By default will pull an image from Docker Hub.
If 'image' field on Pod just references a name like "nginx", it’s probably trying to download this image from Docker Hub.
This pod spec doesn’t reference a registry, so it’ll probably look in Docker Hub first.

# EXAMPLE :-
apiVersion: v1
kind: Pod
metadata:
  name: mytest
  namespace: default
spec:
  containers:
  - image: nginx
    name: nginx

[Updating Images]
When you first create a Deployment, StatefulSet, Pod, or other object that includes a Pod template, then by default the pull policy of all containers in that pod will be set to IfNotPresent if it is not explicitly specified.
This policy causes the kubelet to skip pulling an image if it already exists.
The "imagePullPolicy" for a container and the tag of the image affect when the kubelet attempts to pull (download) the specified image.
The list of the values you can set for imagePullPolicy and the effects these values have -

● IfNotPresent - 
The image is pulled only if it is not already present locally. (OR) 
Only pull the image if it does not already exist on the node. (OR) 
It will pull the new image in cluster if the image is not present.
# Syntax :->        imagePullPolicy: IfNotPresent

● Always - 
Always pull the image. (OR) 
It always pull the image in container.
# Syntax :->        imagePullPolicy: Always

● Never - 
The kubelet does not try fetching the image. If the image is somehow already present locally, the kubelet attempts to start the container otherwise startup fails. (OR) 
Never pull the image.
# Syntax :->        imagePullPolicy: Never

[Secrets with Docker]
Most enterprises typically use an internal private container registry instead of DockerHub because they don’t want to push their internal applications to someone outside their organization.
Even with DockerHub or any other publicly accessible password-protected registry, you must provide proper credentials to Kubernetes using the "secret" to pull the image from the registry.
● imagePullSecrets -
Specifying ImagePullSecrets on a Pod - only pods which provide own keys can access the private registry.
SECRET_NAME=is the name that you want to use for your secrets (the "imagePullSecrets").
--docker-server=is the URL of the private registry where your container images are stored. Examples:- Google Container Registry or DockerHub.
--docker-username=is the username that you use to access the private container registry.
--docker-password=is the password that you use to access the private container registry.
--docker-email=is the email address that is associated with the private registry.
CLI :-
$ kubectl create secret docker-registry SECRET_NAME --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_HUB_USER_ID --docker-password=DOCKER_HUB_USER_PASSWORD --docker-email=DOCKER_EMAIL
$ kubectl create secret docker-registry SECRET_NAME --docker-server=REGISTRY_HOSTNAME_IPADDRESS:REGISTRY_PORT --docker-username=DOCKER_HUB_USER_ID --docker-password=DOCKER_HUB_USER_PASSWORD --docker-email=DOCKER_EMAIL
CODE :-
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
    - name: myapp
      image: registry.example.com/myteam/myapp:latest
      imagePullPolicy: Always
  imagePullSecrets:
  - name: the-secret                                                      # SECRET_NAME

● ImagePullBackOff -
When a kubelet starts creating containers for a Pod using a container runtime, it might be possible the container is in Waiting state because of ImagePullBackOff.
The status ImagePullBackOff means that a container could not start because Kubernetes could not pull a container image (for reasons such as invalid image name, or pulling from a private registry without imagePullSecret).
The status "ImagePullBackOff" means that a Pod couldn’t start because Kubernetes could not pull a container image.
The ‘BackOff’ part indicates that Kubernetes will keep trying to pull the image, with an increasing back-off delay.
The container runtime from pulling an image onto the node that Kubernetes has scheduled your Pod onto, the kubelet will report back "ErrImagePull" then "ImagePullBackOff" and keep trying.
It will not attempt to pull an Image once, so it will attempt multiple times to pull an Image with an incrementally time delay is known as ‘BackOff’.

$ kubectl get pod
NAME       READY   STATUS              RESTARTS   AGE
POD_NAME   0/1     ErrImagePull        0          5s
$ kubectl get pod
NAME       READY   STATUS              RESTARTS   AGE
POD_NAME   0/1     ImagePullBackOff    0          45s 
$ kubectl describe pod POD_NAME
........
Events:
TYPE      REASON        AGE                     FROM                  MESSAGE
Normal    Scheduled     2m54s                   default-scheduler     Successfully assigned default/POD_NAME to minikube
Normal    Pulling       71s (x4 over 2m53s)     kubelet               Pulling image "HUB_REGISTRY/IMAGE_NAME:TAG"
Warning   Failed        67s (x4 over 2m49s)     kubelet               Failed to pull image "HUB_REGISTRY/IMAGE_NAME:TAG" : rpc error: code = Unknown desc = Error response from daemon: pull access denied for HUB_REGISTRY/IMAGE_NAME , repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Warning   Failed        67s (x4 over 2m49s)     kubelet               Error: ErrImagePull
Warning   Failed        54s (x6 over 2m48s)     kubelet               Error: ImagePullBackOff
Normal    Backoff       41s (x7 over 2m48s)     kubelet               Back-off pulling image "HUB_REGISTRY/IMAGE_NAME:TAG"

Now let’s check out the root causes of this ImagePullBackOff error -
1. Image or Tag doesn’t exist in Hub/Registry.
If you’re trying to create a Pod which references an image name or tag that doesn’t exist, you’ll get ImagePullBackOff.
2. made a typo in the Registry name or Image name or Tag name.
3. Image registry requires authentication. (OR) Image is private, and there is an authentication failure.
By default, images are pulled from Docker Hub, but your cluster may be using one or more private registries.
Kubernetes will use it with a private container image registry.
Companies generally don’t want to publish their private, internal apps to Docker Hub.
So if you need to pull an image from a private image registry, need to provide Kubernetes with the credentials it will need to pull the image.
You can do this by creating a Secret.
4. You’ve exceeded a rate or download limit on the registry. (OR) Container registry rate limits.
Once hit maximum download limit on Docker Hub, will be blocked and this might cause your ImagePullBackOff error.
Docker Hub Rate Limiting - Anonymous users can pull 100 images in six hours & Authenticated users can pull 200 images in six hours.
5. This error can also happen if your registry requires SSL/TLS authentication.
