Serve gRPC and HTTP from one endpoint per service #3628

Today the control plane and the Artifact CAS each expose two endpoints: a gRPC server and an HTTP server, on separate ports (control plane 9000/8000, CAS 9001/8001). Every installation therefore needs two Services, two ingresses (or Gateway routes), two hostnames, and two sets of TLS settings per service. Clients and docs must also know which endpoint to use for what.

Goal: serve both protocols from one endpoint per service, so a deployment has one port and one hostname per service.

First step: a spec. Before any code, write a spec in docs/specs/ that compares the options and picks one. Candidate options:

• Multiplex on one port by protocol (HTTP/2 with content-type: application/grpc goes to gRPC, everything else goes to HTTP).
• Move the HTTP endpoints to a framework that serves gRPC and HTTP from the same handlers (for example, Connect).

Considerations:

• Backward compatibility: keep the current two ports for a deprecation period, behind a config flag.
• The Helm chart: one Service and one ingress or route per service once this ships.
• Large CAS uploads and downloads must keep their current streaming behavior.

Related: #2642 (single hostname at the chart level, closed as stale). This issue solves the same problem in the server itself, so it does not depend on Gateway API.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri