component tests adds up very quickly • What happens if you do not address the problem? – Thorough test coverage can take a lot of time and effort – Realistic outcome: Just create E2E tests • What is and cost for API testing for microservices architectures with Istio – Fewer failures higher up the test pyramid as a result of improved API tests • Istio benefits – Venky / Prasad – point here • Demo Alerts … | CONFIDENTIAL Service testing Test a single service in isolation. All producer services are mocked. 4 Terminology Component testing Test a set of services as a single sub-system while

overall architecture review which extrapolated areas of focus for subsequent phases of the assessment. A test plan was created which matched areas of code with specific security controls (e.g. service discovery NCC Group used various hosting options (i.e. Minikube, GKE, KOPS) to build reference clusters and test various configurations. These reference architectures were used to provide testers with a way of validating Method Code-assisted Platforms Golang, Kubernetes Dates 2020-07-06 to 2020-07-31 Environment Local Test Environment Consultants 4 Level of Effort 50 person days Targets istio/istio Istio Source code

Istio Security Audit, 2023 Fuzzing The second goal of the audit was to assess and improve the fuzz test suite of Istio. During the initial assessment, the Ada Logics auditing team reviewed the existing substantial fuzz test suite that runs continuously on OSS-Fuzz. Ada Logics started the fuzzing assessment by prioritising security-critical parts of Istio. We found that many of these had impressive test coverage t/fuzz _test.go#L23 3 FuzzReadCACert istio.io/istio/security/pkg/ k8s/chiron https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/k8s/chir on/fuzz_test.go#L22

of Done #IstioCon Upgrade Working Group Mission: To improve the stability, user experience, and test infrastructure around Istio upgrades #IstioCon Upgrade Working Group - Stability ● Standards and upgrades ● Update or create documentation on upgrades across all supported methods ○ Test documentation using istio.io test framework #IstioCon Upgrade Working Group - User Experience ● Add pre-checks to about known potential issues ○ Provide a clear path forward #IstioCon Upgrade Working Group - Test Infrastructure ● Extend and improve the testing infrastructure ● Extend and add testing of upgrades

docker pull + No local resource utilization + Closely resembles production environments + Can test large scales - Slow, especially without fast upload speeds - Expensive #IstioCon Local Machine from an IDE - Very different from production environment, may not be representative - Harder to test actual traffic, especially iptables - May be dependant on local environment - Challenging to have Rapid iteration - Very different from production environment, may not be representative - Harder to test actual traffic, especially iptables - May be dependant on local environment - Challenging to have

with a test ● make test_status ● make snips #IstioCon The Pull Request Process ● Viewing changes as if they were live ● Linter is pretty specific ● Don't forget to update/create a test if the page

terminationGracePeriodSeconds to 90 seconds. 20 Warning: These are workarounds, not solutions! Stabilizing Istio Test before using! These workarounds are based on the Kubernetes pod/container lifecycles and only recommended performance. ● Default -> 2 ● For minimal performance impact -> Workers = vCPU (1 worker/vCPU) ● Load test your workloads at different level of concurrency and resources ● Account for RPS/pod when calculating

(dev -> PR -> master -> deploy QA …. ) ● On standalone VMs running all services needed for the test #IstioCon Define efficient and cost-effective #IstioCon 1. Minimize time to bug detection Dev

Operational Excellence ● Detecting backwards incompatible changes ● Measuring developer efficiency ○ Test flakes ○ Feature and code coverage ● Feature promotion efficacy ● Improving overall developer experience

deployment pattern that allows you to roll out new code/features to a subset of users as an initial test. Deployment Canary Releases Using Kubernetes Deployment POD POD POD POD S E R V I C E (Load balancer)