How to fix Failed to pull image, ImagePullBackOff, ErrImagePull in Kubernetes

# Check pod status:
kubectl describe pod -n <namespace> <pod-name>

# Look for:
# - Failed to pull image ...
# - Error response from daemon
# - Reason: ImagePullBackOff

# Check image reference in deployment:
kubectl get deployment -n <namespace> <name> -o yaml | grep -A 3 "image:"

# Check which registry is being used:
kubectl get pod -n <namespace> <pod-name> -o jsonpath='{.spec.containers[0].image}'

# For Docker Hub:
curl -s https://hub.docker.com/v2/repositories/<user>/<image>/tags | jq '.results[].name'

# For Docker Hub with specific tag:
docker pull <username>/<image>:<tag>

# For private registry:
podman login <registry>
podman pull <registry>/<image>:<tag>

# Or test from pod:
kubectl run -it --rm debug --image=alpine -- sh
apk add curl
curl -u <user>:<token> https://registry/v2/<image>/manifests/<tag>

# Find the correct image reference:
# Format: [registry/]image:tag

# Common examples:
# - nginx:latest (Docker Hub)
# - gcr.io/project/image:v1.0
# - registry.example.com:5000/myapp:latest

# Update deployment:
kubectl set image deployment/<name> <container>=<correct-image> -n <namespace>

# Or edit directly:
kubectl edit deployment -n <namespace> <name>
# Change container.image field

# Verify the change:
kubectl get deployment -n <namespace> <name> -o yaml | grep image:

# Create Docker config credentials:
kubectl create secret docker-registry myregistry \
  --docker-server=<registry> \
  --docker-username=<user> \
  --docker-password=<token> \
  --docker-email=<email> \
  -n <namespace>

# Or for Kubernetes API token:
kubectl create secret docker-registry myregistry \
  --docker-server=gcr.io \
  --docker-username=_json_key \
  --docker-password="$(cat ~/key.json)" \
  -n <namespace>

spec:
  template:
    spec:
      imagePullSecrets:
      - name: myregistry
      containers:
      - name: app
        image: registry.example.com/app:v1

# Get secret contents:
kubectl get secret <secret-name> -n <namespace> -o jsonpath='{.data..dockerconfigjson}' | base64 -d | jq .

# Test credentials manually:
kubectl run -it --rm debug \
  --image-pull-policy=Never \
  --image=alpine \
  --overrides='{"spec":{"serviceAccount":"default"}}' \
  -- sh

# Inside pod, test registry:
apk add curl
curl -u <user>:<password> https://<registry>/v2/_catalog

# From a node, test:
ping <registry-host>
nslookup <registry-host>
curl -v https://<registry>/v2/

# From a pod:
kubectl run -it --rm debug --image=alpine -- sh
apk add curl
curl -v https://docker.io/v2/
curl -v https://<private-registry>/v2/

# Check firewall rules:
# - Port 443 (HTTPS) must be open
# - No corporate proxies blocking
# - DNS must resolve registry hostname

# Check node architecture:
kubectl get nodes -o jsonpath='{.items[*].status.nodeInfo.architecture}'

# Check image architecture:
docker image inspect <image> | jq '.Architecture'
# Or for multi-arch images:
docker manifest inspect <image>:tag | jq '.manifests[].platform'

# If mismatch, use platform-specific image:
# AMD64: ubuntu:latest
# ARM64: ubuntu:latest-arm64
# ARM32: ubuntu:latest-arm32v7

# Update deployment with correct architecture:
kubectl set image deployment/<name> <container>=<image>-arm64

# Force pod recreation:
kubectl rollout restart deployment -n <namespace> <name>

# Watch for image pull:
kubectl get pods -n <namespace> -w

# Check pod events:
kubectl describe pod -n <namespace> <new-pod-name> | tail -20

# Verify pod is Running:
kubectl get pods -n <namespace> | grep <deployment>

# Check actual image used:
kubectl get pods -n <namespace> <pod-name> -o jsonpath='{.spec.containers[0].image}'