Load testing a gRPC service

You can use Load Testing for service load testing via gRPC with the Pandora load generator.

To perform load testing:

1. Get your cloud ready.
2. Prepare a test target.
3. Set up your infrastructure.
4. Create an agent.
5. Test gRPC Server Reflection.
6. Prepare a file with test data.
7. Run a test.

If you no longer need the resources you created, delete them.

Get your cloud readyGet your cloud ready

Sign up in Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or register a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

If the agent is hosted on Yandex Cloud, you pay for computing resources (see Yandex Compute Cloud pricing).

At the Preview stage, Load Testing is free of charge.

Prepare a test targetPrepare a test target

In this example, we will be using a gRPC service with the 172.17.0.10 internal IP address in the same subnet as where the agent will reside.

To learn how to integrate the gRPC framework for different programming languages, see the documentation.

1. Configure support for gRPC Server Reflection. To learn how to configure gRPC Server Reflection for different programming languages, see the documentation.

   With gRPC Server Reflection, the load generator polls the server at the start of a test to collect information about services and their methods and uses this data to generate correct gRPC requests during the test.

2. Install a port for access to the gRPC service: 8080.

You can also use Load Testing for load testing of a service that is public or located in a subnet and security group other than those of the agent.

For a public service, allow incoming HTTPS traffic on port 8080.

For a service whose subnet and security group is different from the agent's ones, create a rule for incoming HTTPS traffic on port 8080 in the security group where the test target is located.

Set up your infrastructureSet up your infrastructure

Create a service accountCreate a service account

1. Create a service account named sa-loadtest in the folder to host the agent that will generate the load.
2. Assign the following roles to the service account:
   • loadtesting.generatorClient: Allows running the agent, performing tests on the agent, and uploading the results to storage.
   • compute.admin: Allows managing VMs in Compute Cloud.
   • vpc.user: Allows connecting to Virtual Private Cloud network resources and using them.

Configure a networkConfigure a network

Create and configure a NAT gateway in the subnet where your test target is and where the agent will reside. This will enable the agent to access Load Testing.

Configure security groupsConfigure security groups

1. Set up the test agent's security group:

   1. Create an agent security group named agent-sg.
   2. Add rules:

      1. Rule for outgoing HTTPS traffic to the Load Testing public API:

         • Port range: 443
         • Protocol: TCP
         • Destination name: CIDR
         • CIDR blocks: 0.0.0.0/0

         This will allow connecting the agent to Load Testing to manage tests from the interface and get test results.

      2. Rule for incoming SSH traffic:

         • Port range: 22
         • Protocol: TCP
         • Destination name: CIDR
         • CIDR blocks: 0.0.0.0/0

         This will allow you to connect to the agent over SSH and manage tests from the console or collect debugging information.

      3. Rule for outgoing traffic when generating load to the test target:

         • Port range: 0-65535
         • Protocol: Any
         • Destination name: Security group
           Select From list. Specify the security group where the test target is located.

         Create this rule for each test target with a unique security group.

2. Set up the test target's security group:

   1. Create the test target's security group named load-target-sg.

   2. Add a rule for incoming traffic when generating load to the test target:

      • Port range: 0-65535.
      • Protocol: Any.
      • Select From list. Specify the security group where the test target is located.

      This rule allows agents to generate load to this target or enable additional monitoring tools.

Create a test agentCreate a test agent

1. If you do not have an SSH key pair yet, create one.

2. Create an agent.

   Management console

   CLI

   1. In the management console, select the folder where you want to create the agent.

   2. From the list of services, select Load Testing.

   3. In the Agents tab, click Create agent.

   4. Enter a name for the agent, e.g., agent-008.

   5. Specify the same availability zone where the test target is located.

   6. Under Agent:

      • Select the appropriate agent type. For more information, see Agent performance.
      • Specify the subnet where the test target is located. Make sure you created and set up a NAT gateway in the subnet.
      • If security groups are available to you, select a security group preset for the agent.

   7. Under Access, specify the information required to access the agent:

      • Select the sa-loadtest service account.

      • Under Login, enter a username.

        Alert

        Do not use root or other reserved usernames. To perform operations requiring root privileges, use the sudo command.

      • In the SSH key field, paste the contents of the public key file.

   8. Click Create.

   9. Wait for the VM instance to create. Make sure the agent status has changed to Ready for test.

      Note

      If the agent creation process has stopped at Initializing connection, make sure the following conditions are met:

      • The agent has a public IP address and access to loadtesting.api.cloud.yandex.net:443.
      • A NAT gateway is set up in the target subnet.
      • The service account assigned to the agent has the required roles.

   If you do not have the Yandex Cloud CLI yet, install and initialize it.

   The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

   1. See the description of the CLI command for creating an agent:

      yc loadtesting agent create --help
      

   2. Select the same availability zone where the test target is located.

   3. Select the subnet where the test target is located. Make sure you created and set up a NAT gateway in the subnet.

      To get a list of available subnets using the CLI, run this command:

      yc vpc subnet list
      

      Result:

      +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+
      |          ID          |           NAME            |      NETWORK ID      | ROUTE TABLE ID |       ZONE        |      RANGE      |
      +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+
      | e2lfkhps7bol******** |   default-ru-central1-b   | enpnf7hajqmd******** |                |   ru-central1-b   | [10.129.0.0/24] |
      | e9bgnq1bggfa******** |   default-ru-central1-a   | enpnf7hajqmd******** |                |   ru-central1-a   | [10.128.0.0/24] |
      | fl841n5ilklr******** |   default-ru-central1-d   | enpnf7hajqmd******** |                |   ru-central1-d   | [10.130.0.0/24] |
      +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+
      

   4. Select the security group. Make sure to configure the security group in advance.

      To get a list of available security groups using the CLI, run this command:

      yc vpc security-group list
      

      Result:

      +----------------------+---------------------------------+--------------------------------+----------------------+
      |          ID          |              NAME               |          DESCRIPTION           |      NETWORK-ID      |
      +----------------------+---------------------------------+--------------------------------+----------------------+
      | enp414a2tnnp******** | default-sg-enpnf7hajqmd******** | Default security group for     | enpnf7hajqmd******** |
      |                      |                                 | network                        |                      |
      | enpctpve7951******** | sg-load-testing-agents          |                                | enpnf7hajqmd******** |
      | enpufo9ms0gi******** | sg-load-testing-targets         |                                | enpnf7hajqmd******** |
      +----------------------+---------------------------------+--------------------------------+----------------------+
      

   5. Find out the sa-loadtest service account ID using its name:

      yc iam service-account get sa-loadtest
      

      Result:

      id: ajespasg04oc********
      folder_id: b1g85uk96h3f********
      created_at: "2024-12-04T17:38:57Z"
      name: sa-loadtest
      last_authenticated_at: "2024-12-12T19:10:00Z"
      

   6. Create an agent in the default folder:

      yc loadtesting agent create \
        --name agent-008 \
        --labels origin=default,label-key=label-value \
        --zone default-ru-central1-a \
        --network-interface subnet-id=e9bgnq1bggfa********,security-group-ids=enpctpve7951******** \
        --cores 2 \
        --memory 2G \
        --service-account-id ajespasg04oc********
        --metadata-from-file user-data=metadata.yaml
      

      Where:

      • --name: Agent name.
      • --labels: Agent labels.
      • --zone: Availability zone to host the agent.
      • --network-interface: Agent network interface settings:
        • subnet-name: ID of the selected subnet.
        • security-group-ids: Security group IDs.
      • --cores: Number of CPU cores the agent can use.
      • --memory: Amount of RAM allocated to the agent.
      • --service-account-id: Service account ID.
      • --metadata-from-file: <key>=<value> pair with the name of the file containing the public SSH key path. For an example of the metadata.yaml configuration file, see VM metadata.

      For more information on how to create an agent with CLI, see the Yandex Cloud Examples repository.

3. Assign a public IP to the agent to enable access over SSH:

   Management console

   CLI

   1. In the management console, select the folder where the agent is located.
   2. Select Compute Cloud.
   3. Select the VM named agent-008.
   4. Under Network interface, in the top-right corner, click and select Add public IP address.
   5. In the window that opens:
      • In the Public address field, select obtaining a Auto address.
      • Click Add.

   To assign a public IP address to an agent, run the following CLI command:

   yc compute instance add-one-to-one-nat \
     --id=<VM_ID> \
     --network-interface-index=<VM_network_interface_number> \
     --nat-address=<IP_address>
   

   Where:

   • --id: VM ID. You can get a list of available VM IDs in a folder using the yc compute instance list CLI command.

   • --network-interface-index: VM network interface number. The default value is 0. To get a list of VM network interfaces and their numbers, run the following command: yc compute instance get <VM_ID>.

   • --nat-address: Public IP address to assign to the VM. This is an optional parameter. If you omit it, a public IP address will be assigned to the VM automatically.

     You can get a list of reserved public IP addresses available in a folder using the yc vpc address list CLI command. The IP address and the VM must be in the same availability zone.

   Usage example:

   yc compute instance add-one-to-one-nat \
     --id=fhmsbag62taf******** \
     --network-interface-index=0 \
     --nat-address=51.250.*.***
   

   Result:

   id: fhmsbag62taf********
   folder_id: b1gv87ssvu49********
   created_at: "2022-05-06T10:41:56Z"
   ...
   network_settings:
     type: STANDARD
   placement_policy: {}
   

   For more information about the yc compute instance add-one-to-one-nat command, see the CLI reference.

Test gRPC Server ReflectionTest gRPC Server Reflection

1. Connect to the agent via SSH.

2. Run the following command to test gRPC Server Reflection on the gRPC service:

   Connecting via TLS

   Connecting without TLS

   grpcurl 172.17.0.10:8080 list
   

   grpcurl --plaintext 172.17.0.10:8080 list
   

   Result:

   api.Adder
   grpc.reflection.v1alpha.ServerReflection
   

Prepare a file with test dataPrepare a file with test data

1. Generate test data in GRPC_JSON format:

   {"tag": "/Add", "call": "api.Adder.Add", "payload": {"x": 21, "y": 12}}
   {"tag": "/Add", "call": "api.Adder.Add", "payload": {"x": 21, "y": 12}}
   {"tag": "/Add2", "call": "api.Adder.Add", "payload": {"x": 210, "y": 120}}
   

   Where:

   • tag: Request tag to display in reports.
   • call: Method being called.
   • payload: Dictionary with call parameters to provide to the test target.

   In our example, two thirds of requests will be tagged as /Add and one third, as /Add2.

2. Save the payloads to a file named data.json.

Run a testRun a test

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. To avoid paying for them, delete the resources you no longer need:

1. Delete the agent.
2. Delete the route table.
3. Delete the NAT gateway.