Control plane for Envoy proxy fleets
Elchi
Elchi is a self-hosted control plane for Envoy. A three-process backend serves full xDS to your proxies, a web UI generated from Envoy's protobuf definitions edits their configuration, and a Coraza-based WAF with the OWASP Core Rule Set runs beside them. GSLB, ACME certificate automation and Kubernetes node discovery are built in.
What it does
- Three-process backend (Registry, Controller, xDS Control-Plane) plus a web UI, each scaled independently.
- Full xDS: ADS, CDS, EDS, LDS, RDS, VHDS, SDS, ECDS and delta xDS, on CloudNativeWorks' go-control-plane fork.
- Built-in WAF: Coraza with the OWASP Core Rule Set v4, running as an Envoy ext_proc sidecar with centrally managed CRS versions.
- Runs a control plane per Envoy version side by side (Envoy 1.39.x today), with guided version upgrades.
- UI forms generated from Envoy's protobuf definitions.
- Scenario workflows and a component catalog for common configurations.
- GSLB with health checks; ACME certificate automation; BGP via node agents.
- Kubernetes node discovery that keeps Envoy cluster endpoints in sync.
- Project-based multi-tenancy, RBAC (Owner, Admin, Editor, Viewer), JWT and 2FA.
- Audit log of configuration and operational changes, with syslog forwarding.
- Metrics with VictoriaMetrics; optional AI configuration and log analysis through your own OpenRouter key (needs outbound internet).
- Licensing: Free (1 client), Advance (5), Enterprise.
Deployment
| Option | Elchi |
|---|---|
| Self-hosted | Yes (Helm) |
| Air-gapped installs | — |
| Offline licence | — |
| Free tier | Free (1 client) |
See Elchi on your own systems
Talk to the engineers who build it, or read the full documentation on the product site.