ami-publisher
A utility to manage and publish Amazon Machine Images (AMIs) using
images stored in the imageserver,
using ImageUnpacker
instances.
The ami-publisher allows you to efficiently create (publish)
AMIs in multiple AWS accounts and regions. It uses ImageUnpacker instances running in
AWS to effeciently fetch images from the imageserver and then issues AWS API
calls to create the AMIs. It may be run on any machine which has access
to AWS credentials. It is typically run from a script which may be part
of an image build pipeline.
See the design document
for more information.
Usage
Ami-publisher supports several sub-commands. There are many
command-line flags which provide parameters for these sub-commands. The
most commonly used parameter is -imageServerHostname which
specifies which host the imageserver to talk to is running on.
The basic usage pattern is:
ami-publisher [flags...] command [args...]
Built-in help is available with the command:
ami-publisher -h
Some of the sub-commands available are:
- add-volumes: add a volume of the specified size (in
GiB) to the ImageUnpacker
instances. This is mostly for debugging
- copy-bootstrap-image: will copy images of the named
stream between targets (account,region tuples), attempting to copy from
the closest region for each destination. It creates temporary instances
which run copy commands. This is used to bootstrap the ImageUnpacker images
- delete: delete the image resources specified in the
results files
- delete-tags: delete the specified tag from
resources listed in the results files
- delete-tags-on-unpackers: delete the specified tag
from ImageUnpacker
instances
- delete-unused-images: delete images which are not
used by instances, using the exclude and search tags and the list of
targets
- expire: delete resources which have expired
- import-key-pair: import the specified SSH public
key into the targets
- launch-instances: create (launch) instances in the
targets using the specified image and write the created instances to the
specified results file
- launch-instances-for-images: create (launch)
instances for images specified in the results files
- list-images: list images in the specified targets
using search and exclude tags
- list-streams: list the image streams for all the
ImageUnpacker instances in the
specified targets
- list-unpackers: list the ImageUnpacker instances in the
specified targets
- list-unused-images: list unused images in the
specified targets using search and exclude tags
- list-used-images: list used images in the specified
targets using search and exclude tags
- prepare-unpackers: prepare ImageUnpacker instances in the
specified targets for use. Stopped instances will be started and the
ImageUnpacker service will be
waited for. If an image stream name is specified, scanning is
started
- publish: publish AMIs in the specified targets for
the specified image stream and the leaf name (version). This will create
and attach volumes if needed
- remove-unused-volumes: remove volumes not
associated with image streams on the ImageUnpacker instances in the
targets
- set-exclusive-tags: set the specified tag for the
AMIs in the specified results files and delete the tag key from other
AMIs
- set-tags-on-unpackers: set the specified tags on
the ImageUnpacker instances in
the specified targets
- start-instances: start the ImageUnpacker instances in the
specified targets
- stop-idle-unpackers: stop ImageUnpacker instances in the
specified targets which have been idle for the specified time
- terminate-instances: terminate the ImageUnpacker instances in the
specified targets
Security
Imageserver restricts RPC
access using TLS client authentication. Ami-Publisher will load
certificate and key files from the ~/.ssl directory.
Ami-Publisher will present these certificates to
imageserver. If one of the certificates is signed by a
certificate authority that imageserver trusts,
imageserver will grant access.