Short, factual answers about what Elchi is, how it runs, and how it is licensed. Each answer links the documentation page that covers it in full.
Elchi is a visual control plane for Envoy proxy fleets. You configure listeners, routes, clusters, endpoints, filters and certificates in a UI whose editors are generated from each Envoy version’s protobufs, validate the change, and publish it; Elchi pushes it to your Envoys over xDS. Lightweight edge agents run Envoy on your hosts, and add-on products bring API security (Shield), API discovery and GSLB into the same control plane.
In the docsNo. Every Envoy resource is edited through typed forms, and each change is checked twice: in the editor against types generated from the Envoy API, and on the server against the Envoy API’s validation rules before it is stored. Changes go through draft, save and publish steps with an audit log, and a published change reaches the running Envoys over xDS without a restart.
In the docsElchi runs several Envoy versions side by side. Its registry routes each proxy to a control plane that speaks that proxy’s version, and resources can be migrated from one version to the next. The exact set depends on the versions you deploy; the current list is shown under Settings → General in the UI.
In the docsYes. The automation API is a versioned REST API with project API tokens. It can take an upstream endpoint out of rotation across a whole project and put it back, and switch an EDS cluster to another endpoints resource for a blue/green release.
In the docsNo. The control plane installs with a Helm chart on Kubernetes, with the Docker Swarm installer, or on bare-metal Linux hosts; a single-VM evaluation install is also available. The Envoy proxies themselves run on Linux edge hosts managed by the Elchi client, or on Elchi OS appliances.
In the docsOn your own hosts. The Elchi client is a lightweight agent on each Linux edge host (Ubuntu 24.04): it registers with the control plane, runs the deployed Envoys and handles lifecycle commands. Elchi OS is a hardened edge appliance image that does the same and adds active/passive HA pairs that share virtual IPs.
In the docsYes. The Docker Swarm installer supports a fully offline install from a saved image bundle, and an offline license file activates the platform without contacting the license API. API discovery data stays in your own ClickHouse.
In the docsThrough Shield, an ext_proc sidecar that runs next to Envoy on each edge host. Envoy streams each request to Shield over a local socket, and Shield returns allow, block (403) or record-only detect verdicts from twelve security engines (among them authentication, rate limiting, bot defense and a WAF built on the OWASP Core Rule Set) plus built-in data-loss prevention. Policies are rolled out from detect to block.
In the docsNo. API discovery is passive and metadata-only: Envoy ships access-log records to the Elchi collector, which normalizes and scores them into an API inventory. It never touches request bodies and cannot block or slow live traffic. The inventory flags unauthenticated endpoints, PII exposure, shadow endpoints and drift against your OpenAPI specs.
In the docsGSLB steers traffic at DNS. Elchi actively probes every IP behind a record and serves only healthy targets through a CoreDNS plugin, so clients resolve a hostname to reachable backends across regions and data centers.
In the docsBy the number of managed clients (edge nodes) connected at the same time, and by product. Elchi Core is the base of every deployment; API Security, API Discovery and GSLB are licensed individually on top of it. Licenses can be activated online or with an offline license file.
In the docsYes. Without a license, Elchi runs Elchi Core with one managed client, which is enough to evaluate the platform end to end.
In the docs