Everything you need to know about Azure DevOps YAML pipelines

trigger:
  branches:
    include: [main, release/*]
  paths:
    exclude: [docs/*, README.md]   # don't trigger on doc changes

pr:
  branches:
    include: [main]

variables:
  - group: production-secrets        # Variable Group from Library
  - name: imageTag
    value: $(Build.BuildNumber)
  - name: containerRegistry
    value: myacr.azurecr.io

stages:
- stage: Build
  displayName: Build and Scan
  jobs:
  - job: BuildJob
    pool:
      vmImage: ubuntu-latest         # Microsoft-hosted agent
    steps:
    - task: Docker@2
      displayName: Build image
      inputs:
        command: build
        repository: myapp
        dockerfile: Dockerfile
        tags: $(imageTag)

    - task: trivy@1
      displayName: Scan for CVEs
      inputs:
        image: myapp:$(imageTag)
        exitCode: 1
        severity: HIGH,CRITICAL

    - task: Docker@2
      displayName: Push to ACR
      inputs:
        command: push
        containerRegistry: acr-service-connection
        repository: myapp
        tags: $(imageTag)

    - publish: $(Build.ArtifactStagingDirectory)
      artifact: manifests

- stage: DeployDev
  displayName: Deploy to Development
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeployDev
    pool:
      vmImage: ubuntu-latest
    environment: development         # Environment with approval gates
    strategy:
      runOnce:
        deploy:
          steps:
          - task: HelmDeploy@0
            inputs:
              connectionType: Kubernetes Service Connection
              kubernetesServiceEndpoint: aks-dev-connection
              namespace: dev
              command: upgrade
              chartPath: charts/myapp
              releaseName: myapp
              overrideValues: image.tag=$(imageTag)
              waitForExecution: true

- stage: DeployProd
  displayName: Deploy to Production
  dependsOn: DeployDev
  condition: succeeded()
  jobs:
  - deployment: DeployProd
    environment: production          # Requires approval — configured in Environments UI
    strategy:
      runOnce:
        deploy:
          steps:
          - task: HelmDeploy@0
            inputs:
              namespace: prod
              overrideValues: image.tag=$(imageTag),replicaCount=5

Environments are where you control deployment safety

An Environment in Azure DevOps represents a deployment target (development, staging, production). You configure approvals, checks, and gates on the Environment — not in the YAML. This separates deployment logic from deployment safety.

Types of checks on Environments

Environment resources — track Kubernetes namespaces

# Add a Kubernetes namespace to an Environment for deployment tracking
# Go to: Environments → production → Add resource → Kubernetes → AKS
# After adding: every deployment to that namespace is tracked in Azure DevOps
# You can see: which build deployed, when, who approved, pod health status

Three ways to manage configuration in Azure DevOps pipelines

1. Inline variables (non-sensitive)

variables:
  appName: payment-service
  imageTag: $(Build.BuildNumber)
  environment: production

2. Variable Groups (shared across pipelines)

Pipelines → Library → Variable Groups. Define once, reference in many pipelines. Can mark variables as secret (value hidden in logs). Link a group to a Key Vault to sync secrets automatically.

variables:
  - group: production-config    # all variables from this group are available
  - group: production-secrets   # linked to Azure Key Vault

3. Azure Key Vault integration (recommended for secrets)

Link a Variable Group directly to Azure Key Vault. Every secret in the vault becomes a pipeline variable. Rotates automatically when Key Vault secret changes. No manual copy-paste of secrets.

# Variable Group linked to Key Vault
# In the pipeline, reference Key Vault secrets as normal variables:
- task: AzureCLI@2
  inputs:
    azureSubscription: production-connection
    scriptType: bash
    script: |
      echo "Deploying with DB password: $(database-password)"
      # $(database-password) comes from Key Vault via Variable Group
      # value is masked in logs

Service connections — secure links to external systems

Templates eliminate duplication across 50 pipeline files

# templates/docker-build.yml — reusable template
parameters:
- name: imageName
  type: string
- name: dockerfilePath
  type: string
  default: Dockerfile
- name: registryConnection
  type: string
  default: acr-connection

steps:
- task: Docker@2
  displayName: Build $(parameters.imageName)
  inputs:
    command: buildAndPush
    repository: $(parameters.imageName)
    dockerfile: $(parameters.dockerfilePath)
    containerRegistry: $(parameters.registryConnection)
    tags: |
      $(Build.BuildNumber)
      latest

---
# Using the template in a pipeline
trigger: [main]
stages:
- stage: Build
  jobs:
  - job: Build
    pool:
      vmImage: ubuntu-latest
    steps:
    - template: templates/docker-build.yml  # reference by path
      parameters:
        imageName: payment-service
        dockerfilePath: services/payment/Dockerfile

    - template: templates/docker-build.yml
      parameters:
        imageName: order-service
        dockerfilePath: services/order/Dockerfile

Stage templates for full environment promotion

# templates/deploy-stage.yml
parameters:
- name: environment
  type: string
- name: namespace
  type: string
- name: imageTag
  type: string

stages:
- stage: Deploy_${{ parameters.environment }}
  jobs:
  - deployment: Deploy
    environment: ${{ parameters.environment }}
    strategy:
      runOnce:
        deploy:
          steps:
          - task: HelmDeploy@0
            inputs:
              namespace: ${{ parameters.namespace }}
              overrideValues: image.tag=${{ parameters.imageTag }}

---
# Main pipeline using the stage template
stages:
- template: templates/deploy-stage.yml
  parameters:
    environment: development
    namespace: dev
    imageTag: $(Build.BuildNumber)
- template: templates/deploy-stage.yml
  parameters:
    environment: production
    namespace: prod
    imageTag: $(Build.BuildNumber)