---
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
title: "NetworkPolicy Smoke Test"
description: ""
---

Use this how-to to verify the Helm `networkPolicies` values on a local Kind
cluster with Calico enforcing Kubernetes NetworkPolicy resources and Chainsaw
running the behavioral assertions.

## Prerequisites

- A source checkout of `NVIDIA-NeMo/nemo-platform`
- `docker`, `kind`, `kubectl`, and `helm` available on your workstation
- A local `chainsaw` binary, or Docker access to `ghcr.io/kyverno/chainsaw:v0.2.3`
- `NGC_API_KEY` with access to the NeMo Platform chart and container images
- Permission to create and delete the local Kind cluster and Kubernetes namespaces

## Run The Smoke Test

<Tabs>

<Tab title="CLI">

Set the image and namespace inputs, then run the source-checkout smoke script:

```sh
export NGC_API_KEY=<your-ngc-api-key>
export KIND_CLUSTER_NAME=nmp-network-policy
export KUBE_NAMESPACE=nemo-platform

e2e/k8s/scripts/run_network_policy_e2e.sh
```

The script creates or validates a Kind cluster, installs Calico as the enforcing
CNI, installs the chart with `e2e/k8s/values/network-policies.yaml`, and runs a
Chainsaw test suite that creates probe pods to verify allowed API/controller
traffic and denied unlabelled or managed-job egress traffic.

</Tab>

<Tab title="Python SDK">

The Python SDK does not create Kind clusters, install Helm charts, or run
Kubernetes NetworkPolicy probes. After the CLI smoke test passes, use the SDK
only for a post-smoke API check if you expose the API with `kubectl
port-forward`:

```sh
kubectl -n "$KUBE_NAMESPACE" port-forward svc/nemo-platform-api 8080:8080
```

```python
from nemo_platform import NeMoPlatform

client = NeMoPlatform(base_url="http://localhost:8080")
for workspace in client.workspaces.list().data:
    print(workspace.name)
```

</Tab>

</Tabs>

<Accordion title="Registry and private image options">

Set `CALICO_IMAGE_REGISTRY` to override the Calico registry used by the Kind
setup script. The default is `docker.io/calico`.

Set `CHAINSAW_IMAGE` to override the Chainsaw container image used when a local
`chainsaw` binary is not installed. The default is
`ghcr.io/kyverno/chainsaw:v0.2.3`.

When testing source changes, set `NMP_E2E_REGISTRY` and `NMP_E2E_TAG` to a
branch-built `nmp-api` image. CI supplies these from the CPU smoke image build.
If the image is in private GHCR, export `GITHUB_TOKEN` so the setup script can
create the pull secret.

</Accordion>

## Next Steps

- Review the [Helm chart reference](/documentation/self-managed-deployment/helm/helm-reference) for the generated `networkPolicies` values.
- Continue with [Install](/documentation/self-managed-deployment/setup/helm/install) for production chart installation.
- Review [Security](/documentation/self-managed-deployment/setup/security) for broader deployment hardening.
