🧭 ImagePullBackOff explained
The node cannot pull the image: the name or tag is wrong, a private-registry credential is missing, or the registry is down. Kubernetes retries with a growing delay; that is the BackOff.
🔎 Check it by hand
- Read the pull error. The Events show the pull error.
kubectl describe pod <pod> -n <namespace>
- Read the image the deployment uses
kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].image}'
🎯 What kwatch sends
The message reads like this.
Example message
🟠 checkout is failing in shop (prod-eu-1) after the 10:01 release of registry.corp.example/shop/checkout:1.9.O. The previous image was registry.corp.example/shop/checkout:1.9.0. Its image cannot be pulled. Fix in: deployment/checkout → container app → image (registry.corp.example/shop/checkout:1.9.O). To see the rollout state, run kubectl rollout status deployment/checkout -n shop
For a registry that rejects credentials:
🟠 ledger in billing (prod-eu-1) cannot pull its image because registry registry.corp.example rejects the credentials. Its pods name no pull secret, so the registry sees anonymous pulls, and the registry answers "401 Unauthorized". Every error mentions it. Three failing workloads all depend on it. api and worker in shop are affected as well. To see why the container cannot start, run kubectl describe pod ledger-e005c2f7-c -n billing
⭐ Which edition
Community detects image pull failures. The parts of these messages that name the release ("after the 10:01 release") and the other affected workloads ("affected as well") are Pro-level analysis (recent changes and impact), so do not expect them in Community.
🚀 Install kwatch
One command, and it walks you through it.
/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"
Community is free forever; Pro is free during early access. See Installation and Community vs Pro.