Should the IaC deployment be part of the CI build or the release?

Question

I have a use case I would like to ask you for your advice on. I have a .NET application hosted in Azure App Service.

I want to control the configuration state of the infrastructure (Azure App Service + some dependencies like Azure Storage Application Insights). I have an Azure ARM template to deploy with the Incremental mode.

There are two different options:

1. Include the ARM template deployment into the build pipeline.
2. Include the ARM template deployment into the release pipeline.

There may be another option - create a pipeline or a release and schedule it (let's say it's triggered every night to deploy the ARM template).

What do you think about this case? What would be the best practice here?

I would like to know where I should run the ARM template deployment and why.

Answer 1

The best practice should be to choose the method that best suits your needs.

1. Include the ARM template deployment into the build pipeline.

If you are using the classic build pipeline, it can ensure that your infrastructure is updated whenever your code is updated. At the same time, the disadvantage is that the deployment will be repeated regardless of whether the updated code is related to the arm template.

If you are using the YAML build pipeline, you can use a multi-stage pipeline, which combines both the build and release stages in a single YAML file. This way, you can define your entire deployment cycle in one place and use the same syntax and format for both CI and CD. A multi-stage pipeline also supports features such as environments, deployment strategies, and approvals. The YAML editor requires more familiarity with the syntax and structure of YAML files. See sample: Create a multistage pipeline with Azure DevOps

2. Include the ARM template deployment into the release pipeline.

This way, you can consume the artifact from the build pipeline and deploy it to various stages, such as development, testing, and production. A release pipeline can also have additional features, such as approvals, gates to control the deployment process. The Classic release pipelines allows you to use a graphical interface to define your pipeline steps and tasks, which is easy to use compared with yaml. See doc here.

You can refer these similar questions What is the difference between Pipeline and Release Pipeline in azure devops? and Whats the difference between a build pipeline and a release pipeline in Azure DevOps?.

Then you can decide which is more suitable in your case.