A housing agent Deployment on AKS shows ImagePullBackOff after a registry change. What is the most appropriate first remediation focus?

ImagePullBackOff means the kubelet cannot pull the housing agent image after a registry change—most often ACR authentication, missing image name/tag, or wrong pull secret/identity. The first remediation focus is verifying the AKS cluster can authenticate to Azure Container Registry and that the referenced repository and tag (or digest) exist. Fixing pull identity and image reference restores the Deployment without distracting into unrelated generative-quality work.

Rewriting the generative system prompt fails by concept because ImagePullBackOff is a container runtime pull failure, not a model answer-quality signal; prompts never execute if the pod cannot start. Deleting the entire AKS cluster before inspecting pull credentials fails because it is disproportionate destruction that skips root-cause diagnosis and prolongs outage. Switching to Docker Hub anonymous latest tags without checking ACR access fails because it changes trust and supply chain, may pull the wrong bits, and still avoids validating the municipal registry path that broke.

Exam caveat: After AKS-ACR integration changes (AcrPull on kubelet identity, imagePullSecrets, private endpoints), ImagePullBackOff is a classic symptom. ErrImagePull/ImagePullBackOff are pull problems; CrashLoopBackOff is a different class (process exits after start). Always confirm tag existence in ACR, not only cluster credentials.

Operational check: Describe the failing pod events, verify the image string, test that the cluster's pull identity has AcrPull on the registry, confirm the tag exists in ACR, fix the Deployment or attachment, and watch the housing agent pods reach Running. Avoid cluster rebuild as a first step.