Kubernetes pod stuck in ImagePullBackOff or ErrImagePull ('Failed to pull image', 'pull access denied', 'manifest unknown'): how do I find the cause and fix it?

Cause: the kubelet on the node could not download the container image. ErrImagePull is the first failure; after repeated failures the status becomes ImagePullBackOff while the kubelet retries with increasing delays. Typical causes are a typo in the image name or tag, a tag that was never pushed, a private registry with no credentials (or credentials in the wrong namespace), or a node that cannot reach the registry (DNS, proxy, firewall, rate limits). Fix (best first): 1. Read the exact reason: kubectl describe pod POD_NAME and look at the Events at the bottom. The message after "Failed to pull image" says whether it is not found, unauthorized or a network error. 2. Check the image reference character by character (registry host, repository, tag). Confirm the tag exists in the registry and try pulling it by hand from a machine with the same network path. 3. For a private registry, create a pull secret in the same namespace as the pod: kubectl create secret docker-registry regcred --docker-server=REGISTRY_HOST --docker-username=USER --docker-password=TOKEN -n NAMESPACE. Then reference it in the pod template: spec.imagePullSecrets with name: regcred. Use a scoped read-only token rather than a personal password. The secret must be in the pod's namespace; a secret in another namespace is ignored. 4. Pin images by digest or a specific version tag instead of :latest so a registry-side change cannot give you a surprise version. Remember the default pull policy is IfNotPresent, so a node may keep using a cached older image under the same tag. 5. If events show timeouts or DNS errors, test registry access from the node itself (not just your laptop), and check egress rules, proxy settings for the container runtime, and registry rate limits. 6. After correcting the Deployment, new pods are created automatically. For a bare pod, delete and re-apply it. Verify: kubectl get pods shows the pod Running, and kubectl describe pod shows "Successfully pulled image" followed by Started events. Sources: https://kubernetes.io/docs/concepts/containers/images/ https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ https://kubernetes.io/docs/tasks/debug/debug-application/debug-pods/