https://tomatool.github.io/blog/Notes on testing services from the outside, with tomato.en-usThu, 22 Oct 2026 23:30:00 +0200https://tomatool.github.io/blog/posts/presets-redis-elasticache/Thu, 22 Oct 2026 23:30:00 +0200https://tomatool.github.io/blog/posts/presets-redis-elasticache/A service on ElastiCache with cluster mode and TLS has one Redis client, and a plain Redis container can’t answer it. A tomato preset is a container tomato knows how to run: one line in tomato.yml, and tomato does the parts a container definition can’t, while it starts the run. The redis preset now runs a TLS cluster.https://tomatool.github.io/blog/posts/breaking-the-network/Thu, 22 Oct 2026 01:00:00 +0200https://tomatool.github.io/blog/posts/breaking-the-network/Databases fail over, caches hang, brokers restart. A test suite on localhost never sees any of it, so the timeouts, retries and fallbacks written for those moments never run until production. tomato’s network resource puts a proxy between your service and its dependencies and breaks the link on purpose, one scenario at a time.https://tomatool.github.io/blog/posts/testing-web-uis/Thu, 22 Oct 2026 00:30:00 +0200https://tomatool.github.io/blog/posts/testing-web-uis/tomato’s browser resource drives a real Chromium the way a person does: it finds fields and buttons by the names people read, waits for the page instead of sleeping, and starts every scenario signed out. Here is what happens on each step, from the click to the database row it wrote.https://tomatool.github.io/blog/posts/databases/Wed, 21 Oct 2026 06:20:00 +0200https://tomatool.github.io/blog/posts/databases/tomato empties your databases before every scenario, and there is no switch to turn that off. Why that is the cure for flaky suites, how it fits with migrations, how to keep a table when you must, and how it works for Postgres, ScyllaDB, Redis and the databases tomato has no resource for.https://tomatool.github.io/blog/posts/testing-msk-iam/Wed, 21 Oct 2026 06:15:00 +0200https://tomatool.github.io/blog/posts/testing-msk-iam/A service that produces to Amazon MSK with IAM has no Kafka password: it trades a web identity token for a role session at STS and signs the handshake with it. Tests usually switch all of that off. tomato runs it: its aws resource serves STS and its kafka preset speaks AWS_MSK_IAM, so the service’s own auth code runs, and fails, the way it does on AWS.https://tomatool.github.io/blog/posts/driving-your-service/Wed, 21 Oct 2026 06:00:00 +0200https://tomatool.github.io/blog/posts/driving-your-service/Clients are how a tomato scenario uses your service: through its HTTP API, its gRPC API, its web page in a real browser, or its command line. One idea, four doors.https://tomatool.github.io/blog/posts/mocking-third-party-dependencies/Wed, 21 Oct 2026 05:30:00 +0200https://tomatool.github.io/blog/posts/mocking-third-party-dependencies/A stub stands in for a service you don’t run: it answers the way you tell it to, fails when you ask it to, and remembers what your service sent. How tomato’s HTTP, gRPC and WebSocket stubs work, in one picture.https://tomatool.github.io/blog/posts/testing-object-storage/Wed, 21 Oct 2026 05:00:00 +0200https://tomatool.github.io/blog/posts/testing-object-storage/S3, Cloudflare R2, DigitalOcean Spaces, Backblaze B2 and Google Cloud Storage all speak the S3 API. So one MinIO container can stand in for any of them in a tomato run, and the service’s code doesn’t change, only four environment variables.https://tomatool.github.io/blog/posts/code-coverage-for-black-box-tests/Wed, 21 Oct 2026 03:00:00 +0200https://tomatool.github.io/blog/posts/code-coverage-for-black-box-tests/tomato tests a service from the outside, so it cannot see the code it exercised. The service can: every mainstream language can measure a running process and write the result when it exits. How the approach works, what the number does and doesn’t tell you, and a page per language.