Manage Traffic at enterprise scale.
The enterprise control plane for traffic management and API security. Configure, validate and publish your entire Envoy fleet from one place — listeners, routes, GSLB and certificates — and protect every API at the edge with Shield and traffic-derived API discovery.
View architecture
Works withKubernetesEnvoyGrafanaOpenStackLDAP / ADLet's EncryptOpenRouter
One platform. Four products.
Start with Elchi Core — the complete Envoy management platform — and license security, discovery, and traffic products as you need them.
Elchi API Security
Shield is an ext_proc engine running next to each Envoy: authentication, rate limiting, bot defense, data-loss prevention, and a built-in OWASP CRS WAF — composed per route and rolled out safely from detect to block.
Add-on · Requires CoreLearn moreElchi API Discovery
Turns live Envoy traffic into a continuously scored API inventory: shadow endpoints, missing auth, PII exposure, drift — with a one-click path from finding to protection.
Add-on · Requires CoreLearn moreElchi GSLB
CoreDNS-based authoritative DNS driven by distributed health checking: region-scoped answers, per-record failover zones, and anti-flapping state machines — designed for 100K+ endpoints.
Add-on · Requires CoreLearn moreElchi Core
Base platformThe foundation of the Elchi platform: a visual control plane for your entire Envoy fleet — full xDS, multi-version support, safe publish workflows, and an edge agent that runs Envoy on your hosts.
Learn moreEverything you need. Nothing you don't.
Comprehensive platform for enterprise proxy management with modern UI and powerful automation.
Proto-Driven Configuration
Typed models and field metadata are generated from each Envoy version's protobufs. Listeners, Clusters, Endpoints, Routes — with full TypeScript safety.
Interactive Dependency Graphs
Interactive visual diagrams display relationships between Envoy resources. Understand data flow and troubleshoot interactively.
Shield — Edge API Security
A per-edge ext_proc sidecar that enforces API security in the request path: WAF (OWASP CRS), authentication, rate limiting, and bot defense — twelve engines plus built-in DLP, rolled out safely from detect to block.
API Discovery & Inventory
Turn live traffic into a continuously-scored inventory of every API you expose — shadow endpoints, missing auth, PII leaks, enumeration — check it against your OpenAPI specs and export it as OpenAPI.
Quick Start Scenarios
Guided wizards that build a complete set of resources for common setups, such as an HTTP or TCP proxy, plus your own reusable scenarios.
Lightweight Edge Agent
A lightweight agent on every edge host. Auto-registration, health monitoring, log export to Syslog/ELK.
Full xDS Protocol Support
Complete implementation of xDS (ADS, CDS, EDS, LDS, RDS, VHDS). Delta xDS for efficient updates.
Two-Step Validation
Validation in the editor and again on the server ensures configurations are correct before deployment.
Save & Publish Workflow
Draft mode for safe configuration changes. Save incrementally and publish bulk updates atomically. Every change is recorded in the audit log.
Multi-Version Envoy Support
Manage multiple Envoy versions from a single interface. Intelligent version routing with seamless migration X → Y.
Project-Based Multi-Tenancy
Organize configurations by teams, environments, or customers. 4-tier RBAC (Owner, Admin, Editor, Viewer).
Built for the work, not the workaround.
See how Elchi compares to hand-written Envoy configuration and to a service mesh.
What sets it apart
AI-Assisted Analysis
On-demand AI review of configuration and logs, with your own OpenRouter key.
Proto-Driven Models
Typed models and field metadata come from each Envoy version's protos, so the editors follow the Envoy API closely.
Version Routing
Each Envoy is served by the control plane of its own version.
Enterprise Ready
Built from the ground up for multi-tenancy, RBAC, two-factor authentication and a complete audit trail.
Seamless Upgrades
Move a listener and its resources to a new Envoy version and cut over with a hot restart, without dropped requests.
Enterprise Auth
LDAP / AD integration for centralized authentication and authorization.
Log Centralization
Ship logs with Filebeat to Elasticsearch or Logstash, or through rsyslog.
Advanced Metrics
Built-in dashboards with Grafana integration for comprehensive monitoring.
Designed for the operator, built for the platform team.
Captured from a live environment — real Envoy traffic, Shield blocks and discovered APIs. Drag the slider to see each screen in light and dark.
Three processes. One coherent platform.
Enterprise-grade scalability with specialized microservices working in harmony.
Registry
routingService discovery and routing hub
- Controller registration
- Client location tracking
- Version-based routing
- Automatic cleanup
Controller
APIAPI and management layer
- Client management & dispatch
- xDS resources (CDS, LDS, RDS, EDS)
- RBAC & authentication
- Persistent config store
- AI config analysis
- K8s discovery
Control-Plane
xDSxDS control plane
- Client ADS
- VHDS (Virtual Host Discovery)
- Snapshot management
- Live updates
- Auto-registration
- Health & keepalive
High Availability
Multiple control-plane instances with automatic failover, and active/passive edge pairs that share VIPs
Scalability
Load balancing across controllers and control-planes for enterprise workloads
Version Routing
Intelligent routing to appropriate control-plane versions based on client requirements
Versatile by design.
Versatile platform designed for diverse deployment scenarios.
API Gateway Management
Centralized management of clients as an API gateway for microservices architectures.
- Rate limiting & traffic control
- Authentication & authorization
- Request/response transformation
- API versioning & routing
Load Balancing & Traffic Steering
Run Envoy fleets as load balancers in front of your services, with health checks and controlled rollouts.
- Weighted traffic splitting & canary
- Circuit breaking, retries & outlier detection
- Active health checks
- Metrics & live traffic view
Multi-Site & Multi-Cluster Backends
Put edge fleets in front of several sites and Kubernetes clusters, managed from one control plane.
- Kubernetes node discovery per cluster
- GSLB failover between sites
- Active/passive edge HA pairs
- Unified policy enforcement
Enterprise Microservices
Enterprise-grade client management with multi-tenancy and role-based access control.
- Team-based config isolation
- Complete audit trail
- Centralized policy management
- Self-service configuration
Cloud-Native Applications
Run the control plane on Kubernetes and keep the edge proxies in step with your clusters.
- Control plane on Kubernetes via Helm
- Kubernetes node discovery
- Zero-downtime listener upgrades
- Health checking & monitoring
Edge Proxy & Ingress
Run Envoy at the edge to terminate TLS, protect incoming traffic and route it.
- SSL/TLS termination with ACME certificates
- Rate limits & connection limits
- Bot & IP-reputation blocking (Shield)
- Region-scoped DNS answers with GSLB
- Financial Services
- E-Commerce
- Healthcare
- Technology
- Telecommunications
- Media & Entertainment
Whatever your use case, Elchi provides the flexibility and power you need.
Ready to simplify your traffic management?
Try the stack solution for proxy management with our demo, or deploy to your Kubernetes cluster using our Helm chart.
- Ready To Use
- Self-Hosted
- Multi-Version Proxy
- Agent Support
How a change ships
- Saveas a draft
- Validatein the editor and on the server
- Publishto the fleet, atomically
Every change is recorded in the audit log.