A small, reproducible example of a bounded performance-testing delivery: functional smoke checks, a controlled arrival-rate ramp, explicit service-level thresholds, and an honest saturation finding instead of a fabricated “500 RPS passed” claim.
server.py— deterministic threaded local target with/healthand bounded/work?delay_ms=endpoints.tests/test_server.py— five behavior tests for health, timing bounds, validation, and 404 handling.load/smoke.js— five functional requests with status, JSON, request-ID, latency, and failure thresholds.load/ramp.js— configurableramping-arrival-rateprofile, capped at 500 target RPS.scripts/run-local.sh— starts the target, waits for readiness, runs smoke and ramp tests, and always cleans up.DELIVERY_REPORT.md— actual observed pass/fail evidence from the same host.
The runner pins the tested k6 image digest (k6 v2.1.0) rather than relying on a mutable latest tag.
Prerequisites: Python 3.11+ and Docker.
python3 -m unittest discover -s tests -v
TARGET_RPS=100 ./scripts/run-local.shTo intentionally probe the local target's saturation point:
TARGET_RPS=500 ./scripts/run-local.shBASE_URL, PORT, TARGET_RPS, and K6_IMAGE are configurable. The ramp validates TARGET_RPS as an integer from 1 through 500.
- failed requests
< 1%; - work-endpoint p95
< 200 ms; - checks
> 99%; - dropped iterations
== 0.
The profile ramps through 25%, 50%, and 100% of the configured target and then ramps down. Because it is a ramp, total requests divided by total wall time is not the target-stage RPS.
On the recorded host:
- target-stage 100 RPS passed all thresholds: 1,152 requests, 0 failures, 0 dropped iterations, p95 18.78 ms, 3,456/3,456 checks passed;
- target-stage 500 RPS failed honestly: 5,666 requests, 3.03% failures, 86 dropped iterations, p95 43.46 ms among completed requests; k6 exited 99 because three thresholds crossed.
That failure is the useful finding: this deliberately simple thread-per-request local target did not sustain the configured 500 RPS stage under the stated SLOs. See DELIVERY_REPORT.md.
Do not point this profile at production without explicit authorization, a documented safe window, an agreed ceiling, rollback contacts, and monitoring. Start with smoke and low-rate stages in staging. Never place credentials in scripts or command history; use scoped environment injection where required.
MIT