Sync is not running

1. Confirm vulnerabilityReporting.enabled is true in the configuration used by flightctl-periodic.
2. Confirm vulnerabilityReporting.trustify.endpoint is set and reachable from the periodic service host or pod.
3. Review periodic service logs for lines containing vulnerability-sync.

Authentication errors

If logs report Red Hat Trusted Profile Analyzer authentication errors:

1. Verify trustify.auth.mode is none or client-credentials as appropriate.
2. For client-credentials, confirm the OIDC issuer URL is reachable. Verify that <oidcIssuerUrl>/.well-known/openid-configuration is accessible from the periodic service.
3. Verify the client ID and secret in the Kubernetes secret or environment variables.

No vulnerability data is displayed

If sync succeeds but flightctl get vuln returns no rows:

1. Run flightctl get device/<device_name> -o yaml and confirm status.os.imageDigest is populated.
2. Confirm Red Hat Trusted Profile Analyzer has SBOM or advisory data for those digests. See SBOM requirements for Red Hat Trusted Profile Analyzer.
3. Check periodic logs for Syncing vulnerabilities for N unique image digests.

Feature disabled responses

If API or CLI calls return HTTP 501 Not Implemented with reason: FeatureDisabled, enable vulnerability reporting as described in Configuring vulnerability reporting.

HTTP 503 Service Unavailable indicates a transient dependency failure (for example, the database or Red Hat Trusted Profile Analyzer is unreachable), not a disabled feature.