k8s-deploy does not update pods with new images

[Chris-Sheridan]

What happened?

This executes as part of my GH Actions after a code update. The resulting image builds fine and is uploaded to my ACR registry. GH Actions successfully runs k8s-deploy as part of the workflow, but it doesn't detect any changes. The pods never bleed over and the old pods still run. I'm sure I have something wrong but I've had no luck searching.

Here's my action...
- name: Deploy Cluster
uses: Azure/k8s-deploy@v4
with:
resource-group: $RESOURCE_GROUP
name: $NAME
action: deploy
strategy: basic
pull-images: false
namespace: ingress-basic
private-cluster: false
manifests: |
k8s/deployment.yaml
k8s/service.yaml
k8s/cluster-issuer.yaml
k8s/ingress.yaml
images: |
myacr.azurecr.io/my-app:latest

I appreciate any thoughts people have on what I'm missing.

Version

• I am using the latest version

Runner

self-hosted, Azure ACA Container Job

Relevant log output

/usr/local/bin/kubectl apply -f /tmp/deployment.yaml,/tmp/service.yaml,/tmp/cluster-issuer.yaml,/tmp/ingress.yaml --namespace ingress-basic
deployment.apps/my-app unchanged
service/my-app unchanged
clusterissuer.cert-manager.io/letsencrypt unchanged
ingress.networking.k8s.io/my-app-ingress unchanged

[OrellBuehler]

If you use latest as the tag for all images and you don't set pull-images to true, then I believe it will use the cached images instead of updating them from your registry.

[leonardlin]

I encountered the same symptom.

I use unique tags for docker images not "latest"

Example: app:
"pull-images" is left to default "true".
In the logs I can see it does a test pull before deployment with the correct updated image-tag.

However nothing actually gets updated.
The old pods still keep running.

        uses: Azure/k8s-deploy@v5
        with:
          resource-group: company-prod-northeurope
          name: clusterName
          action: deploy
          strategy: basic
          namespace: namespaceName
          manifests: ./devops/k8s-deployment.yaml
          images: companyname.azurecr.io/app:safdsafdsafdsfd

[ejaifeobuks]

@Chris-Sheridan The cause here is the :latest tag, not a bug in the action.

Your workflow passes myacr.azurecr.io/my-app:latest, which is the same tag your manifest already uses. The action substitutes the image into the manifest before applying, but since the value is byte-for-byte identical to what's already deployed, kubectl apply correctly reports unchanged. Because the Deployment's pod template (spec.template) never changes, Kubernetes has no reason to roll out new pods — it won't re-pull :latest on its own.

Two ways to fix it:

1. Recommended: Use an immutable, unique tag so the spec changes on every deploy and a rollout is triggered automatically:

   images: |
       myacr.azurecr.io/my-app:${{ github.sha }}

   (and update k8s/deployment.yaml to reference the same base image name)

2. If you must keep :latest, set force: true, which adds --force to kubectl apply and recreates the resource. Note the README warns --force is not recommended in production.

As a side note, pull-images doesn't control whether the cluster pulls the new image — it only pulls images on the runner to read Dockerfile annotations. The actual rollout depends entirely on whether the manifest content changes.

I'll go ahead and close this issue since this is expected Kubernetes behavior rather than a bug, but please feel free to reopen if the suggestions above don't resolve it for you.

[ejaifeobuks]

@leonardlin Your case is different from the original :latest problem, since you're already using unique tags. The most likely cause is that the image substitution is silently skipping your container because the base image name in your images: input doesn't exactly match the image: base name in your manifest.

The substitution only rewrites a container's image when the base name (everything before the : or @) matches — see updateImageInContainerArray. If the registry/repository in ./devops/k8s-deployment.yaml doesn't match companyname.azurecr.io/app exactly (different registry, casing, or repository path), nothing gets replaced, the manifest is applied unchanged, and you get unchanged with the old pods still running.

The "test pull" you see in the logs is the separate pull-images step (used only to read Dockerfile annotations) and runs independently of whether substitution actually matched anything — so it's not a reliable signal that the tag was injected.

To confirm:

1. Check that the image: field in ./devops/k8s-deployment.yaml uses exactly companyname.azurecr.io/app as the base name (before the tag).
2. Re-run with ACTIONS_STEP_DEBUG=true (set it as a repository secret) and inspect the generated manifest in /tmp to verify the tag was actually substituted.

If the base names already match exactly and substitution still isn't happening, please share your k8s-deployment.yaml (specifically the image: line) so we can dig further.

I'll go ahead and close this issue for now, but please feel free to reopen it (or comment with your image: line) if substitution still isn't working after checking the above.