9 a
. F7 b" B. ?1 L4 n3 @' a/ g1 Etype=AVC msg=audit(1498146726.488:879): avc: denied { name_connect } for pid=6299 comm="httpd" dest=35357 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket permissive=0
This will make it work:
5 y2 B7 h2 @7 h. u% h3 w1 J
( a/ b3 P' t* Z! x: P: u; Z/ \8 V5 ~: lsetsebool -P httpd_can_network_connect 1