# Object graph

Edges for deriving query conditions and `condition_provenance`. Prefer these
over guessing names.

## Cluster → APPBox

| Edge | How |
|------|-----|
| `cluster_cr.spec.networkName` → APPBox name | Parse `networkName`: if `ns/name`, use that NamespacedName; else name=`networkName`, namespace=`cluster_cr` namespace (same as Cluster). Intent: Plane=CP, GK=APPBox, name/ns from this edge. |
| Cluster Pending on network | Controller Guardian waits legacy Network / APPBox readiness before Creating — if APPBox not `Active`, block is dependency domain. |

## APPBox → VPC

| Edge | How |
|------|-----|
| `appbox.spec.vpcRef` → VPC | `name`/`namespace` from `vpcRef`. Gate: VPC `status.phase` must be `Active` before APPBox leaves Pending (`reason` may be `VPCNotReady`). |
| Label `cloud.pingcap.com/appboxName` | May appear on related objects pointing at APPBox name. |

## PLS / Peering → VPC

| Edge | How |
|------|-----|
| PrivateLinkService Guardian | Requires related VPC `Active` before PLS advances from Pending → ReadyForCreate/Creating. |
| VPCPeering Guardian | Requires related VPC `Active` (and Internet when checked) before peering progresses. |

## Cluster → dataplane workloads

| Edge | How |
|------|-----|
| `cluster_id` / Cluster name+ns → DP | Use toolkit DP routing with `cluster_id`. TiDBCluster / Pods live on the APPBox dataplane for that cluster. |
| Scale | `scale_status_cm` via same `cluster_id` as `cluster_cr`. |

## Provider

| Edge | How |
|------|-----|
| Cluster | `spec.kubernetes.provider` → map to EKS/GKE/AKS Procedure branch |
| APPBox / VPC / PLS | `spec.provider` ∈ `eks`\|`gke`\|`aks` |

Mark Procedure steps `when provider=` only when evidence or tasks differ by cloud.