---
name: diag-vpc
description: |
  Read-only diagnosis for Dedicated VPC CR lifecycle (Pending/Creating/Failed/
  not Active). Use when VPC name is known or handed off from APPBox/PLS/
  Peering Gates.
---

# Action Type

`read-only`

# Path note

Shared docs resolve from skill root (`dedicated-cloud-diag/`):
`references/method-*`, `references/patterns/*`, `references/object-graph.md`.

# Data methods

- `references/method-k8s-resource/METHOD.md`

# Required patterns

`cp-cr-lifecycle`, `provider-branch`, `healthy-exit`, `fetch-retry-bypass`,
`skill-boundary-assist`, `diag-trace`. Edges: `references/object-graph.md`.

# Inputs

| Input | Required |
|-------|----------|
| VPC `name` (+ ns) | hard |
| `provider` | optional (read from CR) |

# Top-down Procedure

1. Intent (hard): Plane=`CONTROL_PLANE`, GK=`VPC`, name/ns.  
   Focus: `status.phase`, `spec.provider`. Establish provider.
2. Follow `cp-cr-lifecycle` (phase → reason/conditions → soft events).
3. Provider create stages (`when provider=`):
   - **eks**: Guardian → VPC → SecondaryCidr → SecurityGroup → Subnet →
     SecondaryCidrSubnet → Trigger  
     (`regional-server/pkg/controllers/vpc/taskbuilder.go`).
   - **gke**: Guardian → VPC → Subnet → Firewall.
   - **aks**: Guardian → ResourceGroup → VNet → Subnet.
4. If cloud API needed for subnet/quota → user-assist; if code reachable →
   `task/{eks,gke,aks}` under vpc controller.

# Health checklist (hard)

1. `status.phase=Active`.
2. No Failed phase without explained residual.

# Handoff

Downstream consumers (APPBox/PLS/Peering) resume after VPC Active. Mutation →
ops.

# Output

Obey `references/patterns/diag-trace.md`.