ImagePullBackOff: the image exists, you can pull it by hand, and the pod still cannot

verbatim errorFailed to pull image "our-registry.acme.io/app:1.4.2": failed to resolve reference "our-registry.acme.io/app:1.4.2": unauthorized: authentication required Warning: ImagePullBackOff

Problem

Failed to pull image "our-registry.acme.io/app:1.4.2": failed to resolve reference "our-registry.acme.io/app:1.4.2": unauthorized: authentication required
Warning: ImagePullBackOff

docker pull our-registry.acme.io/app:1.4.2 from a laptop: works. The same image on the same tag from a laptop with kubectl access applied to the same cluster: backoff loop.

Root cause

The laptop is logged into the registry; the node is not. Pods pull with the node's (or secret's) credentials, not yours. The three real shapes of ImagePullBackOff:

1. Private registry, no imagePullSecrets — the 90% case for the "unauthorized" flavor. 2. Tag does not exist — a CI pipeline pushed to a different tag than the manifest references, or used :latest while the cluster has imagePullPolicy: IfNotPresent and an old cached latest. 3. Rate limiting (Docker Hub) — toomanyrequests: You have reached your pull rate limit, which presents identically to a human skimming kubectl get pods.

fix preview — first 3 of 4 lines (bash), truncated:

kubectl describe pod app-7d9c6b5f4-xqz2l | grep -A4 Events | tail -5
# "unauthorized" -> auth problem
# "not found" / "manifest unknown" -> tag problem
… 1 more line in the fix

🔒 the fix — including 3 code blocks — is members-only. $1/mo unlocks everything.