Securing Azure Container Registry Credentials in Azure DevOps CI/CD Pipelines
The client used Azure DevOps Classic Release pipelines to automate deployments across UAT and Production environments, with Azure Container Registry credentials required for container authentication and AKS deployments. These credentials were previously stored directly as pipeline variables, creating risks around exposure, rotation, and centralized governance.
Bobcares moved the ACR credentials into Azure Key Vault and connected them to Azure DevOps through environment-specific Variable Groups. The deployment scripts were updated to consume secrets through environment variables and use secure Docker authentication, allowing automated AKS deployments without hardcoded credentials.
Business Challenge
ACR credentials stored directly in pipeline variables created security and operational concerns, including potential exposure through pipeline configurations, logs, or scripts. Managing credentials across UAT and Production also required manual updates and lacked centralized governance, making secure rotation and environment-specific access control difficult.
Technology Used
Blueprint
Azure Key Vault stores environment-specific ACR credentials and exposes them to Azure DevOps through Variable Groups. Each Classic Release stage retrieves its assigned secrets, exports them as environment variables, and passes them to the deployment script for Docker or Helm authentication before deploying workloads to AKS.
Key Outcomes
- Removed direct credential storage from pipeline configuration.
- Centralized credential management in Azure Key Vault.
- Isolated Non-Production and Production credentials.
- Enabled credential rotation without modifying pipeline configurations.
- Reduced the risk of credential exposure.
- Maintained automated AKS deployment workflows.
Customer Profile
The Challenges
- ACR credentials were directly stored as pipeline variables.
- Sensitive credentials could potentially be exposed through pipeline configurations, logs, or scripts.
- Credential rotation required manual updates across pipelines.
- Secret management lacked centralized governance.
- UAT and Production required separate credentials and access boundaries.
- Deployment scripts required secure credential-handling changes.
Why Bobcares?
- Identified direct pipeline credential storage as the key security concern.
- Moved credential management to Azure Key Vault without redesigning the existing deployment workflow.
- Used separate Variable Groups for UAT and Production access.
- Updated the existing Azure CLI task and deployment script to consume secrets securely.
- Preserved automated AKS deployments while removing hardcoded credentials.
What We Delivered
- Migrated ACR login credentials from pipeline variables to Azure Key Vault secrets.
- Created separate Key Vault secret sets for Non-Production and Production.
- Created
andKV-ACR-NonProd
Variable Groups.KV-ACR-PROD - Linked the appropriate Variable Group to each Release pipeline stage.
- Updated the Azure CLI task to use Inline Script.
- Exported retrieved secrets as environment variables during pipeline execution.
- Modified deployment scripts to consume environment variables instead of hardcoded credentials.
- Implemented Docker authentication using
.--password-stdin
The Results
Credential Storage
- Before: ACR credentials were directly maintained as pipeline variables in the release workflow.
- After: ACR credentials were centrally maintained in Azure Key Vault and retrieved through Key Vault-linked Variable Groups during pipeline execution.
Environment Isolation
- Before: Credential management across environments required manual handling within pipelines.
- After: UAT and Production stages used separate Key Vault-linked Variable Groups for environment-specific credentials.
Credential Rotation
- Before: Rotation required manual updates to pipeline configurations.
- After: Credentials could be rotated in Key Vault without modifying pipeline configurations.
Credential Exposure
- Before: Credentials were handled through pipeline variables and deployment scripts.
- After: Credentials were removed from code and direct pipeline configuration, with Docker authentication using
.--password-stdin
Deployment Workflow
- Before: The existing pipeline depended on credentials maintained as pipeline variables.
- After: Key Vault secrets were retrieved through Variable Groups while automated AKS deployments continued through the existing release workflow.
The Business Impact
- Reduced the risk associated with exposed deployment credentials.
- Established centralized secret governance for ACR credentials.
- Simplified credential rotation across deployment workflows.
- Strengthened separation between UAT and Production credentials.
- Preserved automated container deployments to AKS.
- Reduced dependency on hardcoded credentials in deployment scripts.
- Improved maintainability of the CI/CD credential management process.
Ongoing Collaboration
- Monitor the secret-management configuration across deployment stages.
- Review environment-specific access and Variable Group configuration.
- Support credential rotation through Azure Key Vault.
- Review deployment scripts for secure credential handling.
- Assess pipeline configuration for continued secret isolation.
- Troubleshoot deployment or authentication issues when required.
