Troubleshooting GitOps deployments - Administrator Guide - Cortex CLOUD

KSPM-Documentation

Product
Cortex Cloud Application Security > Cortex CLOUD
Creation date
2025-05-11
Last date published
2026-06-11
Category
Administrator Guide

Diagnose and resolve deployment or synchronization issues with your Kubernetes Connector. Use your controller's logs and diagnostic commands to investigate failures, force state reconciliations, and fix common errors for Flux and ArgoCD.

Controller logs

If resources fail to sync, check the controller logs:

  • Flux logs: Git fetch issues: kubectl logs -n flux-system deploy/source-controller.

    • Helm install issues: kubectl logs -n flux-system deploy/helm-controller.

    • Build issues: kubectl logs -n flux-system deploy/kustomize-controller.

  • ArgoCD logs:

    • Sync issues: kubectl logs -n argocd deploy/argocd-application-controller.

    • Git/Helm issues: kubectl logs -n argocd deploy/argocd-repo-server.

Advanced diagnostics
  • View applied values (Flux): Run helm get values kspm-agent -n panw -a to see what values Flux successfully merged and applied.

  • View rendered manifests (ArgoCD): Run argocd app manifests kspm-agent to see what ArgoCD would apply (dry-run) or argocd app diff kspm-agent to compare live vs. desired state.

  • Force hard refresh (ArgoCD): If the repo is out of sync, force a re-fetch and re-render using argocd app get kspm-agent --hard-refresh.

Common issues diagnosis

Flux issues:

  • GitRepository not ready: Check URL, credentials, and network connectivity.

  • Kustomization failed: Check relative paths in your kustomization.yaml file.

  • ConfigMap not found: Ensure the ConfigMap namespace identically matches the HelmRelease namespace.

ArgoCD issues:

  • ComparisonError: Chart rendering failed. Check chart path and values.yaml syntax.

  • SyncError: Resources cannot be applied to the cluster. Check RBAC, namespace constraints, or resource conflicts.

  • OutOfSync but won't sync: Auto-sync has been disabled. Either manually sync or re-enable the auto-sync policy.