Always heads to the red box without checking, and IfNotPresent ends up there too when CRI doesn't know the image How kubelet decides to pull An empty policy is filled in from the tag imagePullPolicy defaultlatest · no tag → Alwaysanything else → IfNotPresent Alwayspulls even if the node has it IfNotPresentasks CRI by name · tagfound → run itmissing → pull pull → no registry → ErrImagePull The three cases here1latest → Always2name or tag differs → missing3imported, CRI can't see it → missing Infra · KubernetesKubernetes on‑premises ErrImagePullpulling an image that's already thereWhen customers called because an installed service wouldn't start, the pod was usually in ErrImagePull, sometimes ImagePullBackOff. At first that puzzled me.Oct 21, 2026