Oncat Proxy

The ONCat proxy gives NDIP tools authenticated access to the ONCat data catalog. It is an OIDC proxy that accepts XCAMS (PingFed) and UCAMS (Azure) tokens and calls ONCat with NDIP's credentials. It is served at https://ndip.ornl.gov/oncat (test: https://ndip-test.ornl.gov/oncat). For example, the "Load Data" tool uses it in ingest mode oncat.

Deployment

The proxy runs as Helm release oncat-proxy in namespace ndip (chart, image savannah.ornl.gov/ndip/oncatproxy). It is deployed by the calvera CI jobs oncat-proxy-test and oncat-proxy-k8s-prod (k8s/oncat-proxy/deploy.sh), which also apply the /oncat Ingress (oncat-ingress.yaml, rewriting /oncat/<path> to /<path>).

Updating the Oncat Proxy Version

Change image.tag in k8s/oncat-proxy/values-test.yml / values-prod.yml and run the matching job.

Changing the Deployment Environment

The OIDC discovery URLs are under oncat: in values-<env>.yml. ONCat client credentials and other secrets are in the vault-encrypted secrets-<env>.yml (see Deploying NDIP).

Health check: https://ndip.ornl.gov/oncat/health. Prometheus probes https://ndip.ornl.gov/oncat.

Legacy

The proxy used to run as a Docker container on the Galaxy VMs (ornl.oncat-proxy Ansible role, job oncat-proxy-prod). Do not run oncat-proxy-prod: it targets the old VM.