---
name: diag-privatelinkservice
description: |
  Read-only diagnosis for Dedicated PrivateLinkService CR lifecycle
  (Pending/Creating/Failed/not Active). Use when PLS name is known; checks
  VPC Active Gate before provider endpoint tasks.
---

# Action Type

`read-only`

# Path note

Shared docs resolve from skill root (`dedicated-cloud-diag/`):
`references/method-*`, `references/patterns/*`, `references/object-graph.md`.

# Data methods

- `references/method-k8s-resource/METHOD.md`

# Required patterns

`cp-cr-lifecycle`, `provider-branch`, `healthy-exit`, `fetch-retry-bypass`,
`skill-boundary-assist`, `diag-trace`. Edges: `references/object-graph.md`.

# Inputs

| Input | Required |
|-------|----------|
| PrivateLinkService `name` (+ ns) | hard |

# Top-down Procedure

1. Intent (hard): Plane=`CONTROL_PLANE`, GK=`PrivateLinkService`, name/ns.  
   Focus: `status.phase`, `spec.provider`.
2. `cp-cr-lifecycle` then **VPC Gate** (hard): Guardian requires VPC `Active`
   before Pending advances. If VPC not Active → handoff `diag-vpc`.
3. Provider create stages (`when provider=`):
   - **eks**: Guardian → LoadBalancer → EndpointService → DNSRecord → Endpoint.
   - **gke**: Guardian → LoadBalancer → NATSubnet → ServiceAttachment.
   - **aks**: Guardian → LoadBalancer → PrivateLinkService → Endpoint → DNSRecord.
4. Soft: related Service/LB events on DP/CP as needed. Cloud CLI → user-assist.
   Code: `regional-server/pkg/controllers/privatelinkservice/`.

# Health checklist (hard)

1. `status.phase=Active`.
2. Dependency VPC Active.

# Output

Obey `references/patterns/diag-trace.md`.