Cisco Cloud Control Setup

Prerequisites

Tool or access	Purpose	Verify
Bash and Python 3	Run bundled setup and validation helpers	bash --version && python3 --version
Required product/platform access	Inspect or configure the selected target	Complete the documented preflight
Credential files for live modes	Keep secrets out of chat	Verify paths only

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• Prepare Cisco Cloud Control, AgenticOps, AI Canvas, Cloud Control Studio, Cloud Control Workflows, or governed Cisco/Splunk agent execution workflows.
• Preview and review the cisco cloud control setup workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/cisco-cloud-control-setup/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/cisco-cloud-control-setup/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

Issue	Cause	Resolution
Preflight fails	A required tool or access path is missing	Resolve it before rendering or applying
Rendered assets are incomplete	Required non-secret inputs are absent	Complete intake and render again
Apply is blocked	Review, credentials, or explicit acceptance is missing	Use the documented handoff
Validation is incomplete	Live evidence is unavailable	Record the gap and keep completion open

This skill is a render-first parent workflow for Cisco Cloud Control adoption. It does not call undocumented Cisco Cloud Control APIs. It renders the operator plan, official feature/product coverage, Cisco Workflows API readiness, Cloud Control Studio briefs, AI Canvas board templates, and executable child-skill handoffs where supported.

Supported Paths

1. Cisco Data Fabric architecture: delegate the complete lifecycle-aware product, feature, federation, storage/catalog, context, AI, governance, and source-evidence packet to cisco-data-fabric-setup. That dedicated parent routes constituent Splunk skills only when it has reviewed non-secret inputs and never claims a standalone Cisco Data Fabric package or API.
2. MCP connectors: delegate Splunk MCP Server and ThousandEyes MCP client setup plans. Splunk MCP client rendering is emitted only when mcp.splunk_mcp_url is set, because the child skill otherwise needs Splunk credentials to derive the endpoint. ThousandEyes MCP can render independently.
3. Agent observability: delegate Splunk AI Agent Monitoring setup.
4. Observability content: delegate dashboards and detectors to existing Observability skills.
5. Official Cloud Control surfaces: render coverage for onboarding, tenant groups, product integrations, AI context, users/roles, SSO, audit logs, AI Assistant, AI Canvas, Actions, Notifications, Favorites, Inventory, Licensing, RBAC, Topology, Workflows, release notes, and Multicloud Fabric.
6. Cisco Workflows API readiness: render the documented API/OAS, target, account-key, auth, and rate-limit checklist without making API calls.
7. Domain readiness: render child-skill handoffs for Intersight, Nexus, Nexus Hyperfabric, ThousandEyes, Meraki, Catalyst Center, Catalyst SD-WAN, Security Cloud Control, Secure Access, Duo, ISE, Secure Firewall, Splunk Cloud, Collaboration Control Hub, and Cisco IQ.
8. Cloud Control Studio and AI Canvas: render UI/CA handoff artifacts only.

Safe First Command

bash skills/cisco-cloud-control-setup/scripts/setup.sh --help

Primary Workflow

Render from the example intake:

bash skills/cisco-cloud-control-setup/scripts/setup.sh \
  --render \
  --validate \
  --spec skills/cisco-cloud-control-setup/template.example \
  --output-dir cisco-cloud-control-rendered

Run the doctor report:

bash skills/cisco-cloud-control-setup/scripts/setup.sh \
  --doctor \
  --spec skills/cisco-cloud-control-setup/template.example \
  --output-dir cisco-cloud-control-rendered

Review delegated execution without changing anything:

bash skills/cisco-cloud-control-setup/scripts/setup.sh \
  --execute data-fabric,mcp,agent-observability \
  --dry-run \
  --json \
  --spec skills/cisco-cloud-control-setup/template.example

Execute only reviewed delegated sections:

bash skills/cisco-cloud-control-setup/scripts/setup.sh \
  --execute data-fabric,mcp \
  --accept-execute \
  --spec skills/cisco-cloud-control-setup/template.example \
  --output-dir cisco-cloud-control-rendered

CLI Contract

setup.sh supports --render, --validate, --doctor, --execute SECTION[,SECTION], --accept-execute, --dry-run, --json, --spec PATH, and --output-dir DIR.

Delegated executable sections:

• data-fabric
• mcp
• agent-observability
• observability-content
• domain-readiness (handoff-only; an execute request exits nonzero)
• cloud-control-studio (handoff-only; an execute request exits nonzero)
• ai-canvas (handoff-only; an execute request exits nonzero)

The data-fabric section runs only the dedicated parent's render and static validation workflow. Any constituent apply remains behind the owning child skill's explicit approval gates.

domain-readiness, cloud-control-studio, and ai-canvas never mutate Cisco Cloud Control. They render operator handoff artifacts, and an explicit execute request exits nonzero so a handoff cannot be mistaken for an applied change.

The Cisco Workflows API is treated as a readiness surface: this skill renders the public API/OAS, target, account-key, and rate-limit checklist, but it does not issue Workflows API calls or claim a direct Cisco Cloud Control platform mutation API.

Secret Handling

This parent skill rejects direct secret flags such as --token, --password, --api-key, --client-secret, and --private-key. Specs must not contain raw secret-looking keys such as token, password, api_key, client_secret, or private_key. Put credentials in the delegated child skill's supported secret files and keep those values out of chat and argv.

Validation

bash skills/cisco-cloud-control-setup/scripts/validate.sh \
  --output-dir cisco-cloud-control-rendered

For code validation:

python3 -m py_compile \
  skills/cisco-cloud-control-setup/scripts/render_assets.py

See reference.md for the source ledger, coverage boundaries, and delegated skill map.