Description of problem:
In puppet openstack we're having issues when glance-api attempts to talk to keystone for authtoken. The audit.log points to glance-api being denied access to talk to keystone

type=AVC msg=audit(1495149250.981:3409): avc:  denied  { name_connect } for  pid=24381 comm="glance-api" dest=35357 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1495149250.981:3409): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7ffdb097cac0 a2=10 a3=1 items=0 ppid=24370 pid=24381 auid=4294967295 uid=161 gid=161 euid=161 suid=161 fsuid=161 egid=161 sgid=161 fsgid=161 tty=(none) ses=4294967295 comm="glance-api" exe="/usr/bin/python2.7" subj=system_u:system_r:glance_api_t:s0 key=(null)
type=SERVICE_STOP msg=audit(1495149365.518:3410): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1495149365.518:3411): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1495149411.574:3412): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1495149411.575:3413): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1495149419.392:3414): avc:  denied  { name_connect } for  pid=24457 comm="glance-api" dest=35357 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1495149419.392:3414): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7ffe5d766950 a2=10 a3=1 items=0 ppid=24445 pid=24457 auid=4294967295 uid=161 gid=161 euid=161 suid=161 fsuid=161 egid=161 sgid=161 fsgid=161 tty=(none) ses=4294967295 comm="glance-api" exe="/usr/bin/python2.7" subj=system_u:system_r:glance_api_t:s0 key=(null)
type=SERVICE_STOP msg=audit(1495149499.384:3415): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1495149499.385:3416): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=openstack-glance-api comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1495149503.842:3417): avc:  denied  { name_connect } for  pid=24486 comm="glance-api" dest=35357 scontext=system_u:system_r:glance_api_t:s0 tcontext=system_u:object_r:keystone_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1495149503.842:3417): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=7fffada69630 a2=10 a3=1 items=0 ppid=24475 pid=24486 auid=4294967295 uid=161 gid=161 euid=161 suid=161 fsuid=161 egid=161 sgid=161 fsgid=161 tty=(none) ses=4294967295 comm="glance-api" exe="/usr/bin/python2.7" subj=system_u:system_r:glance_api_t:s0 key=(null)



Version-Release number of selected component (if applicable):
[root@centos-libvirt-7-x64 ~]# rpm -qa | grep selinux
libselinux-utils-2.5-6.el7.x86_64
libselinux-python-2.5-6.el7.x86_64
libselinux-2.5-6.el7.x86_64
selinux-policy-targeted-3.13.1-102.el7_3.16.noarch
openstack-selinux-0.8.6-0.20170516203045.c2d92fe.el7.centos.noarch
selinux-policy-3.13.1-102.el7_3.16.noarch
[root@centos-libvirt-7-x64 ~]# rpm -qa | grep glance
python2-glance-store-0.20.1-0.20170504204005.a783a74.el7.centos.noarch
openstack-glance-15.0.0-0.20170511190327.70d51c7.el7.centos.noarch
python2-glanceclient-2.6.0-0.20170206164205.9afb56c.el7.centos.noarch
python-glance-15.0.0-0.20170511190327.70d51c7.el7.centos.noarch
How reproducible:


Steps to Reproduce:
1. install glance with selinux enabled
2. attempt to run a glance api request
3. get 500 with an error in the logs indicating DiscoveryFailure: Could not determine a suitable URL for the plugin