registry

A registry stores repositories, which hold manifests, which point at content-addressed blobs. Being able to draw that hierarchy and the auth exchange around it accounts for essentially every pull failure, because each one is a specific step in it returning something other than 200.

A public registry throttles by source IP and your whole fleet shares one. Why fifty nodes count as a single anonymous user, and authentication and caching changes that reduce upstream demand.

Running pods already have their images, so a credential expiry is invisible until something needs to start. That gap is why this always surfaces during an unrelated incident, at the worst moment.