3.3. Reflection Checkpoint

Your AI solution now has a body to match its memory: images built and versioned in ACR, kept fresh by task triggers, and run on whichever point of the orchestration spectrum the requirements name.

Key Takeaways

• Version images deliberately: unique tags or digests for deployments, never :latest; Premium ACR adds geo-replication for multi-region pulls; managed identity + AcrPull replaces registry passwords everywhere.
• ACR Tasks make builds reactive — commit triggers, schedules, and the base-image-update trigger that rebuilds your images when upstream patches land, no external CI required.
• Configuration is runtime's job: App Service app settings (with WEBSITES_PORT and Key Vault references) and Kubernetes ConfigMaps/Secrets both exist so one immutable image serves every environment.
• In Container Apps, revision-scope changes (image, env vars, scale rules) mint new immutable revisions enabling traffic-split canaries and instant rollback; application-scope changes (secrets, ingress) don't — restart revisions to pick up new secrets.
• Scale on leading signals: KEDA rules on queue depth (with scale-to-zero) for event-driven workers; CPU rules only for request-serving compute; expect chained scenarios where scale-out storms PostgreSQL and PgBouncer is the fix.
• Troubleshoot by walking the path and reading signatures: ImagePullBackOff = registry/auth, CrashLoopBackOff = logs --previous, running-but-silent = probes or selector wiring.

Connecting Forward

Phase 4 supplies the nervous system. The queue that KEDA watched in 3.2.2 gets its full treatment — Service Bus queues, topics, and dead-lettering — alongside Event Grid's reactive eventing and Azure Functions, the trigger-driven glue that stitches these services together without a container in sight.

Self-Check Questions

• A canary revision at 10% traffic starts returning degraded answers after a prompt-template change. Name the revision mode in use, the immediate mitigation, and why no redeploy is needed.
• Trace the full life of a configuration value from Key Vault to a container on App Service versus on AKS — where does each platform inject it, and what restarts when it changes?