nova-status upgrade check fail

admin

cat /etc/nova/nova.conf |grep -v ^# | grep -v ^$
) t% r; t1 P4 E5 h: N/ @[DEFAULT]
: W: |% R) t+ y, H* x4 sfirewall_driver = nova.virt.firewall.NoopFirewallDriver
use_neutron = True
my_ip = 192.168.221.30
) y- K8 G: n! ltransport_url = rabbit://openstack:rabbitpwd@ocataControl
enabled_apis = osapi_compute,metadata
2 i: A* n8 g1 b- ]8 i1 a# v7 l% _[api]
! Q# H2 f7 Y/ N' {1 q% w9 n$ ]auth_strategy = keystone
[api_database]
. A  m2 F+ G6 G' E[barbican]
[cache]
  H& n9 Z- A# U$ Z$ W6 \0 q[cells]
9 _7 ^- o  w9 r$ ^: p' j[cinder]
6 C* _) M5 o* A+ B8 m[cloudpipe]
[conductor]
. N% Q) L7 B# J6 G[console]
+ P5 M# `1 y7 @. |6 U1 M+ l& i: v3 K[consoleauth]
[cors]
[cors.subdomain]
  m: M8 [& a" H9 }  q[crypto]
+ _0 c9 R8 B& N1 f6 h4 I[database]
[ephemeral_storage_encryption]
[filter_scheduler]
[glance]
" r8 `; Q3 |! F4 ]2 X- Eapi_servers = http://ocataControl:9292
[guestfs]
/ ^5 d3 i! K. V1 k! x8 J2 o  j[healthcheck]
$ p- c/ v% F/ x+ X1 A- P+ k7 w[hyperv]
[image_file_url]
- y8 k# B" g. G! X[ironic]
[key_manager]
+ j4 {0 V* p2 T+ C& N[keystone_authtoken]
" c- o" n0 J; P6 M7 v% ?password = novapass
username = nova
, r& V( g: y& vproject_name = service_test
user_domain_name = default
8 a& r$ e1 ~: l* \4 lproject_domain_name = default
: N. @& W0 N/ Sauth_type = password
0 y. {; P  ~& M* i% U) Bmemcached_servers = ocataControl:11211
* J6 f% g0 q. Q! s; l, R- [9 aauth_url = http://ocataControl:35357
1 \% j( a- `5 qauth_uri = http://ocataControl:5000
[libvirt]
[matchmaker_redis]
7 @% _: y- ?7 o2 z0 p) m& r  j7 s. k[metrics]
[mks]
' `2 \4 o# I3 C  y6 J2 H8 \7 B/ g[neutron]
[notifications]
' d! w& _( ?* P# V[osapi_v21]
[oslo_concurrency]
. U4 X9 C: x1 ulock_path = /var/lib/nova/tmp
[oslo_messaging_amqp]
[oslo_messaging_kafka]
1 T' r" l% H4 U# H$ d[oslo_messaging_notifications]
7 f" ?/ f  m& d: P, {9 E[oslo_messaging_rabbit]
[oslo_messaging_zmq]
; v; \+ h  k6 P[oslo_middleware]
[oslo_policy]
! U* v) ?/ E3 Y5 o. {; k) A8 H3 H[pci]
# P$ j4 }" \2 {[placement]
, Q' a: {1 l% n# xauth_url = http://ocataControl:35357/v3
; O6 R+ H' R5 O2 o3 Npassword = placementpass
8 A" X6 }, A4 f: u' k+ {; ]username = placement
user_domain_name = Default
/ I5 t- o7 ^) L* v; S. s* nauth_type = password
" D' ?! _- E+ F) t5 g* G/ V2 x0 tproject_name = service_test
project_domain_name = Default
os_region_name = RegionTWO
[quota]
[rdp]
[remote_debug]
6 K* t4 {% L9 A  c& E* ]/ v[scheduler]
7 h" G- L, M# e- _+ j8 @" Y5 }" d; z[serial_console]
% j  W( K, B" F; |$ W6 [2 _" k, B[service_user]
3 \5 ]+ m) x$ V% u+ G% |9 V[spice]
# V7 E' a; u/ D/ l4 ]1 ?. a! _[ssl]
. q9 N' b) K0 W[trusted_computing]
" N  J* T/ p/ S[upgrade_levels]
[vendordata_dynamic_auth]
7 b* q- N6 G5 Z[vmware]
/ b  R$ }' c5 i; Y5 x[vnc]
novncproxy_base_url = http://ocataControl:6080/vnc_auto.html
0 {" s; A$ k% N9 J) R" [4 gvncserver_proxyclient_address = 192.168.221.30
7 R# W; z4 }' @5 }4 B! Bvncserver_listen = 0.0.0.0
& W- T) F) b; p. O. Ienabled = True
' M7 z5 \. C, W2 {6 O0 |4 g[workarounds]
[wsgi]
8 C6 U6 D$ d  u7 N2 |% n[xenserver]
[xvp]

admin

ConfigFilesPermissionDeniedError: Failed to open some config files: /usr/share/nova/nova-dist.conf,/etc/nova/nova.conf.

admin

# vim /usr/share/nova/nova-dist.conf

[DEFAULT]
log_dir = /var/log/nova
" Q# ?3 w  E- \$ W% ~3 E) hstate_path = /var/lib/nova
lock_path = /var/lib/nova/tmp
dhcpbridge = /usr/bin/nova-dhcpbridge
  R' o& D- Q3 \5 ?- ~3 t: ?dhcpbridge_flagfile = /usr/share/nova/nova-dist.conf
, I9 }' Z2 n2 L/ M  i) ddhcpbridge_flagfile = /etc/nova/nova.conf
force_dhcp_release = True
) z: r3 h) Y/ }; l3 r0 `; Y3 w- Jinjected_network_template = /usr/share/nova/interfaces.template
# h- ~8 q$ l- W. V. ?2 ylibvirt_nonblocking = True
$ h; }8 `0 }: {libvirt_inject_partition = -1
2 j2 n. T; l% b1 O2 F; V6 o0 U/ h  t! Tnetwork_manager = nova.network.manager.FlatDHCPManager
8 i6 M, X# h' F0 u+ bcompute_driver = libvirt.LibvirtDriver
firewall_driver = nova.virt.libvirt.firewall.IptablesFirewallDriver
1 |3 i/ a5 x; ]0 arootwrap_config = /etc/nova/rootwrap.conf
use_stderr = False
2 s. Q6 }) K) ]8 D5 `
0 D% N. q8 ~) q9 B7 u4 x8 F[database]
! \- k- Z- t: J. wconnection = mysql://nova:92e672789c1b9e@controller/nova
max_retries = -1
' C3 z, [4 z1 T3 I: z" z
( k- f' v: ~0 P. P[keystone_authtoken]
auth_host = 192.168.2.20
: L1 O- H* u) xauth_port = 35357
, I' X2 p6 T- h8 \# J+ Dauth_protocol = http

admin

# nova-status --log-file /var/log/nova/status.log upgrade check
/ {+ v  c4 C! j* cError:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 459, in main
+ U8 C; a; z, q( W6 {2 ]    ret = fn(*fn_args, **fn_kwargs)
  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 389, in check
    result = func(self)
  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 203, in _check_placement
; A7 L  {0 `" s5 v' e    versions = self._placement_get("/")
  File "/usr/lib/python2.7/site-packages/nova/cmd/status.py", line 191, in _placement_get
    return client.get(path, endpoint_filter=ks_filter).json()
  H  |" V4 w$ T% A) L& z1 g( m  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 845, in get
' A4 T$ n( E  T- Y5 B+ t! l: W    return self.request(url, 'GET', **kwargs)
6 s: Q+ D( F8 q( M( I8 T  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
6 t( U5 h6 r0 g  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 742, in request
    raise exceptions.from_response(resp, method, url)
( o/ j+ Y/ \/ hServiceUnavailable: Service Unavailable (HTTP 503) (Request-ID: req-b587bc53-eb59-4976-b0c7-27dcddd14260)

admin

ausearch -c httpd
% D# e% z/ L* A2 _7 ishows

type=AVC msg=audit(1498146726.488:879): avc: denied { name_connect } for pid=6299 comm="httpd" dest=35357 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket permissive=0
0 z5 }( n) d# o/ n, g5 u: ?: d- ZThis will make it work:
' J( [* s* v5 A7 b; Z7 O
! h/ R! d9 Q. Q& Usetsebool -P httpd_can_network_connect 1