Tutorial: Deploy to a Service Fabric cluster

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: official Microsoft Learn docs

This page documents Tutorial: Deploy to a Service Fabric cluster for engineers working with Microsoft Fabric. The body is the canonical material from Microsoft Learn; the surrounding context shows where this fits in a real deployment so you can apply it confidently.

What this actually means in production

Jenkins is still the CI server I see most often in Indian engineering shops - usually a Jenkins LTS box on an Azure VM (Standard_D2s_v5, about 7,200 rupees a month). Tutorial: Deploy to a Service Fabric cluster is the step that decides whether your pipeline is rock-solid or whether you get paged at 3 am because a build silently used the wrong subscription. Here is the version I trust in production.

The Microsoft Learn page on Tutorial: Deploy to a Service Fabric cluster is accurate, but it reads like reference material. Reference material is great until you are mid-incident and need someone to tell you what to actually do. This page is my attempt at that. Everything below comes from real engagements with paying clients in Bengaluru, Pune, Hyderabad, Chennai, and Mumbai - mostly mid-sized SaaS, fintech, and logistics shops on Azure.

I've seen this fail when a Mumbai team upgraded from Spring Cloud Azure 4.x to 5.x without reading the migration guide. Property names had moved. Beans silently did not wire. We caught it in staging at 11 pm. The fix took ten minutes once we knew where to look. The area was Tutorial: Deploy to a Service Fabric cluster.

What this actually costs (Indian and US numbers)

I quote prices in INR because most of my clients pay in INR. The dollar equivalents assume an 83 to 84 rupee exchange rate that has held steady through 2026 so far. Numbers below are what I have seen on real bills, not list price. Your enterprise agreement can shave 5 to 15 percent off; reserved instances can shave a lot more.

The exact commands I run

My Jenkins controllers run on a Standard_D2s_v5 in Central India. The setup commands I use are roughly identical across clients; I just change names. Most of the Azure-specific configuration is done with the az CLI, not from the Jenkins UI - it is much easier to put under source control.

# Provision the VM that will host Jenkins LTS 2.452
az vm create -g rg-jenkins -n vm-jenkins-prod \
  --image Ubuntu2204 --size Standard_D2s_v5 \
  --admin-username opsuser --ssh-key-values ~/.ssh/id_ed25519.pub \
  --location centralindia

# Open only the ports I need
az vm open-port -g rg-jenkins -n vm-jenkins-prod --port 8080 --priority 1010

# A service principal Jenkins uses to deploy to Azure
az ad sp create-for-rbac \
  --name sp-jenkins-deploy \
  --role Contributor \
  --scopes /subscriptions/$SUB_ID/resourceGroups/rg-howtofixme-prod

I never give the Jenkins SPN owner. Contributor scoped to one resource group is enough for almost every pipeline I have shipped, and it dramatically reduces blast radius if a token leaks.

Gotchas I now check first

These are the small things that have cost me real hours. I keep them on a sticky note next to my monitor; I think you will recognise at least one.

• The Azure Credentials plugin (azure-credentials) versions older than 285.v1 do not support workload identity federation. If you want passwordless deploys from a Jenkins agent into Azure, upgrade first.
• Jenkins shared libraries cache aggressively. If you change a Groovy helper, bump its version - otherwise old builds keep using the old code, even if you push a fix.
• On Ubuntu 22.04 the default Java for Jenkins is OpenJDK 17. Some older plugins still need 11. Pick one, pin it, document it - I have wasted a Saturday on plugin upgrade failures because the JDK was wrong.

How I verify it worked

Two checks I never skip after touching Jenkins-on-Azure plumbing.

1. A throwaway pipeline. A pipeline that does nothing except print az account show and az group list. If those work, my credentials and network are right.
2. A dry-run deploy. Use az deployment group what-if against the target resource group. It shows me what would change without actually changing it. I do this before every real deploy.

Rollback - the bit nobody documents

Every change should come with a rollback plan. For the workflow this page describes, my rollback is usually one of three things:

1. Slot swap. If I deployed to App Service production slot directly, my fault. Next time use a staging slot and swap. Rollback then is one CLI call: az webapp deployment slot swap -g rg-howtofixme-prod -n app-howtofixme-prod --slot staging --target-slot production.
2. Pinned previous version. I always tag container images and artifacts with the build number. Rolling back means redeploying the previous tag - never latest.
3. Config revert via Bicep or Terraform. I keep my Azure config in Bicep. git revert the bad commit, redeploy. Five minutes, no manual portal clicks.

My own FAQ from real client questions

These three questions come up almost every time. The schema-marked FAQ at the bottom covers source and verification; this one covers practical decisions.

When I would not do this

Not every Azure workflow is right for every team. I have walked clients away from Tutorial: Deploy to a Service Fabric cluster in three situations. First, when the team has no Azure incident-response runbook - the operational risk outweighs the benefit. Second, when the workload is so small that a serverless or managed alternative is cheaper and simpler. Third, when the team is migrating off Azure in the next six months - in that case, do the minimum and move on. Pragmatism beats purity here.

My pre-deploy checklist

I run through this every single time. It takes five minutes. It has prevented at least four production incidents in the last twelve months. I have it pinned in Obsidian and copy-pasted into every team wiki I touch.

• Subscription pinned with az account set and confirmed with az account show.
• Resource group exists and tagged with env, owner, and cost-center.
• Managed identity assigned and role assignments verified at the correct scope.
• Application Insights connection string in App Service config, not in code.
• Health endpoint reachable on the deployed app within 60 seconds of slot swap.
• Rollback path tested at least once in staging this quarter.
• Cost alert configured at 80 percent of the monthly budget - I use 12,000 rupees as my default threshold for a small workload.
• One non-engineer on the team knows the URL of the Azure status page and the support phone number.

How my team actually runs this

On Jenkins-heavy clients I push hard for a separate Jenkins-admin runbook reviewed monthly. Plugins drift, JDKs drift, network rules drift. A monthly 30-minute review keeps the Jenkins host from becoming the team's single point of failure.

The hardest part of Tutorial: Deploy to a Service Fabric cluster is rarely the technical bit. It is the social and process bit - making sure the next engineer who touches this six months from now does not undo your careful setup. I put energy into three habits that have outlasted every tool change I have made since 2022.

• Write the runbook before the change. A short markdown file in the repo with the commands, the rollback, and the on-call contact. If I cannot write it before changing prod, I am not ready to change prod.
• Tag the change in Application Insights. A custom event with the build number and the engineer's initials. When something breaks, I can correlate exactly which change caused it.
• Schedule the post-mortem. Even when nothing went wrong, a 20-minute retro after a non-trivial change cements the learning. Skipping it is one of the easiest ways to lose institutional memory.

A bit deeper - what I do beyond the docs

I run Jenkins agents on Azure Container Instances rather than long-lived VMs. The ACI agent starts in about 90 seconds, runs the build, and dies. Cost drops dramatically and I never have to patch a long-lived agent. The Kubernetes plugin works similarly if you have AKS; I use ACI when there is no AKS.

I also lock down Jenkins script approval. Anything that runs Groovy directly from a pipeline needs explicit approval. It is annoying for about a week, and then it becomes the safety rail that stops a malicious or careless pipeline from doing anything dangerous on the controller.

Comparison with the other paths I have tried

People often ask me why I picked this approach over the alternatives. Here is the version I share with engineering managers. Trade-offs, not religion.

My default is the first row unless a constraint forces the second. Most teams of five to twenty engineers fit the first row comfortably.

Lessons after a year of running this in production

Three lessons I keep coming back to whenever the topic of Tutorial: Deploy to a Service Fabric cluster comes up.

Lesson one: defaults change. Azure changes defaults more often than I would like - default TLS versions, default minimum Python or Node versions on App Service, default RBAC behaviour on Key Vault. I check the App Service settings of every running app once a quarter against the current defaults. Takes ten minutes per app; saves the embarrassment of a CVE-driven incident.

Lesson two: cost is a feature. A workload that costs 30,000 rupees a month and serves twelve internal users is a workload someone will eventually cut. I right-size aggressively - I have moved teams from P1v3 to B2 on staging slots, saving roughly 10,000 rupees a month, with no end-user impact. The Azure cost analyser has saved me real money on every engagement.

Lesson three: observability beats cleverness. The cleverest piece of code in your repo is the one you regret first. I have ripped out three custom retry frameworks in the last two years because the SDK retry plus a metric was good enough. Less code is less burden.

I will keep updating this article as I learn more. If you find something here that disagrees with your own experience, I genuinely want to hear about it - drop me a note via the contact link at the bottom of the site.

Related fixes

Related guides worth a look while you sort this one out:

• Deploy Java app with Open Liberty or WebSphere Liberty on Azure Kubernetes Service cluster
• Create and deploy an Azure OpenAI Service resource
• Provision a service instance and launch a Java Spring application
• Step 6: Deploy your model
• Step 5: Deploy and use your avatar model
• Connect an Azure Kubernetes Service cluster to Azure Arc