It is Monday morning. Overnight the platform team migrated the container registry. Now about half the pods across three namespaces are stuck in ImagePullBackOff and new deploys will not start. You are on call. What do you do?

The follow-ups they ask next

• How would you have caught this before the migration?

  A pre cutover check that pulls every distinct image reference in the cluster from the new registry, plus a canary namespace cut over first. Say you would have asked for that in the migration review.

• The error says manifest unknown, not unauthorized. Where do you go?

  That is a path or tag problem, not credentials. Check whether the migration copied all tags, whether the repository name changed case, and whether anything still references a mutable tag like latest that was never mirrored.

• A node reboots mid incident and takes down four healthy pods. What now?

  That is exactly why you froze scaling. Cordon the remaining nodes, and if the pull is still broken, patch the deployment to the old registry reference as a temporary rollback while the real fix lands.

What the interviewer is listening for

• Realises running pods survive on cached images and protects them by freezing scaling
• Reads the literal pull error instead of reacting to the state name
• Tests the image pull by hand from a node to prove the hypothesis
• Names concrete ECR permissions and imagePullSecret as the likely suspects

What sinks the answer

• Escalates and waits without gathering a single diagnostic
• Restarts all deployments, which turns a partial outage into a full one
• Cannot distinguish unauthorized from manifest unknown
• Never mentions freezing deploys or autoscaling during the incident