ImagePullBackOff means the kubelet tried to pull your container image, failed, and is now backing off before trying again. The pod never runs — it can't even start. Unlike CrashLoopBackOff (where the container starts and then dies), this failure is entirely about getting the image.
Read the real error first
The pod status is a summary; the events tell you why:
kubectl describe pod <pod> | sed -n '/Events:/,$p' # look for the exact reason on the "Failed" line
Three causes cover almost everything: the image name or tag is wrong (typo, or a tag that was never pushed), the registry is private and the pod has no pull secret, or the node genuinely can't reach the registry.
The common one: a missing pull secret
A failed to authorize: unauthorized in the events means the kubelet pulled anonymously against a private registry. Create a pull secret and reference it from the pod spec:
kubectl create secret docker-registry regcred \ --docker-server=registry.internal --docker-username=... --docker-password=... # then in the Deployment pod spec: # imagePullSecrets: # - name: regcred kubectl rollout restart deployment/web_app
Practise it
ImagePullBackOff is one of the Kubernetes incidents in the simulator. Work it alongside CrashLoopBackOff in a full incident response shift.