ARCHITECTURE

Three processes,
built to scale.

A distributed platform with intelligent routing and enterprise-grade components — designed from day one for high availability.

3-PROCESS DISTRIBUTED ARCHITECTURE

Specialized microservices,
working in harmony.

Enterprise-grade scalability through three specialized processes — each with a clear role and lifecycle.

Registryrouting

Service discovery and routing hub

  • › Controller registration
  • › Client location tracking
  • › Version-based control-plane routing
  • › Automatic cleanup of stale instances
ControllerAPI

REST API and management layer

  • › Client management & command dispatch
  • › xDS resource management (CDS, LDS, RDS, EDS)
  • › User & authorization (RBAC)
  • › Persistent configuration store
  • › AI-powered config analysis
  • › K8s Discovery system
Control-PlanexDS

xDS control plane

  • › Envoy ADS (Aggregated Discovery Service)
  • › VHDS (Virtual Host Discovery Service)
  • › Snapshot management per Envoy
  • › Live updates on every change
  • › Auto-registration with registry
  • › Health monitoring & keepalive
01

High Availability

Multiple control-plane instances with automatic failover and health monitoring — and at the edge, active/passive Elchi OS pairs that share VIPs and fail over in about two seconds.

02

Scalability

Load balancing across controllers and control-planes for enterprise workloads.

03

Version Routing

Intelligent routing to appropriate control-plane versions based on client requirements.

EDGE & DATA PLANE

The control plane is half the story.
The edge is where traffic lives.

Each edge host runs Envoy plus the agents that deploy it, secure it, and observe it — driven by the central control plane.

Envoydata plane

The L7 proxy that carries your traffic

  • › Receives config over xDS from the control-plane
  • › Calls Shield over ext_proc for security decisions
  • › Ships access logs (ALS) to the collector
  • › No restarts — config applied live
elchi-clientedge agent

The agent that operates each edge host

  • › Registers the node & runs controller commands
  • › Deploys / upgrades Envoy and bootstrap
  • › Bundles & manages Shield and the WAF module
  • › Ships logs, manages BGP/FRR & networking
  • › Runs elchi-ha on Elchi OS: active/passive VIP pairs
Shieldext_proc

API security enforced in the request path

  • › WAF (OWASP CRS), JWT/mTLS, rate-limit, bot — 12 engines + built-in DLP
  • › Runs locally next to Envoy on each edge host
  • › Policies pushed as files, hot-reloaded
  • › block / detect / shadow decisions, fail-open safe
Collectoranalytics

Turns traffic into an API inventory

  • › Ingests Envoy access logs
  • › Normalizes paths, scores risk & PII
  • › Builds the endpoint catalog and the event history
  • › Powers API Discovery — metadata only, no bodies

Want the full wire map — every port, protocol, and data flow between the control plane and the edge? See the Architecture reference in the docs.

LAYERED ARCHITECTURE

From console to proxy.
Each layer, intentional.

A layered platform with distributed processing and enterprise-grade components.

Management Console
Visual editors
Every Envoy resource
Dependency graphs
Resource relationships
Live views
Traffic, metrics & logs
Backend Layer — 3-Process Architecture
Controller
API · client management, xDS, auth
Control-Plane
xDS · ADS, VHDS, snapshots
Registry
Discovery · service routing, versioning
Data Layer
Configuration store
Resources, projects & audit
Metrics store
Long-term time series
Event store
API events & security audit
Proxy Layer
Envoy Proxy
Multi-Version Support
WAF
OWASP CRS
Health Check
Auto-Recovery
REQUEST FLOW

From client connection
to live config.

How a request travels through the platform — from initial registration to applied configuration.

Client
Agent on host
connect
Registry
Locate the controller
route
Controller
Commands & resources
snapshot
Control-Plane
Snapshot per version
xDS
Envoy
Apply config
01

Connection

Agents and Envoys connect through the front-door Envoy; the Registry, an ext_proc service, tells it which controller holds each client.

02

Routing

Each Envoy's xDS stream is sent to the control plane of its own Envoy version.

03

xDS Protocol

When a resource changes, the controller rebuilds the snapshot and the control plane streams it to Envoy.

04

Configuration

Envoy receives and applies dynamic configurations live.

NATIVE INTEGRATIONS

Plays well with your stack.

First-class integrations with the cloud-native ecosystem.

KU
Kubernetes
Native integration
DO
Docker
Native integration
EN
Envoy
Native integration
GR
Grafana
Native integration
PR
Prometheus
Native integration
OP
OpenStack
Native integration
OP
OpenRouter
Native integration
LD
LDAP / AD
Native integration
SY
Syslog
Native integration
EL
ELK Stack
Native integration
LE
Let's Encrypt
Native integration
GO
Google Trust Services
Native integration
READY TO DEPLOY

Bring this architecture
to your cluster.

Deploy to your Kubernetes cluster with our Helm chart, or install on bare metal.