We've recently encountered two separate problems causing nodes to get stuck
on an old release of Fedora CoreOS. Both issues should primarily affect
machines which have been offline for an extended period. Nevertheless, you
may wish to check whether any of your nodes are unexpectedly running a
CoreOS release older than 20200715. If so, see below for mitigation
There are two issues:
1. Due to an interaction with ostree downgrade protection, older versions
of Fedora CoreOS could fail to apply updates  when there are update
barriers  in the update graph. We applied a server-side workaround 
for several releases after the bug was fixed, but some nodes that were
offline during that period will not successfully update to current releases.
2. In April we began migrating the Cincinnati update service from the
Fedora staging cluster at updates.coreos.stg.fedoraproject.org
production cluster at updates.coreos.fedoraproject.org
. The staging cluster
was removed from service as part of the Fedora datacenter move , and
there are no short-term plans  to restore it. Any nodes that have not
updated since the migration will fail to update to current releases.
If you have nodes affected by either problem, the following commands should
correct the issue:
sudo tee /run/zincati/config.d/99-fixes.toml << EOF
base_url = "https://updates.coreos.fedoraproject.org"
allow_downgrade = true
sudo systemctl restart zincati.service
This procedure does not make any persistent configuration changes to the
system, so no further action is necessary after the node updates.
If you have any questions, you can connect with us on the CoreOS mailing
list , Fedora Discourse , or #fedora-coreos on Freenode.