Bits of .NET

☸️ ImagePullBackOff Isn’t a Guessing Game

A pod stuck in ImagePullBackOff has exactly one root cause every time — Kubernetes can’t pull the container image — but there are only a handful of specific reasons why, and kubectl describe tells you exactly which one in the Events section, no guessing required.

🔍 Always Start Here

kubectl describe pod my-app-7d4f8
# Scroll to the Events section at the bottom - the exact error
# message from the container runtime is right there, e.g.:
#   "manifest for myregistry/app:v2.1 not found"
#   "unauthorized: authentication required"
#   "dial tcp: lookup myregistry.internal: no such host"

🐞 The Four Real Causes, Matched to Their Message

1. "manifest ... not found" / "not found" ->
   Wrong image name or tag - typo, or the tag was never pushed.

2. "unauthorized" / "authentication required" ->
   Private registry, and the pod has no (or the wrong)
   imagePullSecrets configured.

3. "dial tcp ... no such host" / timeout ->
   DNS or network issue reaching the registry - often a private
   registry unreachable from inside the cluster's network.

4. "too many requests" / rate limit ->
   Public registry (often Docker Hub) rate-limiting anonymous or
   free-tier pulls - needs authenticated pulls or a mirror.

✅ Fix for the Most Common Case: Missing imagePullSecrets

• Create a secret holding your registry credentials, then reference it in the pod spec — this is the fix for cause #2, by far the most frequent one.

🔑 Add Registry Credentials

kubectl create secret docker-registry regcred \
  --docker-server=myregistry.example.com \
  --docker-username=myuser \
  --docker-password=mypassword

# Then in your pod/deployment spec:
# spec:
#   imagePullSecrets:
#     - name: regcred

⚠️ Quick Sanity Check

• Try pulling the exact same image manually with ‘docker pull <image>:<tag>‘ from a machine with the same credentials — if that fails too, it confirms the problem is the image/registry, not Kubernetes.