Support per-VNI multisite ingress replication in EVPNInstance

[adamtrizuljak-sap]

Adds a multisiteIngRepl field to the EVPNInstance API and realizes it on the Cisco NX-OS provider, enabling per-VNI multisite ingress replication on Border Gateway (BGW) nodes. When enabled, BUM (Broadcast, Unknown-unicast, Multicast) traffic for a VNI is replicated via unicast to remote VTEP peers in the multisite domain instead of relying on multicast.

This maps to the NX-OS CLI:

member vni {vni}
multisite ingress-replication

and the YANG leaf multisiteIngRepl at:

System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni={vni}]/multisiteIngRepl

⚠️ Setting multisiteIngRepl: Enabled requires even multisite border-gateway to be enabled, which is not yet supported in network-operator. See the Testing section for details. This PR is a pre-requisite for supporting even multisite border-gateway.

Changes

API (EVPNInstance)

• New optional field spec.multisiteIngRepl on EVPNInstanceSpec, typed as a
  MultisiteIngReplMode enum with values Disabled (default), Enabled, and
  EnabledOptimized.
• The underlying YANG leaf is a three-valued enum (nvo_MultisiteIngReplStateT:
  disable / enable / enableOptimized), not a boolean — the API surfaces
  these using the repo's PascalCase enum convention.

Provider (Cisco NX-OS)

• New MultisiteIngRepl provider enum (disable / enable / enableOptimized)
  and a corresponding field on the VNI struct.
• EnsureEVPNInstance maps the API enum to the provider value; the default
  branch resolves Disabled to the platform default disable, so an
  unconfigured VNI produces no false diff on reconcile.

Generated artifacts

• Regenerated CRDs (config/crd/bases), Helm chart CRD copy, and API reference
  docs to reflect the new enum field and its Disabled default.

Notes

• The field is optional and defaults to Disabled, so existing EVPNInstance
  resources are unaffected.

Testing

• Provider payload golden tests cover all three enum values (disable,
  enable, enableOptimized).
• gNMI integration test (evpninstance.txtar) updated: a default EVPNInstance
  now emits "multisiteIngRepl": "disable".
• make manifests generate helm fmt lint test and
  make test-gnmi PROVIDER=cisco-nxos-gnmi all pass.

Simulated device

Tested against a simulated Cisco N9K-C9300v in Clabernets. Results of reading the path using gnmic -a 127.0.0.1 --port 9339 -u *** -p *** --skip-verify get -e json --values-only --path 'System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni=100010]/multisiteIngRepl'

spec.multisiteIngRepl	gNMI value
unset / "Disabled"	["disabled"]
Enabled	[] - causes controller error
EnabledOptimized	["enableOptimized"]

Setting multisiteIngRepl: Enabled produces the following error. This is expected, because evpn multisite border-gateway is not yet supported in network-operator. This PR is a pre-requisite for supporting even multisite border-gateway.

2026-09-17T08:28:57.407Z	ERROR	Reconciler error	{"controller": "evpninstance", "controllerGroup": "networking.metal.ironcore.dev", "controllerKind": "EVPNInstance", "EVPNInstance": {"name":"vxlan-100010","namespace":"default"}, "namespace": "default", "name": "vxlan-100010", "reconcileID": "3194d555-4cd4-40f7-ae7f-610e8cbd6577", "error": "gnmiext: failed to perform set rpc: rpc error: code = Internal desc = descr:internal processing error [error:operation-failed msg:Please enable 'evpn multisite  border-gateway' before enabling 'evpn multisite ingress-replication'][error:operation-failed msg:Please enable 'evpn multisite  border-gateway' before enabling 'evpn multisite ingress-replication' Commit Failed]"}

YANG

Reference https://github.com/YangModels/yang/blob/main/vendor/cisco/nx/10.6-3/Cisco-NX-OS-device.yang

Allowed values of multisiteIngRepl:

typedef nvo_MultisiteIngReplStateT {
    type enumeration {
        enum disable {
            value 1;
            description "Disable 'multisite ingress-replication'";
        }
        enum enable {
            value 2;
            description "Enable 'multisite ingress-replication'";
        }
        enum enableOptimized {
            value 3;
            description "Enable 'Optimized multisite ingress-replication'";
        }
    }
    default "disable";
}