grpcgi: Enabling Universal Web Serving, Native mTLS, and xDS on the gRPC Mesh - Mehrdad Afshari

Don't miss out! Join us at our next KubeCon + CloudNativeCon event in Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io grpcgi: Enabling Universal Web Serving, Native mTLS, and xDS on the gRPC Mesh - Mehrdad Afshari, Signeen Inc. Traditional web applications utilize HTTP, functioning as opaque backends within gRPC/xDS service meshes and lacking native access to SPIFFE identity, mTLS, xDS routing, and advanced load balancing. grpcgi resolves this by inverting the transport layer. Envoy communicates via gRPC to an in-process server that translates calls into the application's native interface (e.g., ASGI, Rack). This enables unmodified applications to operate over gRPC, directly inheriting the service mesh's security and routing infrastructure without code modifications. This presentation examines the language-neutral bridge protocol alongside Envoy-side translation using proxy-wasm and a native C++ filter. It explores the implications of converting web applications—including AI inference servers—into first-class gRPC upstreams. The session concludes with a live demonstration of an unmodified web application and a WebSocket echo served via gRPC through Envoy with xDS and mTLS.