Challenge Easy

Troubleshoot a Deployment Stuck in ImagePullBackOff

Omkar Shelke
by  Omkar Shelke · on
Kubernetes
A Deployment pulls its image from a private container registry, and its Pods are stuck in ImagePullBackOff. Create a registry Secret and update the Deployment manifest to get the Pods running.
#secrets#container-registry#imagepullbackoff#ckad#cka

Scenario

The catalog Deployment in the shop namespace runs an image from the team's private container registry:

registry.iximiuz.com/shop/catalog:v1

The Deployment was applied without any registry credentials, and its Pods are stuck in ImagePullBackOff. From cplane-01:

kubectl get pods -n shop

NAME                       READY   STATUS             RESTARTS   AGE
catalog-647b446c54-6l8bz   0/1     ImagePullBackOff   0          43s
catalog-647b446c54-jkmt5   0/1     ImagePullBackOff   0          43s

The team's registry credentials:

RegistryUsernamePassword
registry.iximiuz.comshop-ciPull-Catal0g-2026

The manifests are on cplane-01:

/home/laborant/shop/
├── catalog-deployment.yaml  # update this file
├── ingress.yaml             # do not change
├── namespace.yaml           # do not change
└── service.yaml             # do not change

Task

Fix the ImagePullBackOff error of the catalog Pods:

  1. Create a Secret with these properties:
    PropertyValue
    Nameregistry-creds
    Namespaceshop
    Typekubernetes.io/dockerconfigjson
    ContentThe registry credentials above
  2. Update the Deployment manifest /home/laborant/shop/catalog-deployment.yaml so that its Pods pull the image with the registry-creds Secret, and apply it.

When the Pods run, http://catalog.shop.local shows the catalog page.

Important

Keep the image registry.iximiuz.com/shop/catalog:v1 and its imagePullPolicy as they are. Do not change the Service or the Ingress.

Hint 1 | Why the Pods do not start

The Pod events say what goes wrong when the node tries to pull the image:

kubectl describe pod <pod-name> -n <namespace>
Hint 2 | Registry credentials in Kubernetes

kubectl create secret has a subcommand made for registry credentials. To find how a Pod refers to such a Secret, explore the Pod spec:

kubectl create secret --help
kubectl explain pod.spec

⚒ Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge pull-image-from-private-registry-66a47c47

This will create a local copy of the challenge content in a directory named pull-image-from-private-registry-66a47c47. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge pull-image-from-private-registry-66a47c47

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge