Use device status, events, and the CLI to diagnose why upstream configuration changes are not reaching devices or why sync probes report failures.

Prerequisites

• You can run the Flight Control CLI and are logged in to the Red Hat Edge Manager service.
• The device or fleet references configuration through gitRef, httpRef, or secretRef.

Upstream change detected but device stays out of date

1. Confirm that a new template version exists for the fleet:

   flightctl get templateversions --fleetname <fleet_name>

   Look for a sync-driven name such as v1-8ebebaf8 in addition to spec-driven v1.

2. Check device update status:

   flightctl get device/<device_name> -o yaml

   Review status.updated.status and fleet controller annotations such as fleet-controller/templateVersion.

3. List recent events on the device:

   flightctl get events --field-selector 'involvedObject.kind=Device,involvedObject.name=<device_name>'

   Verify that DependencyChangeDetected is displayed after the upstream change. Inspect structured event details:

   flightctl get events --field-selector 'involvedObject.kind=Device,involvedObject.name=<device_name>,reason=DependencyChangeDetected' -o yaml

The event details include resourceKey and fingerprint values for the upstream resource that changed.

If a template version exists but the device remains OutOfDate, investigate agent connectivity and update errors by using Device update status and update state and Troubleshooting device error codes.

DependencySyncProbeFailed events

A DependencySyncProbeFailed warning indicates that Red Hat Edge Manager could not reach or authenticate to an upstream dependency during a sync cycle.

Common causes include:

• Invalid or expired credentials on the Repository resource
• Network or firewall rules blocking Git, HTTP, or the Kubernetes API
• HTTP endpoints that are unreachable or return server errors

Confirm that the repository is reachable:

flightctl get repository/<name>

The ACCESSIBLE condition should be True.

The event message is sanitized and does not include secrets. Fix the underlying repository or secret access, then wait for the next poll cycle or trigger a specification reconciliation if needed.

Inspect probe failure details:

flightctl get events --field-selector 'reason=DependencySyncProbeFailed' -o yaml

Secret informer disconnect or not running

Secret synchronization requires an in-cluster Red Hat Edge Manager deployment and a running flightctl-periodic service with permission to watch labeled secrets.

1. Confirm Red Hat Edge Manager is installed in the same cluster as the secrets.
2. Verify the secret label: flightctl.io/sync-<release_namespace>: "true".
3. Check periodic service logs for informer or watch errors:

   oc logs -n <release_namespace> deployment/flightctl-periodic --tail=200

4. If you use Prometheus, check that flightctl_dependency_sync_informer_connected is 1. A value of 0 indicates the informer is not connected.
5. Restart the flightctl-periodic deployment if the informer failed to start after RBAC or configuration changes.

For RBAC and labeling requirements, see Configuring synchronization in the Additional resources section.

Secret changes not detected

Verify all of the following:

• Red Hat Edge Manager is deployed in-cluster (secret informers are not started for off-cluster installations).
• The secret has the label flightctl.io/sync-<release_namespace>: "true".
• The flightctl-periodic deployment can list and watch secrets in the secret namespace (cluster-wide RBAC or namespace Role as required).
• The flightctl-worker service account can read the secret when rendering devices.

For labeling and RBAC, see Configuring synchronization in the Additional resources section.

HTTP resources not updating

• Confirm the Repository resource is accessible and ACCESSIBLE is True: flightctl get repository/<name>.
• Periodic sync uses conditional HEAD when the server returns ETag or Last-Modified. Endpoints without those headers are not actively probed. A sha256: fingerprint is recorded when configuration is rendered, not by the sync probe.
• Ensure the HTTP server returns ETag or Last-Modified if you need automatic change detection between device renders. To verify response headers:

  curl -I <endpoint-url>

• Parameterized suffix values are resolved per device; only devices whose resolved URL content changed are updated.

Git commits not applied

• Verify the fleet or device references the correct targetRevision and path.
• Allow up to one polling interval (default 15 minutes) after pushing a commit before expecting a new template version.
• Ensure the Repository is accessible from the Red Hat Edge Manager service and that credentials are valid.

Duplicate or ambiguous configuration provider names

Each config entry name in a device or fleet template must be unique. If two providers share a name, status.dependencySync.configRefs can be ambiguous and fleet reconciliation can fail.

Rename configuration providers so each name is unique, then re-apply the fleet or device specification.