Azure Container Registry + AKS Deployment Pipeline
Fast recall
Quick revision
Core answer
End-to-end understanding of a containerized Java deployment pipeline on Azure — from source to running Kubernetes pod.
Storing ACR credentials as plaintext secrets in the pipeline instead of using the AKS-ACR integration (az aks update --attach-acr) for credential-free pulls.
Mention multi-stage Docker builds to reduce image size, image vulnerability scanning with Defender for Containers, and rolling update strategy in the Deployment spec.
Interview-ready guide
Interview answer
The Azure container deployment pipeline — build, push to ACR, deploy to AKS — follows a consistent four-stage pattern regardless of whether you use Azure DevOps Pipelines, GitHub Actions, or Jenkins.
Build stage
- Build the Spring Boot JAR with Maven or Gradle, then build the Docker image — a multi-stage Dockerfile builds the JAR in a JDK stage and copies the artifact to a JRE final image to minimize image size
- Use the Git commit SHA as the image tag:
docker build -t myacr.azurecr.io/my-service:$(git rev-parse --short HEAD) .— which means every deployed image is traceable to a specific commit, making rollback straightforward
Push to ACR
- Authenticate to ACR with
az acr login --name myacr(development) or a service principal withacrPushrole (CI); push the tagged image - ACR geo-replication mirrors images to the same regions as AKS clusters — which means image pulls from AKS are fast and don't traverse the public internet; use ACR in the same region as AKS to avoid cross-region latency
Deploy to AKS
- Update the Kubernetes Deployment manifest with the new image tag:
kubectl set image deployment/my-service my-service=myacr.azurecr.io/my-service:SHA - Or use Helm: update the
image.tagvalue andhelm upgrade my-service ./charts/my-service --set image.tag=SHA; Helm tracks release history, makinghelm rollbacka single command
AKS authentication to ACR
- Attach ACR to AKS with
az aks update --attach-acr myacr— this grants the AKS kubelet's Managed Identity theacrPullrole on ACR; pods pull images without imagePullSecrets or stored credentials
Azure Container Registry + AKS Deployment Pipeline
Direct Answer
Build the Docker image, push it to Azure Container Registry, then apply a Kubernetes deployment manifest referencing the ACR image. Use GitHub Actions or Azure DevOps Pipelines to automate the workflow.
Common Mistakes & Pitfalls
Storing ACR credentials as plaintext secrets in the pipeline instead of using the AKS-ACR integration (az aks update --attach-acr) for credential-free pulls.
Check your understanding
Answer these without looking back at the article.
- How does az aks update --attach-acr work under the hood?
- What is the difference between kubectl set image and using Helm for deployments?
- How do you configure ACR geo-replication for multi-region AKS clusters?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.