API Tests Low Effort API Testing for Microservices | CONFIDENTIAL • What has changed? – Migration to microservices triggering need for extensive API tests • Problem: – Creating API tests is effort effort intensive – Creating + maintainting E2E, service tests, component tests adds up very quickly • What happens if you do not address the problem? – Thorough test coverage can take a lot of time outcome: Just create E2E tests • What is our solution? – Leverage Istio sidecar to listen to API traffic data and create tests from the data – 10x speed in creating API tests • Can also be sped up

#IstioCon Our clusters #IstioCon The problem Running end-to-end tests at Omio is both not efficient and cost-effective #IstioCon How tests are run ● On QA (dev -> PR -> master -> deploy QA …. ) ● Allow simultaneous tests Only one commit at a time from your microservice #IstioCon 3. Reuse existing infrastructure ● Minimize costs ● Reuse existing infrastructure to run tests #IstioCon Why don’t order matters #IstioCon Checkpoint 1. Minimize time to bug detection: yes 2. Allow simultaneous tests: yes 3. Reuse infrastructure: yes #IstioCon Drawbacks Contract header needs to be preserved all

Zhang - Link #IstioCon Writing Tests ● Istio.io page content is automatically verified through tests, and you can help by creating one! ● Guide for creating tests ● Sample page with a test ● make Working Group ● Contributing ○ Check out the style guides for documentation ○ Look into writing tests and how they work ○ We are here to help you with your PR! #IstioCon Thank you! @albertsun0 https://albert

Image transfers are over localhost + Reproducible configuration with other developers and Istio tests + Easy to setup bespoke clusters, including enabling alpha features and multicluster - Local resource

3. Sidecar & ExportTo tuning is required 1. Resource consumption 2. Resource Mounts (#15517) 4. Tests on the production-size environment aren’t a waste of time 1. Istio Discovery Restarts (#25495) 2

industry standards and security advisories are clear and detailed. ● Security fixes include regression tests. A�er the manual auditing commenced, the auditing team found that the Istio team had prioritised