| CONFIDENTIAL Leveraging Istio for Creating API Tests Low Effort API Testing for Microservices | CONFIDENTIAL • What has changed? – Migration to microservices triggering need for extensive #bugs-in-production, Reduced eng effort for testing, velocity) – Early testing of services components auto-generated from end-to-end tests – Significantly reduced time and cost for API testing for microservices architectures Questions 2 Structure | CONFIDENTIAL 3 API-driven applications exploding Service Testing Component Testing E2E API Tests Engineering effort grows superlinearly as #APIs grow Customer services

run for a longer time and explore more of the reachable code. It also allows the fuzzers to keep testing the latest master branch as it evolves to test whether new bugs get introduced. Short-term, OSS-Fuzz .go and run it with go test -run=TestParsePublishMetadata2. func TestParsePublishMetadata2(t *testing.T) { m := &pubsub.PublishRequest{} m.Data = []byte{246, 255, 255, 255, 255, 10, 255, 32, 32, 32 pc=0xa3c850 testing.tRunner(0xc000288ea0, 0xc78960) /usr/local/go/src/testing/testing.go:1576 +0x10b fp=0xc000392fc0 sp=0xc000392f70 pc=0x53632b testing.(*T).Run.func1() /usr/local/go/src/testing/testing.go:1629

曾元（Yuan Tseng） 2022.02.18 Outline ● Background: Prerequisites & What is Pytorch? ● Training & Testing Neural Networks in Pytorch ● Dataset & Dataloader ● Tensors ● torch.nn: Models, Loss Functions Training & Testing Neural Networks Validation Testing Training Guide for training/validation/testing can be found here. Training & Testing Neural Networks - in Pytorch Validation Testing Training Load 1. torch.utils.data.Dataset & torch.utils.data.DataLoader Dataset & Dataloader Training: True Testing: False ● Dataset: stores data samples and expected values ● Dataloader: groups data in batches

project was assigned to four members of the Cure53 team with best-suited expertise and skills. The testing team examined the scope in June 2020, namely in calendar weeks 24 and 25. A total budget allocated project channel, which was then used for questions and feedback, as well as broader verifications of testing and auditing ideas or directions. Cure53 shared status updates and discussed findings with Dapr as sections, the report will first shed light on the scope and key test parameters of this June 2020 testing exercise of Dapr. Next, all findings will be discussed in a chronological order alongside

.......................................................................................... 53 Testing Lambda Code .................................................................................... The headers modification includes tasks such as modifying cookie data, URL rewrite, used for AB testing to change the response send to the user back, adding extra headers info for security purpose etc dependencies However, remember that proper permission has to given to be given to the zip file . Testing Lambda Code Lambda Code can be tested for events inside the AWS Lambda console. It is also possible

specific security controls (e.g. service discovery, certificate lifecycle, side car injection) to focus testing efforts. Istio does not currently have a reference design for what an ideal Kubernetes cluster with many open source compo- nents that were actively being updated during testing so testers used the latest release at the time of testing which was 1.6.5 along with specific commits for the code base shown a lack of validation on the VirtualService Gateway fields that could allow route hijacking • In testing, it did not appear to be possible to secure the control plane either by the controlPlaneSecuri ty

available on GitHub as OSS. In addition, a dedicated environment created by the Dapr team for the testing purposes was provided. White-box methodology, just as last time, has guided the work of Cure53. attention. The report will now present the scope and test setup as well as the material available for testing. Next, three tickets - one new finding and two collections of past vulnerabilities and weaknesses Vulnerabilities The following sections list both vulnerabilities and implementation issues spotted during the testing period. Note that findings are listed in chronological order rather than by their degree of severity

updates for app and version labels ● Istio default retry policy ● Istio proxy performance and load testing ● Abstracting the Istio features 44 Moving HTTP/2 load-balancing from client-side to Envoy Adopting bigger cost ● Case 2: Adjust based on workloads + Resource cost is low - Tremendous cost in load-testing and adjusting values 59 Istio proxy performance and capacity Adopting Istio ● One size fits can we adjust the sidecar size? ○ VPA? Not working ○ HPA? Not applicable ○ Load testing application, load testing the sidecar -> seems the only way We just want a dynamic smart autoscaler for Istio

Murthy #IstioCon Agenda ● Introduction ● Applications Deployment ● Service Mesh Journey ● Scale Testing ● Future Direction #IstioCon Introduction: eBay at a glance 185M Number of Active Buyers worldwide scale …? ● Extensive Data-plane & Control-plane scale testing ● Data-plane performance of Envoy is well documented ● Control-plane scale testing ○ Primary Goal ■ Understand Istio control-plane performance configuration params - debounce interval, push concurrency, etc. #IstioCon Control-plane Scale Testing: Setup ● Setup ○ Create Gateway Pods & thousands of Pods with sidecar Envoys ○ Measure Config

substrings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564 2.9.7 Testing for strings that match or contain a pattern . . . . . . . . . . . . . . . . . . . . . . . 568 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107 3.2.8 Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 3 options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2539 3.14.2 Testing functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2554 3