Modern cloud-native applications rely heavily on automated Continuous Integration and Continuous Deployment (CI/CD) pipelines. When deploying containerized workloads to Azure Kubernetes Service (AKS), a robust pipeline requires a secure bridge between your source control, your container registry, and your orchestration cluster.

This guide provides an end-to-end walkthrough for provisioning an Azure Container Registry (ACR), attaching it to an existing AKS cluster, and generating the necessary Service Principal credentials to allow GitHub Actions to securely automate your deployments.

Prerequisites

Before beginning, ensure you have the following ready:

Step 1: Provisioning the Azure Container Registry (ACR)

The Azure Container Registry is a private, managed Docker registry that stores your application's container images.

1.1 Register the Resource Provider

A common pitfall when creating an ACR for the first time in a subscription is encountering a MissingSubscriptionRegistration error. Azure requires you to explicitly register the Microsoft.ContainerRegistry namespace.

Execute the following command to register the provider:

az provider register --namespace Microsoft.ContainerRegistry

You can verify the registration status. Wait until it returns "Registered":

az provider show -n Microsoft.ContainerRegistry --query "registrationState"

1.2 Create the Registry

Once the provider is registered, create the ACR. Registry names must be globally unique across Azure and contain only lowercase alphanumeric characters.

az acr create --resource-group linux-admin-course --name mudassaracr99 --sku Basic

Using the Basic SKU is highly cost-effective for learning, development, and standard deployment workflows.

Step 2: Integrating ACR with AKS

Kubernetes needs permission to pull the private images stored in your new registry. Instead of manually creating Kubernetes secrets for Docker registry authentication, Azure provides a streamlined command to establish a secure, role-based role assignment (AcrPull) between the AKS cluster and the ACR.

Run the following command to attach the ACR to your AKS cluster:

az aks update -n mudassar-kubi-course -g linux-admin-course --attach-acr mudassaracr99

Once this completes, any Pod deployed to your AKS cluster can seamlessly pull images from mudassaracr99.azurecr.io without requiring explicit image pull secrets in your deployment manifests.

Step 3: Configuring Service Principal Credentials for GitHub Actions

To allow GitHub Actions to build Docker images, push them to your ACR, and apply manifests to your AKS cluster, it needs an Azure identity. We create an Azure Active Directory Service Principal with the Contributor role scoped strictly to your resource group.

The Shell Syntax Gotcha

When running Azure CLI commands requiring IDs, documentation often uses angle brackets (like <your-subscription-id>) as placeholders. When executing these in Bash, the < and > symbols must be removed. Otherwise, Bash interprets them as file redirection operators, resulting in "No such file or directory" errors.

To get your exact Subscription ID, run:

az account show --query id --output tsv

Construct the final command by replacing the ID directly, without any brackets:

az ad sp create-for-rbac --name "GitHub-Actions-AKS" --role contributor --scopes /subscriptions/cf35803b-b565-4555-8e15-430b69dbd059/resourceGroups/linux-admin-course --json-auth

Securing the Output

The command above will output a JSON object containing your clientId, clientSecret, subscriptionId, and tenantId.

Critical: Copy this entire JSON block immediately. Navigate to your GitHub repository's Settings > Secrets and variables > Actions, and create a new repository secret named AZURE_CREDENTIALS. Paste the JSON object as the value.

With the registry provisioned, the cluster authorized to pull images, and the identity established for GitHub Actions, the foundational infrastructure for your CI/CD pipeline is complete. The next phase involves writing the .github/workflows/deploy.yml file to automate the build, tag, push, and Kubernetes rollout processes.