Before a container can start, the kubelet pulls its image. When that fails the Pod shows ErrImagePull, then ImagePullBackOff while the kubelet waits before trying again, and it alternates between the two with a growing delay. Nothing else can go wrong yet, because nothing has run.
Read the reference
kubectl describe pod market-web-5f7d-m2k8q | grep -A2 "Failed to pull"Failed to pull image "nginx:1.99": failed to pull and unpack image "docker.io/library/nginx:1.99":
failed to resolve reference "docker.io/library/nginx:1.99": docker.io/library/nginx:1.99: not foundThe message spells out the full reference the node asked for: registry, repository, tag. Read it word by word against what you meant.
| The message says | Usually means |
|---|---|
…/nginx:1.99: not found | the tag does not exist; check the registry's tag list |
…/monster-market-apy:v1: not found | a typo in the repository name |
pull access denied, unauthorized | a private image with no imagePullSecrets on the Pod |
toomanyrequests | the registry's rate limit; authenticate or mirror |
dial tcp … i/o timeout | the node cannot reach the registry |
Fix the reference
kubectl set image deploy/market-web nginx=nginx:1.27
kubectl rollout status deploy/market-webFor a Deployment, set image edits the template and rolls out a new ReplicaSet; the broken Pods disappear with the old one. A bare Pod can also be fixed in place with set image pod/NAME, since the image is one of the few fields a Pod allows you to change.
Pull policy
imagePullPolicy decides whether the kubelet pulls at all: IfNotPresent (the default) reuses a cached image, Always re-pulls on every start, Never only uses what is on the node. The tag latest defaults to Always, which is one reason to pin versions: a rollout should not change what runs just because the registry did.