# probes -- D-137 tier 3 behavioural probe declarations (consumed by scripts/creds-probe.sh).
#
# BOUNDARY: operator-ruled 2026-07-26, FULL scope including OpenStack service credentials.
# Per-tenant credentials are excluded BY CONSTRUCTION and creds-probe.sh refuses them even
# if declared here -- probing one means authenticating as a tenant, and D-069 plus ruling 3
# already keep tenant surface out of this control.
#
# EVERY PROBE AUTHENTICATES (except `https-head`) and therefore writes an audit/login record
# on its target. That is the cost of knowing a credential still works, and it is why this
# runs at stage close and DC-standup close rather than in a deploy gate.
#
# FORMAT. Whitespace-separated: <matrix-id> <kind> <target>
#   ssh            open an ssh connection with the key and run `true`. Narrowest real
#                  authentication available: no payload, no API surface.
#   https-head     unauthenticated reachability of the endpoint the credential is FOR.
#                  Proves the service answers WITHOUT spending the credential -- use where
#                  an authenticated probe would cost more than it tells us.
#   declared-only  deliberately not probed; validity rests on V1 provenance and V2 declared
#                  state. The reason goes in the target field so the decision is visible.
#
# A probe for an id whose mint stage is `pending` in stages-reached is SKIPPED, never
# failed. Most OpenStack service credentials are stage5/stage6 and will skip until Stage 5
# runs -- they are declared NOW so the coverage exists the moment the stage lands, rather
# than being remembered later.

# --- SSH keys: present today, narrowest authentication ---------------------------------
office1-svc-key        ssh            voffice1
dc0-svc-key            declared-only  dc0-rack-reachable-only-via-jumpbox-with-per-env-key-D-126
dc1-svc-key            declared-only  dc1-rack-reachable-only-via-jumpbox-with-per-env-key-D-126

# --- infrastructure APIs ----------------------------------------------------------------
# The edge REST APIs answer on the DC provider-public gateway addresses; an unauthenticated
# HEAD proves the service is up without spending the key. An authenticated GET is available
# (the firmware-status call used at edge bootstrap) but costs an audit record per run for
# information V1/V2 largely already give.
office1-edge-api       declared-only  edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it
dc0-edge-api           declared-only  ABSENT-per-SEC-021;nothing-to-probe-until-consolidated
dc1-edge-api           declared-only  edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it
netbox-sandbox-token   https-head     http://10.10.1.10:8000/
netbox-upstream-token  declared-only  SEC-006-declares-this-BURNED;probing-a-burned-token-is-wrong

# --- MAAS -------------------------------------------------------------------------------
# The `admin` identity drives 19 automation call sites. A failed auth probe against it is
# exactly the lockout risk the no-retry rule exists for, so it is reachability-only.
maas-region-admin      https-head     http://10.10.0.20:5240/MAAS/
dc0-maas-apikey        declared-only  probing-would-authenticate-as-the-juju-cloud-identity;stage5-verifies-in-use
dc1-maas-apikey        declared-only  probing-would-authenticate-as-the-juju-cloud-identity;stage5-verifies-in-use

# --- OpenStack service credentials (stage5+; declared now, will SKIP until the stage runs)
keystone-admin         declared-only  stage5-not-reached;probe-shape-to-be-set-when-the-cloud-exists
magnum-domain-admin    declared-only  stage5-not-reached;probe-shape-to-be-set-when-the-cloud-exists
