Question

A newly deployed pod in the 'payments' namespace remains in ImagePullBackOff. The image is hosted in a private registry at registry.internal.corp/payments/api:v2.3. Running 'kubectl describe pod' shows the event: 'Failed to pull image ... failed to authorize: 401 Unauthorized'. Other pods in the 'default' namespace pull from the same registry successfully. What is the most likely cause and correct fix?

Accepted Answer

The imagePullSecret exists only in the 'default' namespace; create the docker-registry secret in the 'payments' namespace and reference it in the pod's imagePullSecrets.

Answer

The image tag v2.3 does not exist in the registry; edit the deployment to use the 'latest' tag instead.

Answer

CoreDNS cannot resolve registry.internal.corp; restart the CoreDNS deployment to refresh its cache.

Answer

The node's container runtime is out of disk space; drain the node and prune unused images.