spec: issue-3628 Serve gRPC and HTTP from one endpoint per service
Summary
The control plane and the Artifact CAS will each serve gRPC, gRPC-Web, and HTTP on one port. Today each service has a gRPC port and an HTTP port. An installation thus needs two Services, two ingresses, two hostnames, and two TLS settings per service.
The spec compares three options: a split by connection, a per-request router to the HTTP adapter of the gRPC server, and a move to Connect. It picks the split by connection on the current gRPC port. Each new connection goes to the gRPC server that runs today, or to the HTTP server that runs today. The middleware, the authentication, and the native gRPC transport for large CAS streams do not change. The old HTTP port stays on by default for a deprecation period, behind a config flag. The Helm chart moves to one Service and one hostname per service, with a path split on the same host for nginx.
Open questions for reviewers
- Must the single port support proxies that share one upstream connection for gRPC and plain HTTP (Envoy-based proxies, service meshes)? Proposed: not in this spec. Those setups can keep the legacy HTTP port until it is deleted. Revisit before that release.
The Decision Record (D-001 to D-010) holds the other choices. Please challenge any of them in review.
We would like two reviewers to approve this spec before it merges.
Refs #3628
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill