Implement OpenConfig provider for core resource types

[felix-kaestner]

Add provider implementations for ACL, AAA, BGP, BGPPeer, ISIS, LLDP,
NTP, PrefixSet, RoutingPolicy, Syslog, and VRF resources targeting
Nokia SRLinux via gNMI.

Use SetBuilder for multi-element operations and direct client calls
for single-element operations. Guard unsupported fields with
UnsupportedFieldError.

[rgildein]

Test Report — OpenConfig Provider (Nokia SRL 26.7.1)

Local Dev Checks

────────────────────────────────────────────────────────
Vet:         ✓ passed
Lint:        ✓ passed  (0 issues)
Unit tests:  ✓ 21 packages passed, 0 failed
gNMI tests:  ✓ 17 passed, 0 failed
             banner, bgp, dns, interface (×8), lldp,
             ntp, prefixset, routingpolicy, syslog, vrf
────────────────────────────────────────────────────────

---

Real Device — Nokia SRL 26.7.1 @ 172.20.20.2:57400

CR Name	Kind	Ready	gNMI Path	Result
lldp	LLDP	True	openconfig-lldp:lldp/config	✓ enabled: true
pfx-loopbacks	PrefixSet	True	...prefix-set[name=LOOPBACKS]	✓ 10.0.0.0/24, 10.1.0.0/16
accept-loopbacks	RoutingPolicy	True	...policy-definition[name=accept-loopbacks]	✓ statements 10 + 65535
vrf-blue	VRF	True	...network-instance[name=BLUE]/config	✓ type: L3VRF
vrf-default	VRF	True	...network-instance[name=default]/config	✓ type: DEFAULT_INSTANCE
bgp	BGP	True	...network-instance[name=default]/...bgp/global	✓ AS 65000, IPv4+IPv6
ntp	NTP	True	openconfig-system:system/ntp	✓ 2 servers, prefer + default
syslog	Syslog	True	openconfig-system:system/logging/remote-servers	✓ INFORMATIONAL severity
dns	DNS	False	openconfig-system:system/dns	✗ containerlab constraint (see below)

8/9 passed

---

gnmic outputs

gnmic get openconfig-lldp:lldp/config

{ "enabled": true }

gnmic get ...prefix-set[name=LOOPBACKS]

{
  "config": { "name": "LOOPBACKS" },
  "prefixes": {
    "prefix": [
      { "ip-prefix": "10.0.0.0/24", "masklength-range": "exact",
        "config": { "ip-prefix": "10.0.0.0/24", "masklength-range": "exact" } },
      { "ip-prefix": "10.1.0.0/16", "masklength-range": "exact",
        "config": { "ip-prefix": "10.1.0.0/16", "masklength-range": "exact" } }
    ]
  }
}

gnmic get ...policy-definition[name=accept-loopbacks]

{
  "config": { "name": "accept-loopbacks" },
  "statements": {
    "statement": [
      { "name": "10",
        "conditions": { "match-prefix-set": { "config": { "prefix-set": "LOOPBACKS", "match-set-options": "ANY" } } },
        "actions": { "config": { "policy-result": "ACCEPT_ROUTE" } } },
      { "name": "65535",
        "actions": { "config": { "policy-result": "REJECT_ROUTE" } } }
    ]
  }
}

gnmic get ...network-instance[name=BLUE]/config

{ "name": "BLUE", "type": "openconfig-network-instance-types:L3VRF" }

gnmic get ...network-instance[name=default]/config

{ "name": "default", "type": "openconfig-network-instance-types:DEFAULT_INSTANCE" }

gnmic get ...network-instance[name=default]/protocols/protocol[BGP]/bgp/global

{
  "config": { "as": 65000, "router-id": "10.0.0.1" },
  "afi-safis": {
    "afi-safi": [
      { "afi-safi-name": "openconfig-bgp-types:IPV4_UNICAST",
        "config": { "afi-safi-name": "openconfig-bgp-types:IPV4_UNICAST", "enabled": true } },
      { "afi-safi-name": "openconfig-bgp-types:IPV6_UNICAST",
        "config": { "afi-safi-name": "openconfig-bgp-types:IPV6_UNICAST", "enabled": true } }
    ]
  }
}

gnmic get openconfig-system:system/ntp

{
  "config": { "enabled": true },
  "servers": {
    "server": [
      { "address": "192.0.2.1", "config": { "address": "192.0.2.1", "network-instance": "default", "prefer": true } },
      { "address": "192.0.2.2", "config": { "address": "192.0.2.2", "network-instance": "default" } }
    ]
  }
}

gnmic get openconfig-system:system/logging/remote-servers

{
  "remote-server": [
    {
      "config": { "host": "192.0.2.100", "remote-port": 514 },
      "host": "192.0.2.100",
      "selectors": {
        "selector": [
          { "facility": "openconfig-system-logging:ALL", "severity": "INFORMATIONAL",
            "config": { "facility": "openconfig-system-logging:ALL", "severity": "INFORMATIONAL" } }
        ]
      }
    }
  ]
}

---

Notes

BGP requires a DEFAULT_INSTANCE VRF CR to be applied first — SRLinux enforces that the default network-instance must exist with type set before a BGP protocol entry can be written.

DNS — containerlab pre-configures mgmt and clab-default DNS network-instances at boot. SRLinux enforces a unique network-instance leaf on the OpenConfig system/dns path, causing FailedPrecondition on any write. Passes cleanly on the mock server. Not a provider bug — a containerlab topology constraint that does not apply in production.

Additional fixes in this commit

• NTPSpec.SourceInterfaceName, SyslogSpec.Facilities, LogServer.VrfName made optional in the API (were incorrectly required, blocking Nokia SRLinux usage)
• NTP.servers[].vrfName was silently accepted by the provider — now correctly returns UnsupportedFieldError
• Syslog severity values mapped from API strings (Info) to OpenConfig identities (INFORMATIONAL)

---

Signed-off-by: Claude claude@anthropic.com

[github-actions]

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1	1.72% (-0.00%)	👎
github.com/ironcore-dev/network-operator/internal/provider/openconfig	2.60% (+2.60%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/ironcore-dev/network-operator/api/core/v1alpha1/prefix_types.go	17.14% (-0.50%)	35 (+1)	6	29 (+1)	👎
github.com/ironcore-dev/network-operator/api/core/v1alpha1/prefixset_types.go	9.09% (-0.91%)	11 (+1)	1	10 (+1)	👎
github.com/ironcore-dev/network-operator/internal/provider/openconfig/aaa.go	0.00% (ø)	50 (+50)	0	50 (+50)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/acl.go	0.00% (ø)	29 (+29)	0	29 (+29)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/bgp.go	17.57% (+17.57%)	74 (+74)	13 (+13)	61 (+61)	🎉
github.com/ironcore-dev/network-operator/internal/provider/openconfig/bgppeer.go	0.00% (ø)	67 (+67)	0	67 (+67)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/interface.go	0.00% (ø)	112 (+4)	0	112 (+4)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/isis.go	0.00% (ø)	32 (+32)	0	32 (+32)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/lldp.go	0.00% (ø)	16 (+16)	0	16 (+16)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/prefixset.go	0.00% (ø)	12 (+12)	0	12 (+12)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/routingpolicy.go	0.00% (ø)	24 (+24)	0	24 (+24)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/syslog.go	0.00% (ø)	25 (+25)	0	25 (+25)
github.com/ironcore-dev/network-operator/internal/provider/openconfig/vrf.go	0.00% (ø)	15 (+15)	0	15 (+15)

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/ironcore-dev/network-operator/internal/provider/openconfig/bgp_test.go