When something is wrong
Start here:
kubectl -n <your-namespace> describe kvsyncThe resource reports one reason, and the reasons are kept apart because each sends you somewhere different — the network, the token, your cluster, or the manifest.
Synced
Nothing is wrong: the last sync succeeded.
If values still are not reaching your application, the Secret is current and
your pods are not. See Restarting workloads.
Find the reason
Reaching kyvlt.sh
Unreachable, Unauthorised, Forbidden, NotFound, Incompatible.
The cluster and the resourceNamespaceNotServed, TargetNamespaceRefused, Misconfigured, Unresolvable, Conflict.
Keys and scopeScopeInvalid, NameCollision, PartialFailure.
You can also paste a reason into the search box: every one of them has a section named after it.