Atlas: ImagePullBackOff / ErrImagePull

What this usually means

The kubelet cannot fetch the image from the registry. Until it can, the pod cannot start, and there is no deeper application signal to interpret.

Likely causes

Pull failures are boring. Treat them as a checklist, not a mystery.

• Wrong image reference (typo, missing tag, private registry path).
• Missing/incorrect imagePullSecrets or service account config.
• Egress restrictions (NAT, firewall, NetworkPolicy outside cluster, proxy).
• Registry rate limiting or transient registry outage.
• Node DNS issues resolving the registry host.

What to inspect first

Start with events. They usually name the exact failure.

• Look for: `Failed to pull image`, `unauthorized`, `not found`, `i/o timeout`.
• Confirm which serviceAccountName the pod uses.
• Confirm imagePullSecrets exist and are referenced correctly.

kubectl describe pod <pod> -n <ns>
kubectl get sa <sa> -n <ns> -o yaml

Resolution guidance

Fix the governing mechanism, then verify a clean pull on new pods.

• Correct the image reference; prefer immutable tags/digests for critical workloads.
• Attach imagePullSecrets to the service account (namespace-scoped) if appropriate.
• If egress/DNS is the issue, confirm node-level resolution and outbound routing.