Galaxy

Galaxy is an open-source, web-based platform originally developed for data-intensive biomedical research. It enables users to perform complex computational analyses by providing a graphical interface to access compute resources, manage data, run analysis tools, construct workflows, and share results. NDIP runs an ORNL fork.

Deployment

Galaxy runs on Kubernetes: test on mickey (ndip-test.ornl.gov) and production on speedy (ndip.ornl.gov), in namespace ndip. It is deployed with the Galaxy Helm chart by the calvera CI jobs galaxy-test and galaxy-k8s-prod (k8s/galaxy/deploy.sh). For the procedure, see Deploying NDIP.

The Helm release galaxy creates:

Object	Purpose
Deployment galaxy	One pod: container galaxy (gunicorn ×2, Celery, job handlers via gravity) and sidecar gx-it-proxy (interactive tools). Init containers tools-sync (clones galaxy-tools) and it-map
StatefulSet galaxy-rabbitmq	RabbitMQ, see RabbitMQ
PVC galaxy-data (RWX)	/galaxy/data: GALAXY/GALAXY_TEST RSE files, object store cache, job dirs, interactive tools map. Prod: 150Gi Longhorn
Secret galaxy-config	Rendered galaxy.yml, job_conf.yml, OIDC config and other secrets
ConfigMaps	Static files from the chart, plus templated config (tool_conf, resource orchestration rules, welcome page)
Secret galaxy-tls	Certificate for the host, used by all Ingresses and RabbitMQ TLS
Ingress	/ for Galaxy and /nova for the dashboard; interactive tool Ingresses are created by the job runner
ServiceAccount + Role	Lets Galaxy create Kubernetes Jobs and interactive tool objects

The database is the CloudNativePG cluster galaxy-pg (galaxy.secrets.databaseUrl → galaxy-pg-rw). The chart's bundled Bitnami PostgreSQL is disabled.

Configuration

All configuration is in calvera, k8s/galaxy/ (branch k8s-env-split):

File	What
values-galaxy.yml	galaxy.yml settings shared by both environments (admins, OIDC flags, logging, banner, gravity)
values-<env>.yml	Image tag, resources, storage, RabbitMQ, Ingress host, tools branch
values-jobconf-<env>.yml	job_conf.yml: runners, destinations, tool mappings (job routing)
values-resource-orchestration.yml	Machine/tool resources and the dynamic_resource_orchestration rule
values-objectstore-<env>.yml	Rucio object store (RSE, scope, download schemes)
values-toolconf-<env>.yml	tool_conf.xml
values-oidc.yml, values-hpc.yml, values-job-resource-params-<env>.yml	OIDC, HPC routing, job resource parameters
extra-routes-prod.yaml	Prod-only Ingresses: /docs, /nova/tutorial, /nova/sans, /mcp
secrets-<env>.yml	Vault-encrypted: DB/AMQP URLs, OIDC client secrets, Rucio credentials, TLS cert

@NAME@ placeholders are filled from k8s/env/<env>.env at deploy time. Change something in galaxy.yml without redeploying only for emergencies: patch the Secret galaxy-config and restart. The next deploy overwrites it.

Things to know

• Uploads run inside the Galaxy pod. upload1 and __DATA_FETCH__ map to the local runner (2 workers) and use the Galaxy container's memory. Bursts of uploads have caused OOM kills. The memory limit is 4 Gi on prod (capped by speedy's LimitRange) and 8 Gi on test. Speedy runs Galaxy with a 4Gi memory limit: the ndip-limits LimitRange caps containers at 2 CPU / 4Gi, so the 8Gi in values-prod.yml is rejected at admission until the cluster admins raise it. Test (mickey, no LimitRange) runs 8Gi.
• Logs go to stderr. kubectl -n ndip logs deploy/galaxy -c galaxy. There are no log files under /srv/galaxy/var/log any more. See logging.
• Rolling updates. Each deploy briefly runs two Galaxy pods. Every Galaxy process declares durable control.* queues in RabbitMQ, and these pile up across rollouts unless the control-expiry policy is in place (see RabbitMQ).
• The job lock is not persistent. A restart clears the "Job Lock" switch on the admin jobs page.
• Message banner. message_box_* in values-galaxy.yml. For a temporary maintenance banner, patch message_box_content in Secret galaxy-config and restart the Deployment.
• Interactive tools are served under https://<host>/interactivetool/ep/... through the gx-it-proxy sidecar. None of the current tools needs the wildcard *.interactivetool.<host> domain.

Legacy: VM deployment

Until 2026-10-06, Galaxy ran on ORC VMs (ndip.ornl.gov, ndip-test.ornl.gov), deployed by the Ansible galaxy_playbook.yml (ndip CI job) together with PostgreSQL, RabbitMQ, RDB and the GIE proxy. The test VM is retired. The prod VM is now only the VM proxy: do not run the ndip job. The same playbook still deploys the separate galaxy.ornl.gov instance (job galaxy-common), configured in ansible/group_vars/galaxy_all_servers and ansible/host_vars/galaxy.ornl.gov.