Introduction ImagePullBackOff means Kubernetes cannot pull the container image. This is one of the most common pod failures and is caused by authentication issues with private registries, incorrect image names/tags, or network problems reaching the registry.

Symptoms - `kubectl get pods` shows STATUS = ImagePullBackOff or ErrImagePull - `kubectl describe pod` shows: "Failed to pull image: unauthorized" or "manifest unknown" - Events show: "Back-off pulling image" - Pod remains in Pending state indefinitely

Common Causes - Missing imagePullSecrets in pod spec - ImagePullSecret expired (Docker Hub token, ECR credentials) - Image tag does not exist or was deleted - Typo in image name or registry URL - Network policy blocking access to container registry

Step-by-Step Fix 1. **Check pod events for specific error**: ```bash kubectl describe pod <pod-name> -n <namespace> # Look at Events section for exact pull error ```

  1. 1.Verify imagePullSecrets exist:
  2. 2.```bash
  3. 3.kubectl get secret regcred -n <namespace>
  4. 4.kubectl get serviceaccount default -n <namespace> -o jsonpath='{.imagePullSecrets}'
  5. 5.`
  6. 6.Create or update imagePullSecret:
  7. 7.```bash
  8. 8.kubectl create secret docker-registry regcred \
  9. 9.--docker-server=myregistry.example.com \
  10. 10.--docker-username=myuser --docker-password=mypass \
  11. 11.--namespace <namespace>
  12. 12.`
  13. 13.Verify the image exists and tag is correct:
  14. 14.```bash
  15. 15.docker pull myregistry.example.com/my-app:v1.2.3
  16. 16.`
  17. 17.Fix the deployment image reference:
  18. 18.```bash
  19. 19.kubectl set image deployment/my-app my-container=myregistry.example.com/my-app:v1.2.3 -n <namespace>
  20. 20.`

Prevention - Use image digest pins (sha256:...) instead of tags for reproducibility - Automate imagePullSecret rotation before expiration - Validate image existence in CI/CD before deploying - Use admission webhooks to prevent deployments with missing secrets - Monitor ImagePullBackOff events with alerts