> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-platform/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-platform/_mcp/server.

# NetworkPolicy Smoke Test

Use this how-to to verify the Helm `networkPolicies` values on a local Kind
cluster with Calico enforcing Kubernetes NetworkPolicy resources and Chainsaw
running the behavioral assertions.

## Prerequisites

* A source checkout of `NVIDIA-NeMo/nemo-platform`
* `docker`, `kind`, `kubectl`, and `helm` available on your workstation
* A local `chainsaw` binary, or Docker access to `ghcr.io/kyverno/chainsaw:v0.2.3`
* `NGC_API_KEY` with access to the NeMo Platform chart and container images
* Permission to create and delete the local Kind cluster and Kubernetes namespaces

## Run The Smoke Test

#### CLI

Set the image and namespace inputs, then run the source-checkout smoke script:

```sh
export NGC_API_KEY=<your-ngc-api-key>
export KIND_CLUSTER_NAME=nmp-network-policy
export KUBE_NAMESPACE=nemo-platform

e2e/k8s/scripts/run_network_policy_e2e.sh
```

The script creates or validates a Kind cluster, installs Calico as the enforcing
CNI, installs the chart with `e2e/k8s/values/network-policies.yaml`, and runs a
Chainsaw test suite that creates probe pods to verify allowed API/controller
traffic and denied unlabelled or managed-job egress traffic.

#### Python SDK

The Python SDK does not create Kind clusters, install Helm charts, or run
Kubernetes NetworkPolicy probes. After the CLI smoke test passes, use the SDK
only for a post-smoke API check if you expose the API with `kubectl
port-forward`:

```sh
kubectl -n "$KUBE_NAMESPACE" port-forward svc/nemo-platform-api 8080:8080
```

```python
from nemo_platform import NeMoPlatform

client = NeMoPlatform(base_url="http://localhost:8080")
for workspace in client.workspaces.list().data:
    print(workspace.name)
```

#### Registry and private image options

Set `CALICO_IMAGE_REGISTRY` to override the Calico registry used by the Kind
setup script. The default is `docker.io/calico`.

Set `CHAINSAW_IMAGE` to override the Chainsaw container image used when a local
`chainsaw` binary is not installed. The default is
`ghcr.io/kyverno/chainsaw:v0.2.3`.

When testing source changes, set `NMP_E2E_REGISTRY` and `NMP_E2E_TAG` to a
branch-built `nmp-api` image. CI supplies these from the CPU smoke image build.
If the image is in private GHCR, export `GITHUB_TOKEN` so the setup script can
create the pull secret.

## Next Steps

* Review the [Helm chart reference](/documentation/self-managed-deployment/helm/helm-reference) for the generated `networkPolicies` values.
* Continue with [Install](/documentation/self-managed-deployment/setup/helm/install) for production chart installation.
* Review [Security](/documentation/self-managed-deployment/setup/security) for broader deployment hardening.