ImagePullBackOff root cause

Surface registry pull failures: bad tag, missing imagePullSecret, or rate limit

kubectl get events -n <ns> --field-selector reason=Failed -o wide | grep -i 'pull\|manifest\|unauthorized'

More k8s-debug commands

Cleanup evicted pods

kubectl get po -A | grep Evicted | awk '{print $2" -n "$1}' | xargs -L1 kubectl delete po

Bulk-delete all Evicted pods left behind by node-pressure eviction
Force-remove stuck Terminating pod

kubectl patch po <pod> -n <ns> -p '{"metadata":{"finalizers":null}}' --type=merge; kubectl delete po <pod> -n <ns> --grace-period=0 --force

Clear finalizers to unstick a pod hung in Terminating; note: confirm node is gone first
Raw kubelet stats summary

kubectl get --raw /api/v1/nodes/<node>/proxy/stats/summary | jq '.pods[] | {name:.podRef.name, mem:.memory.workingSetBytes}'

Pull live per-pod memory from kubelet Summary API, bypassing metrics-server
Conntrack stats on node

kubectl debug node/<node> -it --image=nicolaka/netshoot -- conntrack -S

Check per-CPU conntrack drops/insert_failed; nf_conntrack table exhaustion drops packets
In-cluster DNS resolution test

kubectl run dnstest --rm -it --image=nicolaka/netshoot --restart=Never -- dig +short <name>.<ns>.svc.cluster.local

Resolve a Service FQDN from an ephemeral pod to isolate CoreDNS vs app DNS issues