GumGum AMI Bakery

TL;DR: Packer + checksums = 👍

corey@gumgum.com

About GumGum

Computer Vision company located in Santa Monica
Advertising space
- Context-aware in-image ads
- Brand-safety technology
New verticals:
- Sports (working with teams in the NBA and NHL)
- Dental

Project Goals

Use Hashicorp Packer
- Dependable
- ```
-debug
```
AMIs defined 100% in code
Idempotent builds
- AMIs are only re-built when their definition changes
Solution must be CI-friendly

Problem

Packer builds are not idempotent
- Re-building the same code twice = 2 AMIs
Makes integrating Packer into your CI challenging

Solution

Introducing the GumGum AMI Bakery Docker image!
You tell the AMI Bakery where your AMI config code lives
The AMI Bakery will then re-build your AMI only if your AMI config code changes

GumGum AMI Bakery

Packer JSON

AMI config paths

AMI ID

File Checksums

Digital signatures for files
- Our AMI Bakery uses SHA1 checksums
Returns a 40 character hexidecimal value for files or strings of any size
If any part of a file changes, so will its SHA1 checksum

Our AMI Bakery Algorithm

Get list of all

config files

Sort list

Calculate SHA1 of each file

Calculate SHA1 of list of file SHA1s

= ami_config_checksum

Does an

AMI exist with that

ami_config_checksum

Build new AMI

Return existing AMI

Yes

Before The AMI Bakery 😥

AMIs were hard-coded
- Required a manual code update
- ... which humans sometimes forget to do
- ... which lead to AMIs getting stale

After 😎

GumGum AMI Bakery stage inserted
- If the AMI DNE, it is built
- If it exists, the AMI's ID is returned
Terraform passed the AMI ID via CLI parameter

New stage

Updated stage

Demo

Advantages

AMI updates are simple:
- Update the AMI config code
- That's it.
No external state
AMI config checksums remain the same between branch changes = faster builds

Disadvantages

A little invasive
- Need to update existing Terraform code to look up AMIs dynamically
- But maybe that's a good thing?

GumGum AMI Bakery Code

```
https://github.com/mechtron/ami-bakery
```
Includes an example sample-app

Example Pipeline Integration

docker run --rm -t \
    -e AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION \
    -e AWS_SUBNET_ID=$AWS_SUBNET_ID \
    -e PACKER_JSON_PATH=`pwd`/example-app/ami/packer/ami.json \
    -e AMI_DEFINITION_DIRS=`pwd`/example-app/ami/ \
    --mount type=bind,source=`pwd`,target=`pwd` \
    --mount type=bind,source=$HOME/.aws/,target=/root/.aws \
    docker.io/mechtron/ami-bakery:latest