← Problem Library
K8s L6 K8S 1357 · 15 min

A kubeadm worker join passes and pods cannot pull images

The node joins successfully, yet sandbox creation fails because the node runtime still references a registry path that is no longer reachable.

K8sPlatform ReliabilityLevel 6Pro15 min
Scenario

A cluster migrates to a private mirror and later freshly joined workers alone fail to start pods even though control-plane nodes are healthy.

What to check first
  • Identify the primary failure signal in the The Node Joined the Cluster and Kept the Previous Bootstrap Registry Contract scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare node-level runtime defaults against current cluster image policy before editing pull secrets.

Questions worth viewing together
What should you verify first when A kubeadm worker join passes and pods cannot pull images appears?

Community-field Kubernetes problem inspired by kubeadm and containerd discussions where newly joined workers still referenced an old pause image registry. Successful node join does not prove the node runtime inherited the same registry assumptions as the cluster.

What usually causes A kubeadm worker join passes and pods cannot pull images in production?

Teams often blame imagePullSecrets when the node sandbox image itself still points at the old registry path.

What should you document after resolving A kubeadm worker join passes and pods cannot pull images?

Cluster bootstrap docs should be updated alongside registry migration, not after new nodes start failing.