Managing Development and Testing
1. Setting Up Development Environments
| Env | Purpose |
|---|---|
| local | Docker Compose, fast iter |
| dev | Shared cluster, latest commits |
| staging | Production-mirror, pre-release |
| prod | Live traffic |
| sandbox | External developer testing |
2. Configuring Sandbox Endpoints
| Feature | Sandbox Behavior |
|---|---|
| Real backend | Isolated test DB |
| No charges | Mock payment processor |
| Test keys | sk_test_* |
| Lower rate limits | Encourage prod migration |
| Reset daily | Clean state |
3. Using Request/Response Mocking
Example: Mock via response-transformer
plugins:
- name: request-termination
config:
status_code: 200
content_type: application/json
body: |
{"id": "mock-123", "status": "pending", "_mock": true}
4. Implementing Test Credentials
| Type | Convention |
|---|---|
| Test API keys | sk_test_* prefix |
| Test card numbers | 4242424242424242 (Stripe) |
| Test webhooks | HMAC with known secret |
| Triggered errors | Magic values force failure |
5. Setting Up Integration Testing
| Layer | Tool |
|---|---|
| HTTP API | REST Assured, supertest, httpx |
| Schema | Dredd, Schemathesis |
| Browser E2E | Playwright, Cypress |
| Contract | Pact, OpenAPI diff |
6. Using Contract Testing
Example: Pact consumer test
provider.given("user 42 exists")
.uponReceiving("a request for user 42")
.withRequest({ method: "GET", path: "/users/42" })
.willRespondWith({
status: 200,
headers: { "Content-Type": "application/json" },
body: { id: 42, name: like("Ana") }
});
7. Configuring Load Testing
| Tool | Strength |
|---|---|
| k6 | Scriptable JS, Grafana native |
| Gatling | Scala DSL, detailed reports |
| Locust | Python, distributed |
| Vegeta | CLI constant-rate |
| wrk | C, max throughput |
8. Implementing Security Testing
| Test | Tool |
|---|---|
| SAST (code) | Semgrep, SonarQube, CodeQL |
| DAST (running) | OWASP ZAP, Burp |
| Container | Trivy, Grype |
| Dependency | Snyk, Dependabot |
| Fuzzing | RESTler, Schemathesis |
9. Setting Up Continuous Deployment
CD Pipeline
- PR opened → run unit + lint
- Merge to main → build image, push registry
- Deploy to dev → integration tests
- Auto-promote to staging → smoke tests
- Canary 1% prod → SLO check
- Gradual rollout 10% → 50% → 100%
- Auto-rollback if error rate spikes
10. Configuring Canary Releases
| Setting | Value |
|---|---|
| Initial traffic | 1% |
| Step size | 5-10% per stage |
| Bake time | 10-30 min per stage |
| SLO gate | Error rate < baseline + 10% |
| Auto-rollback trigger | 3 consecutive SLO breach |