Staging Environment with API Gateway Environment

Question

Short description

My current test scenario is about designing a test staging environment that is addressed via an API gateway. We chose WSO2. They already have corresponding test frameworks on board, but I want to go other ways, because we already use acceptance testing via Cucumber and serenity.

Another problem is that several projects are currently being tested in regression. Of course I have to take a look at these projects to change them to the current and agile way.

In my planning I want to do acceptance tests, UI tests and penetration tests in the test environment (but also in the production environment). For the acceptance test, we currently used serenity in the test environments and, of course, integrated reporting accordingly.

For penetration testing I would use ZAP or a similar tool and want to integrate it into the test environment as well as into the production environment.

Current structure:

• Various projects with applications that are still being tested via
  regression on the one hand.
• Isolated projects tested through serenity and pipelined into Jenkins
• Currently no penetration test available
• Currently no load or performance test available
• The test team is currently designed for three testers

Planned structure

• API Gateway Solution via WSO2
• Planned integration of serenity Jenkins pipelines into WSO2 as acceptance test on test environment
• Planned load and performance test on the production environment (possibly already on the staging environment?)
• Planned penetration test on the test environment as well as on the production environment

queries

• Would you rather use your own test frameworks in WSO2? Or should existing test frameworks be connected to WSO2 via Jenkins?
• Should integration testing be performed on the staging environment?
• What would your test plan look like on an appropriate staging environment?
• Should Load and Performance Testing only be performed on the production environment?
• Should one use the existing penetration test solutions of WSO2 or rather integrate own solutions?

Answer 1

Would you rather use your own test frameworks in WSO2? Or should existing test frameworks be connected to WSO2 via Jenkins?

In your case I would research if you can use the WSO2 testing framework in combination with Cucumber/Serenity. Make some proof of concepts of all situations.

Should integration testing be performed on the staging environment?

Yes, why not?

What would your test plan look like on an appropriate staging environment?

Automate everything. In a world of continuous delivery this is a must.

Should Load and Performance Testing only be performed on the production environment?

It depends. My current team has a production like environment to load test against. We do not want disturbe the datacollection in production, but be confident enough that after a deploy performance was not degraded. I have also worked on products where doing a load test on production was fine, for example in the weekend. Preferably you automate load-testing in your buildpipeline.

Should one use the existing penetration test solutions of WSO2 or rather integrate own solutions?

Security testing is whole topic on its own. Probably you need a combination. I cant imagion that a tool delivered with a framework is enough to be confident that a system is well pen-tested.