Docker-based infrastructure testing tool

Question

I am currently trying to migrate a VM-based infrastructure to a Docker-based one and take the chance to add behavior testing to this infrastructure. So I aim to have all changes I make to the base system configuration in code (e.g. in a Dockerfile), git versioned and (in an ideal world) every change should have a testable effect.

Examples for tests I want to do:

• If I add a user account and a permission rule in my "postgres" container, then user "x" should be able to access (only) database "y" (only) from the "web" container.
• If I change the postfix configuration like insert change here, then human users must authenticate, but system users can send email unauthenticated.
• If I change the Apache configuration like insert change here, then average response time goes below x ms.

Things I don't really want to test (doesn't hurt if I could, though):

• File x should be present.
• Service y should be installed.

I was wondering what is a good/common approach to do infrastructure testing such as the above and would be happy to receive any advice or hear best practices. (I discovered serverspec, but it seemed to me as if this would support rather the second kind of tests; in all the examples I read it would rather check system state than system behavior.)

Answer 1

In a single "behavior testing" you're mixing various idea. Testing security (access ...), app monitoring (response time ...), infrastructure compliance (file / service should be present ...).

Since you're going the infra as a versioned code way, you should first test it like any code, and serverspec is a good tool for that. I personnaly prefer testinfra, the python based equivalent framework. There are others, like goss, robotframework, inspec... There you can test a lot of things : listening to port 80, service running, config file exists. And more, since you can wire any piece of code, you can read a config file and check if user X has access to database Y but not to database Z.

As for the response time that's a monitoring topic if it's about live environment, or load testing if it's about testing staging before going live. There are tons of possibilities for monitoring, like nagios, zabbix... For load testing I'ld go for locust.