test: use chainsaw for network policy smoke

Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>

Author: mckornfield

.github/workflows/ci.yaml

@@ -620,20 +620,27 @@ jobs:
         shell: bash
         env:
           NAMESPACE: nemo-platform
+          CHAINSAW_REPORT_FORMAT: XML
+          CHAINSAW_REPORT_NAME: report-network-policy-smoke
+          CHAINSAW_REPORT_PATH: .
         run: |
           if e2e/k8s/scripts/test_network_policies.sh; then
-            printf '<testsuite name="network-policy-smoke" tests="1" failures="0"/>%s' $'\n' > report-network-policy-smoke.xml
-          else
-            status="$?"
+            if [ ! -f report-network-policy-smoke.xml ]; then
+              printf '<testsuite name="network-policy-smoke" tests="1" failures="0"/>%s' $'\n' > report-network-policy-smoke.xml
+            fi
+            exit 0
+          fi
+          status="$?"
+          if [ ! -f report-network-policy-smoke.xml ]; then
             cat > report-network-policy-smoke.xml <<'EOF'
           <testsuite name="network-policy-smoke" tests="1" failures="1">
             <testcase name="network-policy-smoke">
               <failure message="network policy smoke test failed">See the workflow log and Kubernetes artifact bundle.</failure>
             </testcase>
           </testsuite>
           EOF
-            exit "${status}"
           fi
+          exit "${status}"
 
       - name: Finalize Kind e2e
         if: always()

Makefile

@@ -599,8 +599,8 @@ test-e2e-kubernetes: ## Run e2e tests against Kubernetes (set NMP_E2E_CLUSTER_UR
 	$(UV) run --frozen pytest e2e --kubernetes -v -n 2 --junitxml=report-kubernetes.xml
 
 .PHONY: test-e2e-kubernetes-network-policies
-test-e2e-kubernetes-network-policies: ## Set up local kind with Calico and run the Helm NetworkPolicy smoke test
-	@echo "Running Kubernetes NetworkPolicy e2e smoke test..."
+test-e2e-kubernetes-network-policies: ## Set up local kind with Calico and run the Chainsaw NetworkPolicy smoke test
+	@echo "Running Chainsaw NetworkPolicy e2e smoke test..."
 	e2e/k8s/scripts/run_network_policy_e2e.sh
 
 .PHONY: test-e2e-kubernetes-auth

docs/set-up/helm/index.mdx

@@ -26,7 +26,7 @@ Install the NeMo Platform using the Helm chart.
 </Card>
 <Card title="NetworkPolicy Smoke Test" href="/documentation/self-managed-deployment/setup/helm/network-policy-smoke-test">
 
-Verify optional Helm NetworkPolicies on a local Kind cluster with Calico.
+Verify Helm NetworkPolicies on a local Kind cluster with Calico and Chainsaw.
 
 <small><span class="md-tag">cluster-admin</span> <span class="md-tag">kind</span> <span class="md-tag">networking</span></small>
 

docs/set-up/helm/network-policy-smoke-test.mdx

@@ -4,13 +4,15 @@ description: ""
 ---
 <a id="network-policy-smoke-test"></a>
 
-Use this how-to to verify the optional Helm `networkPolicies` values on a local
-Kind cluster with Calico enforcing Kubernetes NetworkPolicy resources.
+Use this how-to to verify the Helm `networkPolicies` values on a local Kind
+cluster with Calico enforcing Kubernetes NetworkPolicy resources and Chainsaw
+running the behavioral assertions.
 
 ## Prerequisites
 
 - A source checkout of `NVIDIA-NeMo/nemo-platform`
 - `docker`, `kind`, `kubectl`, and `helm` available on your workstation
+- A local `chainsaw` binary, or Docker access to `ghcr.io/kyverno/chainsaw:v0.2.3`
 - `NGC_API_KEY` with access to the NeMo Platform chart and container images
 - Permission to create and delete the local Kind cluster and Kubernetes namespaces
 
@@ -31,9 +33,9 @@ e2e/k8s/scripts/run_network_policy_e2e.sh
 ```
 
 The script creates or validates a Kind cluster, installs Calico as the enforcing
-CNI, installs the chart with `e2e/k8s/values/network-policies.yaml`, and runs
-in-cluster probes that verify allowed API/controller traffic and denied
-unlabelled or managed-job egress traffic.
+CNI, installs the chart with `e2e/k8s/values/network-policies.yaml`, and runs a
+Chainsaw test suite that creates probe pods to verify allowed API/controller
+traffic and denied unlabelled or managed-job egress traffic.
 
 </Tab>
 
@@ -65,6 +67,10 @@ for workspace in client.workspaces.list().data:
 Set `CALICO_IMAGE_REGISTRY` to override the Calico registry used by the Kind
 setup script. The default is `docker.io/calico`.
 
+Set `CHAINSAW_IMAGE` to override the Chainsaw container image used when a local
+`chainsaw` binary is not installed. The default is
+`ghcr.io/kyverno/chainsaw:v0.2.3`.
+
 When testing source changes, set `NMP_E2E_REGISTRY` and `NMP_E2E_TAG` to a
 branch-built `nmp-api` image. CI supplies these from the CPU smoke image build.
 If the image is in private GHCR, export `GITHUB_TOKEN` so the setup script can