SuppressARP per VNI

[adamtrizuljak-sap]

Summary

The NVE-level suppressARP is a device-wide default for all VNIs. There was no way to override ARP suppression individually per VNI — either to explicitly enable it for a specific VNI while leaving others to inherit the default, or to disable it for a VNI while the global default has it enabled.

This PR adds an optional suppressARP field to EVPNInstanceSpec. When set, it overrides the NVE-level setting for that VNI's gNMI path. When unset (nil), the NVE-level default remains in effect.

API change (api/core/v1alpha1/evpninstance_types.go):

spec:
  suppressARP: true   # or false; omit to inherit NVE-level default

Provider mapping (internal/provider/cisco/nxos/):

The NX-OS DME API represents this field as a string on Nw-list, not a boolean. The provider maps:

spec.suppressARP	gNMI value
nil (unset)	"off" — inherit NVE-level setting
true	"enabled"
false	"disabled"

VNI.SuppressARP is therefore a plain string field, avoiding any bool↔string unmarshal mismatch when reading device state back for idempotency checks.

Changes

• api/core/v1alpha1/evpninstance_types.go — adds SuppressARP *bool to EVPNInstanceSpec
• api/core/v1alpha1/zz_generated.deepcopy.go — regenerated deep-copy
• config/crd/bases/, charts/.../crd/ — regenerated CRD manifests
• docs/api-reference/index.md — updated API reference table
• internal/provider/cisco/nxos/nve.go — adds VNI.SuppressARP string and string constants
• internal/provider/cisco/nxos/provider.go — maps *bool → string constant in EnsureEVPNInstance
• internal/provider/cisco/nxos/testdata/ — updates marshal testdata to include suppressARP in all VNI payloads
  - test/gnmi/testdata/cisco-nxos-gnmi/evpninstance.txtar — updates expected gNMI state to include "suppressARP": "off"

Tests

Updated testdata/vni.json to include "suppressARP": "DME_UNSET_PROPERTY_MARKER" (reflecting the new zero-value serialization of Option[bool])
Added golden files and fixtures for explicit true and false cases (vni_suppress_arp_true, vni_suppress_arp_false)

Simulated device

Tested against a simulated Cisco N9K-C9300v in Clabernets. Results of reading the path using gnmic -a 127.0.0.1 --port 9339 -u *** -p *** --skip-verify get -e json --values-only --path 'System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni=100010]/suppressARP'

spec.suppressARP	gNMI value
unset	["off"]
true	["enabled"]
false	["disabled"]

YANG

Reference https://github.com/YangModels/yang/blob/main/vendor/cisco/nx/10.6-3/Cisco-NX-OS-device.yang

Path: System/eps-items/epId-items/Ep-list[epId=1]/nws-items/vni-items/Nw-list[vni={vni}]/suppressARP

Allowed values of suppressARP:

typedef nvo_SuppressARPT {
    type enumeration {
        enum off {
            value 0;
            description "Arp suppression not configured";
        }
        enum enabled {
            value 1;
            description "Arp suppression enabled";
        }
        enum disabled {
            value 2;
            description "Arp suppression disabled";
        }
    }
    default "off";
}

[github-actions]

Merging this branch will decrease overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1	2.51% (-0.00%)	👎
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos	9.45% (-0.01%)	👎

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1/evpninstance_types.go	12.50% (ø)	8	1	7
github.com/ironcore-dev/network-operator/api/core/v1alpha1/zz_generated.deepcopy.go	0.00% (ø)	2697 (+4)	0	2697 (+4)
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/nve.go	72.73% (ø)	11	8	3
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/option.go	46.67% (ø)	15	7	8
github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/provider.go	0.35% (-0.00%)	2289 (+3)	8	2281 (+3)	👎

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/ironcore-dev/network-operator/internal/provider/cisco/nxos/nve_test.go

[felix-kaestner]

Suggested change

	const (
	suppressARPOff = "off"
	suppressARPEnabled = "enabled"
	suppressARPDisabled = "disabled"
	)
	type VNI struct {
	AssociateVrfFlag bool `json:"associateVrfFlag"`
	McastGroup Option[string] `json:"mcastGroup"`
	Vni int32 `json:"vni"`
	SuppressARP string `json:"suppressARP"`
	type SuppressARP string
	const (
	SuppressARPOff SuppressARP = "off"
	SuppressARPEnabled SuppressARP = "enabled"
	SuppressARPDisabled SuppressARP = "disabled"
	)
	type VNI struct {
	AssociateVrfFlag bool `json:"associateVrfFlag"`
	McastGroup Option[string] `json:"mcastGroup"`
	Vni int32 `json:"vni"`
	SuppressARP SuppressARP `json:"suppressARP"`

could we make this a real string enumeration?

[felix-kaestner]

nit: I don't think we need a variant for each of the different values for each fiel. The internal/provider/cisco/nxos/testdata/vni.json would already be sufficient in my view to showcase that we set this payload. Exact string values are easily checkable from the code itself.