County library catalog Pods on OKE stay ImagePullBackOff after the Deployment points at a private OCIR repository. What is the most likely missing piece?
Select an answer to reveal the explanation.
Short Explanation
Private OCIR is a locked staff room; the kubelet needs a badge. That badge is an imagePullSecret on the ServiceAccount or Pod. Public repos do not need it—private ones fail with ImagePullBackOff until credentials are present.
Full Explanation
When a Deployment references a private OCIR image, the kubelet must authenticate the pull. Attach an imagePullSecret to the Pod or its ServiceAccount unless a documented node-level OCIR integration already supplies credentials. Public OCIR repositories do not require that secret. ImagePullBackOff after switching to a private tag is the classic symptom of a missing pull secret, not a missing LoadBalancer in front of OCIR.