Green plan, red deploy: the subnet that is not there yet

terraform plan answers one question: does this configuration match what Terraform already manages? It does not answer the one that breaks the deploy: does the network this cluster needs exist yet, with a way out to the Internet, in the tenancy this credential can reach? Control Cloud runs that second question before the first one, against the live inventory of the account, and shows the answer as…