Add per-VNI multisite ingress replication (Cisco NX-OS)

[adamtrizuljak-sap]

Adds support for per-VNI multisite ingress replication on Border Gateway (BGW) nodes. Because this is a Cisco NX-OS–specific feature with no OpenConfig equivalent, it is exposed through a new provider-specific configuration resource, EVPNInstanceConfig, rather than on the vendor-neutral core API.

When enabled, BUM traffic for a VNI is replicated to remote VTEP peers in the multisite domain via ingress replication. Three modes are supported: Disabled (default), Enabled, and EnabledOptimized.

This maps to the NX-OS CLI:

member vni {vni}
multisite ingress-replication

and the YANG leaf multisiteIngRepl at:

System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni={vni}]/multisiteIngRepl

⚠️ Setting multisiteIngRepl: Enabled requires evpn multisite border-gateway to be enabled, which is not yet supported in network-operator. See the Testing section for details. This PR is a pre-requisite for supporting evpn multisite border-gateway.

Changes

API

• New EVPNInstanceConfig resource under api/cisco/nx/v1alpha1 with the MultisiteIngRepl enum field (Disabled/Enabled/EnabledOptimized, default Disabled), registered as an EVPNInstance dependency.

Provider (Cisco NX-OS)

• EnsureEVPNInstance reads multisiteIngRepl from the referenced EVPNInstanceConfig and maps it to the VNI's device enum.
• VNI struct/mapping updates in nve.go for the three modes.

Generated / scaffolding

• New CRD (base + Helm chart), RBAC, deepcopy, API reference docs, PROJECT and
  kustomization entries.

Samples

• New EVPNInstanceConfig sample plus Tiltfile wiring; the EVI sample now references it via providerConfigRef (commented out by default).

Generated artifacts

• Regenerated CRDs (config/crd/bases), Helm chart CRD copy, and API reference
  docs to reflect the new enum field and its Disabled default.

Notes

• The field is optional and defaults to Disabled, so existing EVPNInstance resources are unaffected.

Testing

• Provider payload golden tests cover all three enum values (disable, enable, enableOptimized).
• gNMI integration test (evpninstance.txtar) updated: a default EVPNInstance now emits "multisiteIngRepl": "disable".
• make manifests generate helm fmt lint test and make test-gnmi PROVIDER=cisco-nxos-gnmi all pass.

Simulated device

Tested against a simulated Cisco N9K-C9300v in Clabernets. Results of reading the path using gnmic -a 127.0.0.1 --port 9339 -u *** -p *** --skip-verify get -e json --values-only --path 'System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni=100010]/multisiteIngRepl'

spec.multisiteIngRepl	gNMI value
unset / "Disabled"	["disabled"]
Enabled	[] - causes controller error
EnabledOptimized	["enableOptimized"]

Setting multisiteIngRepl: Enabled produces the following error. This is expected, because evpn multisite border-gateway is not yet supported in network-operator. This PR is a pre-requisite for supporting evpn multisite border-gateway.

ERROR	Failed to reconcile resource	{"controller": "evpninstance", "controllerGroup": "networking.metal.ironcore.dev", "controllerKind": "EVPNInstance", "EVPNInstance": {"name":"vxlan-100010","namespace":"default"}, "namespace": "default", "name": "vxlan-100010", "reconcileID": "d48672c4-2103-4197-a001-f72862a26d9e", "error": "gnmiext: failed to perform set rpc: rpc error: code = Internal desc = descr:internal processing error [error:operation-failed msg:Please enable 'evpn multisite  border-gateway' before enabling 'evpn multisite ingress-replication'][error:operation-failed msg:Please enable 'evpn multisite  border-gateway' before enabling 'evpn multisite ingress-replication' Commit Failed]"}

YANG

Reference https://github.com/YangModels/yang/blob/main/vendor/cisco/nx/10.6-3/Cisco-NX-OS-device.yang

Allowed values of multisiteIngRepl:

typedef nvo_MultisiteIngReplStateT {
    type enumeration {
        enum disable {
            value 1;
            description "Disable 'multisite ingress-replication'";
        }
        enum enable {
            value 2;
            description "Enable 'multisite ingress-replication'";
        }
        enum enableOptimized {
            value 3;
            description "Enable 'Optimized multisite ingress-replication'";
        }
    }
    default "disable";
}

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/ironcore-dev/network-operator/api/cisco/nx/v1alpha1	0.00% (ø)
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos	10.01% (+0.00%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/ironcore-dev/network-operator/api/cisco/nx/v1alpha1/evpninstanceconfig_types.go	0.00% (ø)	4 (+4)	0	4 (+4)
github.com/ironcore-dev/network-operator/api/cisco/nx/v1alpha1/zz_generated.deepcopy.go	0.00% (ø)	598 (+34)	0	598 (+34)
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/nve.go	72.73% (ø)	11	8	3
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/provider.go	0.87% (+0.00%)	3341 (-1)	29	3312 (-1)	👍

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/nve_test.go

[felix-kaestner]

The Kubernetes API conventions suggest to "not use abbreviations in the API". ref/ https://github.com/kubernetes/community/blob/main/contributors/devel/sig-architecture/api-conventions.md#:~:text=Do%20not%20use%20abbreviations%20in%20the%20API

So I'rather spell it out like

Suggested change

	MultisiteIngRepl MultisiteIngReplMode `json:"multisiteIngRepl,omitempty"`
	MultisiteIngressReplication MultisiteIngReplMode `json:"multisiteIngressReplication,omitempty"`

[adamtrizuljak-sap]

I originally used the name as-is from the YANG mode, but the full spelling is better to understand indeed. I'm leaving it as-is in internal/provider/cisco/nxos/nve.go to match the YANG model.