Load Test Google Cloud APIs

JMeter and Go

Google Cloud Platform provides the ability to monitor quota and request increases within the Cloud Console.

This provides fantastic transparency and control, but doesn’t obviate the need for load testing:

• One aspect of Google Cloud Platform’s defense in depth is that multiple layers of the infrastructure have their own protections against abuse, which can manifest as a load limitation.
• Quotas for some Google Cloud APIs such as the Admin SDK (ignore the legacy G Suite branding; this applies to Cloud Identity APIs as well) aren’t surfaced through the Cloud Console.

Apache JMeter(TM) is a popular open source tool for load testing; it includes scriptable Samplers in JSR223-compatible languages like Groovy and BeanShell.

However, when it comes to scripting, you may prefer to code it yourself in a familiar language. And if you were intrigued when the Go programming language was released, but had been waiting for the right use case, this is it.

JMeter

Those of you familiar with JMeter may find configuring it for Google Cloud a no-brainer; however, if you’re new to either JMeter or Google Cloud, the following may save you some trial and error.

Create an OAuth client ID

This step is required if you have non-default quota associated with your project; otherwise you can skip it.

You’ll need a Google Cloud credential to authorize JMeter against your project; make sure you create it on the project against which you want to test so the appropriate quotas are applied. Create a new credential rather than re-using an existing one in case it’s compromised.

• Application Type: web application
• Authorized Javascript origins: https://developers.google.com
• Authorized redirects: https://developers.google.com/oauthplayground

Record the client ID and secret securely.

Get an access token

Make sure you’re in a browser session associated with your test project’s domain, and with an identity which has sufficient permissions to authorize the API scope (eg. Super Admin role for Admin SDK APIs).

In the OAuth 2.0 Playground…

If you have non-default quota associated with your project, click on the settings (gear icon) and…

• Select ‘Use your own OAuth Credentials’
• Provide the client ID and secret you generated above

Otherwise you can use the default credentials generated by the Playground.

In the main screen follow the prompts to:

• Step 1. Select and authorize APIs: provide the scope for the API you’re going to test, eg. https://www.googleapis.com/auth/admin.directory.group.readonly for the https://www.googleapis.com/auth/admin.directory.group API.
• Step 2. Exchange authorization code for token

This may take you directly to Step 3 and collapse Step 2; expand Step 2 if necessary to see the access token.

You’ll come back to this screen to get the access token in a subsequent step, so don’t close this window.

Install JMeter

Install JMeter (Java SDK is a pre-requisite for recording HTTPS, so install this first if it’s not already installed).

• Mac: brew install JMeter

Run JMeter

From your installation’s bin directory, run JMeter’s UI.

$ bash jmeter

Configure JMeter test plan

Either start with this template and just provide the bold parameters below, or create a new plan and…

Add a Thread Group (right click on Test Plan) and configure it:

• Add -> Threads (users) -> Thread Group
• Action to be taken after a Sampler error: Stop Thread
• Thread Properties -> Number of Threads: 10; start with 1, and ramp up until you reach the QPS you’re aiming for.
• Loop Count: Forever
• Scheduler Configuration -> Duration: 100 seconds; select a duration that matches the quota period you’re testing.

Add an HTTP Request Sampler (right click on Thread Group) and configure it:

• Add -> Sampler -> HTTP Request
• Web Server -> Protocol: https
• Web Server -> Name or IP: content.googleapis.com
• Method: GET (unless you’re testing inserts, for which scripting is often required)
• Path: this is appended to the server, eg. /admin/directory/v1/groups
• Parameters (don’t encode): these are appended to the path, eg. domain=yourdomain.com, userKey=testuser@yourdomain.com

Add an HTTP Header Manager (right click on Test Plan) and configure it:

• Add -> Config Element -> HTTP Header Manager
• Headers: Authorization=Bearer [YOUR ACCESS TOKEN: copy/paste the token you created in the OAuth 2.0 Playground earlier; you may need to refresh it first]

Add Summary Report and Results Tree listeners (right click on Test Plan):

• Add -> Listener -> Summary Report
• Add -> Listener -> View Results Tree; ensure that the Log/Display Only boxes aren’t selected to see both error and success logs.

Save JMeter test plan

You’ll be prompted in any case…

Run the JMeter test plan

Select the Summary Report to monitor progress and click on the green Play button at the top of the screen.

When the run is complete, check the listeners:

• The Summary Report shows the total number of queries submitted (“# Samples”) before the quota maxed out or the run exceeded the configured duration, as well as the QPS (“Throughput”).
• The View Results Tree -> Response data shows detailed responses and any error messages.

When you’re satisfied with your test plan you can run it directly from the command line.

Go

Load testing and multi-threading go together like toast and jam; however, Go isn’t as performant as JMeter, so you’ll need to run more threads, aka Go routines, to generate the same load as JMeter; in return you get loads of control and flexibility.

There are a couple of ways of implementing multi-threading:

• Mutexes
• Stateful goroutines and channels

Mutexes are a good match for the load testing use case, so you can mash up the sample mutex application with the Admin SDK Go quickstart application and add a dash of CLI sugar to build a simple load test harness for group list and insert operations.

The list command operates similarly to the JMeter test above; the insert command increments group names as it inserts them.

You need to use go build to compile the code, and then run the binary; command-line flags and arguments don’t work with the go run shortcut.

Download an OAuth credential

You’ll need to authorize the tool against the Admin SDK (this requires using a session associated with a user with the Super Admin role; Google Cloud Platform APIs just require the usual IAM permissions).

Use the “Enable the Directory API” button to enable the API on an existing or new project and download a token to your source directory; the application takes you through the auth flow instead of having to use the OAuth 2.0 playground.