devnet-6: cut xatu sentries over to the per-devnet gloas pipeline (#30)

Promote the fleet cutover (live on all 40 hosts since 2026-07-03) into
group_vars:

- server address derived from ethereum_network_name
  (<network>-ingest.xatu.ethpandaops.io:443, mca-xatu-devnets in platform)
  so future devnets need no wiring
- full xatu_sentry_config override adding the Gloas SSE topics the
  sentry's default subscription set excludes (bids, PTC votes, proposer
  preferences, execution payload events) — collapses back to
  xatu_sentry_config_beacon_subscriptions once
  ethpandaops/ansible-collection-general#556 merges
- data_column_sidecar subscription (previously applied via extra-vars
  only)
- xatu image pinned to 0.0.43-gloas (xatu:latest cannot decode Gloas
  blocks; unpin when ethpandaops/xatu#795 reaches master)
- ingest credentials in devnet sops

Author: samcm

ansible/inventories/devnet-6/group_vars/all/all.sops.yaml

@@ -21,9 +21,9 @@ secret_mev_relay_secret_key: ENC[AES256_GCM,data:jnk2Bp3kMu4XBAfe3cJ8iJ061Lq2UDo
 secret_mev_flood_private_key: ENC[AES256_GCM,data:LYJDMo2JUMH5TnRJ/DiTpeF+u5oKTRJzpLwNte1QA84e8JNtKlehUDH5XX+rzoyOI3edHm4gwZ5oIeziY1STJA==,iv:1qNfUVqJ9eebRmA4Ly59KFR9WmaQ8eelSvNLJAWCJ10=,tag:2YTI3l+1z9sO2Gr7Csd4aw==,type:str]
 secret_mev_flood_user_key: ENC[AES256_GCM,data:KKnBt1BEnBR/Cl9B7FljzV3kJOW9Gmp7DJ46xc1EkUZmWn1f8F4QLhgsyK34FKBKSCmDMCQoctwirAKTG/Vlsw==,iv:efkOBcrGeGJwT91SR+2wFI/fpnWASQeqjH3MJSIQBAA=,tag:1f+bkUNLh8kMsxO5qNQo+Q==,type:str]
 secret_xatu_sentry:
-    server_address: ENC[AES256_GCM,data:XzLdQ+6JRMe77fQJUJC8pGsVCKB6L4JuQfyTBb84hW9UXrHJ3umII0yQeg==,iv:ITMxKGxTVHDVPYhphwfRtt++DSMrwP5jOPD+/3q8Oig=,tag:cUjDFe+1uFv+tPAPYVnSZQ==,type:str]
-    user: ENC[AES256_GCM,data:H/ee8GvkSYtyTzY=,iv:Jjhtt5V0LXcNdS5PjBmYMDLJndPZUd4HPn2pSw4BM34=,tag:vo08KX4A2ic4IqpcBRHRZg==,type:str]
-    password: ENC[AES256_GCM,data:6bR/AjXadfHRZyBGlFcgiBnUQMc2xTjFcpgFZg6vxw==,iv:r6FsNBMe6nPCoQ7NuUzSljgKgdvp540kkOD+ApPSmdM=,tag:Df0RYt75FlB2NFakqViJ2g==,type:str]
+    server_address: ENC[AES256_GCM,data:m4TazcSCuGW/Jlh0Jg1G/0FyPpc6M4kHBt1SNXCSkkKMOPLenEBqHHl4pPlBuvfv+75E,iv:eCJatIrq7Ff8SJlMCSMxNBgV+iHFOlXcfer6/drqXCo=,tag:67qe1jg2i90xFq71s0rA/A==,type:str]
+    user: ENC[AES256_GCM,data:uwGLpiNh7Q==,iv:1beJ8Z7mcZzY55qRoYeoOHLluwAOVb4woG7vqF22x/w=,tag:aP85BC6u1T5dDETRRj569g==,type:str]
+    password: ENC[AES256_GCM,data:XCMEbRpVmRFaI10es9mBrR8EiFWJenK3zjM4QGh70iLo8HaU,iv:++cb9FjM21r9gylwvA5ax1E0FAQzZisAsJhGnPjQHdM=,tag:V5iTEAQ4JiUiiYeQqbMtDQ==,type:str]
     event_ingester_auth: ENC[AES256_GCM,data:xD1uqYrRdB+TU7Fqbs+fENWiInVD1HOdVjxppQHhh7jRl+dU9HlJpD60nswd611EyHbWheTnlY1lRMO6Damz0ut9,iv:bKNxaPz+Xj5bIidQlaJrQXaDtT/I0lfBBY3zFfvMCAg=,tag:G1qOLehH6Wm9aI6a2ShqCQ==,type:str]
     coordinator_secret: ENC[AES256_GCM,data:f4y7Ck0Z2zpOo8bHuS/w7Bhk6/6+DIvFXctMhjaMBYWLiwEY,iv:gQG7HBaDQPz0huJH2fq4y8HOGN3JwceJET/spgL5GXk=,tag:2guBo0MRKOMKOhpyjYL0VA==,type:str]
 secret_cert_encryption_psk: ENC[AES256_GCM,data:WXK5OSHqbAPXxWRwxDV4vSkWLd+KBMJMZuEPFUKE,iv:w45No4rBDjT+kGooIoHGikjJQjwWQ9dyNBzL/NBo7XE=,tag:9Unr8yDbWpCOINcCW/frSg==,type:str]
@@ -44,8 +44,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2026-06-11T23:33:23Z"
-    mac: ENC[AES256_GCM,data:xf6+EG+caTJT14hsf9X7Nw7OiSvWS+Fl4BcJb6qHHz+hFF8R97NMO8Gwdy8+37turYiQn5SxEDwQkT4/HinbmY9EXfDL3/ITJ3FAYDceUKqVH4lEVK22MrxXn4HvJ5ubJ1AFaXN6pDfQy9f/WQnqHYHvYTyJOrjKCt+oZxooO8E=,iv:j7t+Ere+5jgl4oTbZ453yyfZbmeyOugTY8TBnnqOz6M=,tag:fBoYBGP0e8CXutSQcVlNzA==,type:str]
+    lastmodified: "2026-07-03T02:24:30Z"
+    mac: ENC[AES256_GCM,data:iVIEcb+8NkyVKZNokn+B63qWmQvqWDSaEzj75DLCbU+xUf4PEpMjJbjZOAQeZd3+OGfCE7WB/lg8I363Y5ibqb56i7UHXzZTk7tIbLWvEpZm8z+j6vmTQxuRsqwXJLauEr9bG7bxoC0XxeOxZPYHshUsBlbcFtd/aZbjANi/BBM=,iv:nUUc974hh5EAimQlYFCpwyezYW79GiUfgmcPRkeAH4Y=,tag:7okt3AK7uo/0ZVO3Q//3Hg==,type:str]
     pgp:
         - created_at: "2025-10-27T13:25:35Z"
           enc: |-

ansible/inventories/devnet-6/group_vars/all/all.yaml

@@ -199,11 +199,52 @@ gen_kubernetes_config_dora_api_secret: "{{ secret_dora_api_key }}"
 # role: ethpandaops.general.xatu_sentry
 xatu_sentry_container_image: "{{ default_tooling_images.xatu_sentry }}"
 xatu_sentry_config_name: "{{ ethereum_network_name }}-{{ inventory_hostname }}"
-xatu_sentry_config_server_address: "{{ secret_xatu_sentry.server_address }}"
+# Per-devnet xatu pipeline (mca-xatu-devnets in platform): the ingest host is
+# derived from the network name so new devnets need no wiring here.
+xatu_sentry_config_server_address: "{{ ethereum_network_name }}-ingest.xatu.ethpandaops.io:443"
 xatu_sentry_config_server_auth_user: "{{ secret_xatu_sentry.user }}"
 xatu_sentry_config_server_auth_password: "{{ secret_xatu_sentry.password }}"
 xatu_sentry_config_network_name_override: "{{ ethereum_network_name }}"
 
+# Full config override: adds the Gloas SSE topics, which the sentry's default
+# subscription set deliberately excludes.
+xatu_sentry_config: |
+  logging: "info"
+  metricsAddr: ":9090"
+  name: "{{ xatu_sentry_config_name }}"
+  ntpServer: time.google.com
+  ethereum:
+    beaconNodeAddress: {{ xatu_sentry_config_beacon_uri }}
+    overrideNetworkName: {{ xatu_sentry_config_network_name_override }}
+    beaconSubscriptions:
+      - attestation
+      - single_attestation
+      - block
+      - block_gossip
+      - chain_reorg
+      - finalized_checkpoint
+      - head
+      - voluntary_exit
+      - contribution_and_proof
+      - blob_sidecar
+      - data_column_sidecar
+      - execution_payload
+      - execution_payload_gossip
+      - execution_payload_available
+      - execution_payload_bid
+      - payload_attestation_message
+      - proposer_preferences
+  outputs:
+  - name: grpc
+    type: xatu
+    config:
+      address: {{ xatu_sentry_config_server_address }}
+      tls: {{ xatu_sentry_config_server_tls_enabled }}
+      maxQueueSize: 100000
+      workers: 5
+      headers:
+        authorization: "Basic {{ (xatu_sentry_config_server_auth_user + ":" + xatu_sentry_config_server_auth_password) | b64encode }}"
+
 # role: ethpandaops.general.ethereum_metrics_exporter
 ethereum_metrics_exporter_container_image: "{{ default_tooling_images.ethereum_metrics_exporter }}"
 ethereum_metrics_exporter_container_user: root

ansible/inventories/devnet-6/group_vars/all/images.yaml

@@ -23,7 +23,9 @@ default_tooling_images:
   mev_relay: ethpandaops/mev-boost-relay:main
   buildoor: ethpandaops/buildoor:main-latest
   authenticatoor: ethpandaops/service-authenticatoor:main-latest
-  xatu_sentry: ethpandaops/xatu:latest
+  # Gloas event support ships on the release/gloas builds until
+  # ethpandaops/xatu#795 merges to master (xatu:latest cannot decode Gloas).
+  xatu_sentry: ethpandaops/xatu:0.0.43-gloas
   xatu_cannon: ethpandaops/xatu:latest
   xatu_mimicry: ethpandaops/xatu:latest
   xatu_cl_mimicry: ethpandaops/xatu:latest