Azure K8s-Deploy步骤未替换镜像问题排查求助

问题背景 #

在Azure中搭建Kubernetes集群后，通过Azure的“自动化部署”菜单创建了基于GitHub Actions的工作流。该工作流能成功构建镜像并推送至Azure容器注册表（ACR），但执行部署步骤时，Kubernetes Deployment中的镜像未被新构建的镜像替换；无需修改的Service部署正常，Manifest已同步到集群。工作流基本沿用Azure生成的模板，怀疑问题与Azure容器注册表或Azure/k8s-deploy@v4的使用方式有关。

相关配置 #

GitHub Actions工作流配置 #

name: deploy_to_ota
"on":
    push:
        branches:
            - main
    workflow_dispatch: {}
env:
    ACR_RESOURCE_GROUP: ota
    AZURE_CONTAINER_REGISTRY: otaRegistry
    CLUSTER_NAME: ota
    CLUSTER_RESOURCE_GROUP: ota
    CONTAINER_NAME: portfolio-image
    DEPLOYMENT_MANIFEST_PATH: |
        ./kubernetes/my-deployment.yaml
        ./kubernetes/my-service.yaml
jobs:
    buildImage:
        permissions:
            contents: read
            id-token: write
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v3
            - name: Set up Java
              uses: actions/setup-java@v4
              with:
                distribution: 'adopt'
                java-version: '21'
            - name: Build with Maven
              run: mvn clean package
            - uses: azure/login@HASH
              name: Azure login
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
            - name: Build and push image to ACR
              run: az acr build --image ${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.ACR_RESOURCE_GROUP }} -f ./Dockerfile ./
    deploy:
        permissions:
            actions: read
            contents: read
            id-token: write
        runs-on: ubuntu-latest
        needs:
            - buildImage
        steps:
            - uses: actions/checkout@v3
            - uses: azure/login@HASH
              name: Azure login
              with:
                client-id: ${{ secrets.AZURE_CLIENT_ID }}
                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
            - uses: azure/use-kubelogin@v1
              name: Set up kubelogin for non-interactive login
              with:
                kubelogin-version: v0.0.25
            - uses: azure/aks-set-context@v3
              name: Get K8s context
              with:
                admin: "false"
                cluster-name: ${{ env.CLUSTER_NAME }}
                resource-group: ${{ env.CLUSTER_RESOURCE_GROUP }}
                use-kubelogin: "true"
            - uses: Azure/k8s-deploy@v4
              name: Deploys application
              with:
                action: deploy
                images: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}
                manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }}
                namespace: portfolio

Deployment Manifest配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: portfolio-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: portfolio
  template:
    metadata:
      labels:
        app: portfolio
    spec:
      containers:
      - name: portfolio-app
        image: WILL_I_BE_REPLACED

排查与解决步骤 #

1. 修正Azure/k8s-deploy@v4的镜像匹配规则 #

Azure/k8s-deploy@v4默认会根据镜像名称（即portfolio-image）匹配Manifest中容器的镜像字段，但你的Deployment里容器名称是portfolio-app，且镜像字段是占位符WILL_I_BE_REPLACED，无法和工作流中定义的镜像名称对应，导致action无法识别需要替换的容器。

解决方法：修改deploy步骤中的images参数，显式指定容器名称与镜像的映射关系：

images: portfolio-app=${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }}

这样action会明确替换Deployment中名为portfolio-app的容器镜像为指定的ACR镜像。

2. 验证ACR镜像的存在性与标签正确性 #

在工作流的buildImage步骤中，用github.sha作为镜像标签，需确认该标签的镜像已成功推送至ACR：

• 登录Azure门户，进入目标ACR，查看镜像列表，确认存在标签为对应commit SHA的portfolio-image镜像；
• 查看工作流中az acr build步骤的日志，确认输出包含“Successfully pushed image”等成功推送的信息。

3. 检查Azure/k8s-deploy@v4的执行日志 #

在GitHub Actions的deploy任务中，查看Azure/k8s-deploy@v4步骤的日志：

• 若日志显示“Successfully replaced image for container 'portfolio-app'”，说明镜像替换生效；
• 若日志显示“Could not find container to replace image”，则验证是否已正确配置容器名称与镜像的映射。

4. 确认AKS集群对ACR的访问权限 #

确保AKS集群有权限拉取ACR中的镜像：

• 若AKS与ACR在同一订阅，可通过Azure CLI执行az aks update -n <cluster-name> -g <resource-group> --attach-acr <acr-name>，将ACR附加到AKS集群；
• 若不在同一订阅，需为AKS集群的服务主体分配AcrPull角色权限。

5. 验证Deployment的更新触发逻辑 #

由于使用github.sha作为镜像标签，每次推送的标签都是唯一的，正常情况下会触发Deployment的滚动更新。若仍未更新，可手动执行kubectl describe deployment portfolio-deployment -n portfolio查看事件，确认是否存在镜像拉取失败或其他异常。

内容的提问来源于stack exchange，提问作者Phi Tiet