<p>All of a sudden, I cannot deploy some images which could be deployed before. I got the following pod status:</p>
<pre><code>[root@webdev2 origin]# oc get pods 
NAME                      READY     STATUS             RESTARTS   AGE 
arix-3-yjq9w              0/1       ImagePullBackOff   0          10m 
docker-registry-2-vqstm   1/1       Running            0          2d 
router-1-kvjxq            1/1       Running            0          2d 
</code></pre>
<p>The application just won't start. The pod is not trying to run the container. From the Event page, I have got <code>Back-off pulling image &quot;172.30.84.25:5000/default/arix@sha256:d326</code>. I have verified that I can pull the image with the tag with <code>docker pull</code>.</p>
<p>I have also checked the log of the last container. It was closed for some reason. I think the pod should at least try to restart it.</p>
<p>I have run out of ideas to debug the issues. What can I check more?</p>

Devs love ZenUML
<p>You can use the '<em><strong>describe pod</strong></em>' syntax</p>
<p><strong>For OpenShift use:</strong></p>
<pre><code>oc describe pod &lt;pod-id&gt;  
</code></pre>
<p><strong>For vanilla Kubernetes:</strong></p>
<pre><code>kubectl describe pod &lt;pod-id&gt;  
</code></pre>
<p>Examine the events of the output.
In my case it shows <code>Back-off pulling image unreachableserver/nginx:1.14.22222</code></p>
<p>In this case the image <code>unreachableserver/nginx:1.14.22222</code> can not be pulled from the Internet because there is no Docker registry unreachableserver and the image <code>nginx:1.14.22222</code> does not exist.</p>
<p><strong>NB: If you do not see any events of interest and the pod has been in the 'ImagePullBackOff' status for a while (seems like more than 60 minutes), you need to delete the pod and look at the events from the new pod.</strong></p>
<p><strong>For OpenShift use:</strong></p>
<pre><code>oc delete pod &lt;pod-id&gt;
oc get pods
oc get pod &lt;new-pod-id&gt;
</code></pre>
<p><strong>For vanilla Kubernetes:</strong></p>
<pre><code>kubectl delete pod &lt;pod-id&gt;  
kubectl get pods
kubectl get pod &lt;new-pod-id&gt;
</code></pre>
<p>Sample output:</p>
<pre><code>  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  32s                default-scheduler  Successfully assigned rk/nginx-deployment-6c879b5f64-2xrmt to aks-agentpool-x
  Normal   Pulling    17s (x2 over 30s)  kubelet            Pulling image &quot;unreachableserver/nginx:1.14.22222&quot;
  Warning  Failed     16s (x2 over 29s)  kubelet            Failed to pull image &quot;unreachableserver/nginx:1.14.22222&quot;: rpc error: code = Unknown desc = Error response from daemon: pull access denied for unreachableserver/nginx, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Warning  Failed     16s (x2 over 29s)  kubelet            Error: ErrImagePull
  Normal   BackOff    5s (x2 over 28s)   kubelet            Back-off pulling image &quot;unreachableserver/nginx:1.14.22222&quot;
  Warning  Failed     5s (x2 over 28s)   kubelet            Error: ImagePullBackOff
</code></pre>
<p><strong>Additional debugging steps</strong></p>
<ol>
<li>try to pull the docker image and tag manually on your computer</li>
<li>Identify the node by doing a 'kubectl/oc get pods -o wide'</li>
<li>ssh into the node (if you can) that can not pull the docker image</li>
<li>check that the node can resolve the DNS of the docker registry by performing a ping.</li>
<li>try to pull the docker image manually on the node</li>
<li>If you are using a private registry, check that your <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="noreferrer">secret</a> exists and the secret is correct. Your secret should also be in the same namespace. Thanks <a href="https://stackoverflow.com/users/2677943/swenzel">swenzel</a></li>
<li>Some registries have firewalls that limit ip address access. The firewall may block the pull</li>
<li>Some CIs create deployments with temporary docker secrets. So the secret expires after a few days (You are asking for production failures...)</li>
</ol>
