Troubleshooting
Problem
When you install or upgrade to IBM Guardium Data Security Center version 3.7.0, the noobaa-core pod might fail to start successfully due to an image pull error.
Symptom
When you inspect the pods by using the following command, the
ImagePullBackOff error is displayed as shown in the following example.
oc get pods | grep nooba
noobaa-core-0 0/1 ImagePullBackOff 0 3h3m
noobaa-db-pg-0 1/1 Running 0 3h3m
noobaa-endpoint-867d9b9cf9-cbv6f 1/1 Running 0 3h3m
noobaa-endpoint-867d9b9cf9-nhxk9 1/1 Running 0 3h3m
noobaa-operator-689f446475-fzf8h 1/1 Running 0 3h3m
Cause
This error is caused when the noobaa-core service account is missing the IBM entitlement key. The entitlement key is needed to authenticate and pull the protected noobaa-core image from the IBM Container Registry. Without this key, the image pull fails and leads to the
ImagePullBackOff error.Diagnosing The Problem
When you run the
kubectl describe command on the noobaa-core pod, the output displays a series of error messages as shown in the following example.
Normal BackOff 5m20s (x5 over 5m50s) kubelet Back-off pulling image "cp.icr.io/cp/ibm-guardium-data-security-center/noobaa-core@sha256:e0925c59c22123ac7173a98d7ab7d16a2c079d99b1c35b3602df755670bd723f"
Warning Failed 5m20s (x5 over 5m50s) kubelet Error: ImagePullBackOff
Warning Failed 5m20s (x3 over 5m49s) kubelet Error: ImagePullBackOff
Normal Pulling 5m7s (x3 over 5m50s) kubelet Pulling image "cp.icr.io/cp/ibm-guardium-data-security-center/noobaa-core@sha256:e0925c59c22123ac7173a98d7ab7d16a2c079d99b1c35b3602df755670bd723f"
Warning Failed 5m7s (x3 over 5m50s) kubelet Failed to pull image "cp.icr.io/cp/ibm-guardium-data-security-center/noobaa-core@sha256:e0925c59c22123ac7173a98d7ab7d16a2c079d99b1c35b3602df755670bd723f": Requesting bearer token: invalid status code from registry 400 (Bad Request)
Warning Failed 5m7s (x3 over 5m50s) kubelet Error: ErrImagePull
Normal BackOff 43s (x22 over 5m49s) kubelet Back-off pulling image "cp.icr.io/cp/ibm-guardium-data-security-center/noobaa-core@sha256:e0925c59c22123ac7173a98d7ab7d16a2c079d99b1c35b3602df755670bd723f"
Resolving The Problem
Add the IBM entitlement key as an image pull secret by applying the following patch to the noobaa-core service account.
export NAMESPACE=<your-namespace>
oc patch sa noobaa-core -n ${NAMESPACE} --type=json -p='[{"op": "add", "path": "/imagePullSecrets/-", "value": {"name": "ibm-entitlement-key"}}]'
oc delete pod noobaa-core-0 -n ${NAMESPACE}
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSWSZ5","label":"IBM Security Guardium Insights"},"ARM Category":[{"code":"a8m0z000000Gp0NAAS","label":"INSTALL UPGRADE MIGRATION"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"3.4.0;3.4.1"}]
Was this topic helpful?
Document Information
Modified date:
01 April 2025
UID
ibm17229778