Fix ImagePullBackOff and ErrImagePull in Kubernetes

A pod stays in `ImagePullBackOff` or `ErrImagePull`. The container image cannot be pulled from the registry.

• Image tag does not exist (typo or moved tag).
• Private registry without an `imagePullSecret`.
• Expired registry credentials.
• Node cannot reach the registry (DNS, firewall, airgap).

Confirm the exact error

kubectl describe pod <pod> | grep -A2 'Failed'

Create a pull secret

kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=USER \
  --docker-password=TOKEN

Reference it in the Deployment

spec:
  imagePullSecrets:
    - name: regcred
  containers:
    - name: api
      image: registry.example.com/api:1.4.2