# probes -- D-137 tier 3 behavioural probe declarations (consumed by scripts/creds-probe.sh).
#
# BOUNDARY: operator-ruled 2026-07-26, FULL scope including OpenStack service credentials.
# Per-tenant credentials are excluded BY CONSTRUCTION and creds-probe.sh refuses them even
# if declared here -- probing one means authenticating as a tenant, and D-069 plus ruling 3
# already keep tenant surface out of this control.
#
# EVERY PROBE AUTHENTICATES (except `https-head`) and therefore writes an audit/login record
# on its target. That is the cost of knowing a credential still works, and it is why this
# runs at stage close and DC-standup close rather than in a deploy gate.
#
# FORMAT. Whitespace-separated: <matrix-id> <kind> <target>
# ssh open an ssh connection with the key and run `true`. Narrowest real
# authentication available: no payload, no API surface.
# https-head unauthenticated reachability of the endpoint the credential is FOR.
# Proves the service answers WITHOUT spending the credential -- use where
# an authenticated probe would cost more than it tells us.
# declared-only deliberately not probed; validity rests on V1 provenance and V2 declared
# state. The reason goes in the target field so the decision is visible.
#
# A probe for an id whose mint stage is `pending` in stages-reached is SKIPPED, never
# failed. Most OpenStack service credentials are stage5/stage6 and will skip until Stage 5
# runs -- they are declared NOW so the coverage exists the moment the stage lands, rather
# than being remembered later.
# --- SSH keys: present today, narrowest authentication ---------------------------------
office1-svc-key ssh voffice1
dc0-svc-key declared-only dc0-rack-reachable-only-via-jumpbox-with-per-env-key-D-126
dc1-svc-key declared-only dc1-rack-reachable-only-via-jumpbox-with-per-env-key-D-126
# --- infrastructure APIs ----------------------------------------------------------------
# The edge REST APIs answer on the DC provider-public gateway addresses; an unauthenticated
# HEAD proves the service is up without spending the key. An authenticated GET is available
# (the firmware-status call used at edge bootstrap) but costs an audit record per run for
# information V1/V2 largely already give.
office1-edge-api declared-only edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it
dc0-edge-api declared-only ABSENT-per-SEC-021;nothing-to-probe-until-consolidated
dc1-edge-api declared-only edge-API-probe-costs-an-audit-record-per-run;V1+V2-cover-it
netbox-sandbox-token https-head http://10.10.1.10:8000/
netbox-upstream-token declared-only SEC-006-declares-this-BURNED;probing-a-burned-token-is-wrong
# --- MAAS -------------------------------------------------------------------------------
# The `admin` identity drives 19 automation call sites. A failed auth probe against it is
# exactly the lockout risk the no-retry rule exists for, so it is reachability-only.
maas-region-admin https-head http://10.10.0.20:5240/MAAS/
dc0-maas-apikey declared-only probing-would-authenticate-as-the-juju-cloud-identity;stage5-verifies-in-use
dc1-maas-apikey declared-only probing-would-authenticate-as-the-juju-cloud-identity;stage5-verifies-in-use
# --- OpenStack service credentials (stage5+; declared now, will SKIP until the stage runs)
keystone-admin declared-only stage5-not-reached;probe-shape-to-be-set-when-the-cloud-exists
magnum-domain-admin declared-only stage5-not-reached;probe-shape-to-be-set-when-the-cloud-exists
