feat(cli): Add lifecycle management commands (pause, resume, disable, enable)

k8s-tests/chainsaw/cli/lifecycle/assert-disabled.yaml

@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  annotations:
+    skyhook.nvidia.com/disable: "true"

k8s-tests/chainsaw/cli/lifecycle/assert-enabled.yaml

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  # Note: Chainsaw will verify that disable annotation is NOT present

k8s-tests/chainsaw/cli/lifecycle/assert-paused-and-disabled.yaml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  annotations:
+    skyhook.nvidia.com/pause: "true"
+    skyhook.nvidia.com/disable: "true"

k8s-tests/chainsaw/cli/lifecycle/assert-paused.yaml

@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  annotations:
+    skyhook.nvidia.com/pause: "true"

k8s-tests/chainsaw/cli/lifecycle/assert-resumed.yaml

@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  # Note: Chainsaw will verify that pause annotation is NOT present
+  # by checking the resource exists without that annotation

k8s-tests/chainsaw/cli/lifecycle/assert-still-disabled.yaml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+  annotations:
+    # pause annotation should be removed, but disable should remain
+    skyhook.nvidia.com/disable: "true"

k8s-tests/chainsaw/cli/lifecycle/chainsaw-test.yaml

@@ -0,0 +1,121 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: cli-lifecycle
+spec:
+  description: |
+    Test all CLI lifecycle commands:
+    - pause: pauses a Skyhook from processing
+    - resume: resumes a paused Skyhook
+    - disable: disables a Skyhook completely
+    - enable: enables a disabled Skyhook
+  timeouts:
+    assert: 60s
+    exec: 30s
+  steps:
+  # Step 1: Create a Skyhook
+  - name: setup-skyhook
+    try:
+    - apply:
+        file: skyhook.yaml
+    - script:
+        timeout: 30s
+        content: |
+          echo "Waiting for Skyhook to be created..."
+          for i in $(seq 1 15); do
+            if kubectl get skyhook cli-lifecycle-test 2>/dev/null; then
+              echo "Skyhook created"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Timeout waiting for Skyhook"
+          exit 1
+
+  # Step 2: Test pause command
+  - name: test-pause
+    try:
+    - script:
+        timeout: 30s
+        content: |
+          ../../../../operator/bin/skyhook pause cli-lifecycle-test --confirm
+    - assert:
+        file: assert-paused.yaml
+
+  # Step 3: Test resume command
+  - name: test-resume
+    try:
+    - script:
+        timeout: 30s
+        content: |
+          ../../../../operator/bin/skyhook resume cli-lifecycle-test
+    - assert:
+        file: assert-resumed.yaml
+
+  # Step 4: Test disable command
+  - name: test-disable
+    try:
+    - script:
+        timeout: 30s
+        content: |
+          ../../../../operator/bin/skyhook disable cli-lifecycle-test --confirm
+    - assert:
+        file: assert-disabled.yaml
+
+  # Step 5: Test enable command
+  - name: test-enable
+    try:
+    - script:
+        timeout: 30s
+        content: |
+          ../../../../operator/bin/skyhook enable cli-lifecycle-test
+    - assert:
+        file: assert-enabled.yaml
+
+  # Step 6: Test pause and disable together
+  - name: test-pause-and-disable
+    try:
+    - script:
+        timeout: 30s
+        content: |
+          ../../../../operator/bin/skyhook pause cli-lifecycle-test --confirm
+          ../../../../operator/bin/skyhook disable cli-lifecycle-test --confirm
+    - assert:
+        file: assert-paused-and-disabled.yaml
+    - script:
+        timeout: 30s
+        content: |
+          # Resume should only remove pause, not disable
+          ../../../../operator/bin/skyhook resume cli-lifecycle-test
+    - assert:
+        file: assert-still-disabled.yaml
+    - script:
+        timeout: 30s
+        content: |
+          # Enable should remove disable
+          ../../../../operator/bin/skyhook enable cli-lifecycle-test
+
+  # Cleanup
+  - name: cleanup
+    try:
+    - script:
+        content: |
+          kubectl delete skyhook cli-lifecycle-test 2>/dev/null || true
+

k8s-tests/chainsaw/cli/lifecycle/skyhook.yaml

@@ -0,0 +1,34 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-lifecycle-test
+spec:
+  nodeSelectors:
+    matchLabels:
+      skyhook.nvidia.com/test-node: skyhooke2e
+  packages:
+    test-package:
+      version: "1.0.0"
+      image: ghcr.io/nvidia/skyhook-packages/shellscript
+      configMap:
+        apply.sh: |
+          #!/bin/bash
+          echo "Lifecycle test apply"
+          sleep 2
+

k8s-tests/chainsaw/cli/node/chainsaw-test.yaml

@@ -30,26 +30,11 @@ spec:
     assert: 120s
     exec: 90s
   steps:
-  # Step 1: Create a Skyhook and wait for activity
+  # Step 1: Create a Skyhook
   - name: setup-skyhook
     try:
     - apply:
         file: skyhook.yaml
-    - script:
-        timeout: 60s
-        content: |
-          NODE=$(kubectl get nodes -l skyhook.nvidia.com/test-node=skyhooke2e -o jsonpath='{.items[0].metadata.name}')
-          echo "Waiting for Skyhook activity on node $NODE..."
-          for i in $(seq 1 30); do
-            ANNOTATION=$(kubectl get node "$NODE" -o jsonpath='{.metadata.annotations.skyhook\.nvidia\.com/nodeState_cli-node-test}' 2>/dev/null)
-            if [ -n "$ANNOTATION" ]; then
-              echo "Skyhook activity detected"
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "Timeout waiting for activity"
-          exit 1
 
   # Step 2: Test node list (table format)
   - name: test-node-list

k8s-tests/chainsaw/cli/package/assert-complete.yaml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: skyhook.nvidia.com/v1alpha1
+kind: Skyhook
+metadata:
+  name: cli-package-test
+status:
+  status: complete
+

k8s-tests/chainsaw/cli/package/chainsaw-test.yaml

@@ -29,26 +29,11 @@ spec:
     assert: 120s
     exec: 90s
   steps:
-  # Step 1: Create a Skyhook and wait for package activity
+  # Step 1: Create a Skyhook
   - name: setup-skyhook
     try:
     - apply:
         file: skyhook.yaml
-    - script:
-        timeout: 60s
-        content: |
-          NODE=$(kubectl get nodes -l skyhook.nvidia.com/test-node=skyhooke2e -o jsonpath='{.items[0].metadata.name}')
-          echo "Waiting for Skyhook activity on node $NODE..."
-          for i in $(seq 1 30); do
-            ANNOTATION=$(kubectl get node "$NODE" -o jsonpath='{.metadata.annotations.skyhook\.nvidia\.com/nodeState_cli-package-test}' 2>/dev/null)
-            if [ -n "$ANNOTATION" ]; then
-              echo "Skyhook activity detected"
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "Timeout waiting for activity"
-          exit 1
 
   # Step 2: Test package status (table format)
   - name: test-package-status
@@ -73,9 +58,12 @@ spec:
           # Run logs command - it should succeed (may show waiting or actual logs)
           ../../../../operator/bin/skyhook package logs hello-world --skyhook cli-package-test --node "$NODE"
 
-  # Step 4: Test package rerun
+  # Step 4: Wait for package to complete, then test rerun
   - name: test-package-rerun
     try:
+    - assert:
+        timeout: 120s
+        file: assert-complete.yaml
     - script:
         timeout: 30s
         content: |

k8s-tests/chainsaw/cli/package/skyhook.yaml

@@ -28,5 +28,5 @@ spec:
       image: ghcr.io/nvidia/skyhook/agentless
       env:
         - name: SLEEP_LEN
-          value: "30"
+          value: "5"