Kvindo™ Cloud Docs
An HTTPS Listener Rule matches requests on an HTTPS Listener (after TLS has been terminated) and applies a Layer-7 action. It has the same capabilities as an HTTP rule, with one extra option: forwarding as gRPC.
• Listener — the HTTPS listener this rule belongs to (spec.httpsListenerId)
• Match — the request path and how it is compared (spec.match)
• Action — forward to a Target Group, return a static response, rewrite the path, or add/remove headers
• gRPC — the forward-to-HTTPS action can carry passAsGrpc for gRPC backends
• Exactly one of Static response, Forward to HTTP, Forward to HTTPS must be set — no more, no fewer
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Listener | spec.httpsListenerId |
spec.https_listener_id |
No | ULID — references an HTTPS Listener | — | No | The listener this rule belongs to |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Evaluation order; lower is checked first. Must be unique per listener — a second rule left at the default 0 while another rule on the same listener already has order 0 is rejected |
| Match | spec.match |
spec.match |
No | object | — | No | Request match criteria |
| Path | spec.match.path |
path |
No | string | — | No | Path to compare against. Must not contain any of: " ; { } $ # \ or CR/LF |
| Path match type | spec.match.pathMatchType |
path_match_type |
No | string — prefix / exact / regex |
— | No | How the path is compared |
| Forward to HTTP | spec.forwardToHttpResponseAction |
spec.forward_to_http_response_action |
Yes | object (nullable) | — | No | Forward the request to a Target Group over plain HTTP. Exactly one of Static response, Forward to HTTP, Forward to HTTPS must be set |
| Target group | spec.forwardToHttpResponseAction.targetGroupId |
target_group_id |
Yes | ULID (nullable) — references a Target Group | — | No | Target Group to forward to |
| Port mapping type | spec.forwardToHttpResponseAction.portMappingType |
port_mapping_type |
Yes | string — ANY_TO_ANY / ONE_TO_ONE |
ANY_TO_ANY |
No | How listener ports map to target group ports |
| To ports | spec.forwardToHttpResponseAction.toPorts |
to_ports |
No | list of string | — | No | Target ports to forward to |
| Forward to HTTPS | spec.forwardToHttpsResponseAction |
spec.forward_to_https_response_action |
Yes | object (nullable) | — | No | Forward the request to a Target Group, re-encrypting to the backends. Exactly one of Static response, Forward to HTTP, Forward to HTTPS must be set |
| Target group | spec.forwardToHttpsResponseAction.targetGroupId |
target_group_id |
Yes | ULID (nullable) — references a Target Group | — | No | Target Group to forward to |
| Pass as gRPC | spec.forwardToHttpsResponseAction.passAsGrpc |
pass_as_grpc |
Yes | boolean | false |
No | Forward as gRPC instead of plain HTTP/2 |
| Port mapping type | spec.forwardToHttpsResponseAction.portMappingType |
port_mapping_type |
Yes | string — ANY_TO_ANY / ONE_TO_ONE |
ANY_TO_ANY |
No | How listener ports map to target group ports |
| To ports | spec.forwardToHttpsResponseAction.toPorts |
to_ports |
No | list of string | — | No | Target ports to forward to |
| TLS | spec.forwardToHttpsResponseAction.tls |
tls |
Yes | object (nullable) | — | No | Backend TLS re-encryption config |
| mTLS certificate | spec.forwardToHttpsResponseAction.tls.mTlsCertificateId |
m_tls_certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | Client certificate presented to the backend for mutual TLS |
| CA certificate | spec.forwardToHttpsResponseAction.tls.caCertificateId |
ca_certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | CA certificate used to verify the backend's certificate |
| Verify | spec.forwardToHttpsResponseAction.tls.verify |
verify |
Yes | boolean (nullable) | — | No | Whether to verify the backend's certificate |
| SNI server name | spec.forwardToHttpsResponseAction.tls.sniServerName |
sni_server_name |
Yes | string (nullable, up to 128 chars) | — | No | SNI hostname sent to the backend during the TLS handshake. Must not contain any of: " ; { } $ # \ or CR/LF |
| Static response | spec.staticResponseAction |
spec.static_response_action |
Yes | object (nullable) | — | No | Return a fixed response without touching a backend. Exactly one of Static response, Forward to HTTP, Forward to HTTPS must be set |
| Status code | spec.staticResponseAction.statusCode |
status_code |
No | integer | — | No | HTTP status code to return |
| Body | spec.staticResponseAction.bodyString |
body_string |
No | string | — | No | Response body. Must not contain any of: " ; { } $ # \ or CR/LF |
| Content type | spec.staticResponseAction.contentType |
content_type |
Yes | string (nullable) | — | No | Value of the Content-Type response header. Must not contain any of: " ; { } $ # \ or CR/LF |
| Headers | spec.staticResponseAction.headers |
headers |
Yes | map of string to string (nullable) | — | No | Additional response headers to include. Header names and values must not contain any of: " ; { } $ # \ or CR/LF |
| Path rewrite | spec.pathRewriteAction |
spec.path_rewrite_action |
Yes | object (nullable) | — | No | Rewrite the request path before forwarding; only applies when a forward action ends up handling the request — has no effect if Static response is what's actually selected |
| Source path | spec.pathRewriteAction.sourcePath |
source_path |
No | string | — | No | Path (or pattern, depending on Path type) to match against the request. Must not contain any of: " ; { } $ # \ or CR/LF |
| Destination path | spec.pathRewriteAction.destinationPath |
destination_path |
No | string | — | No | Path to rewrite the request to. Must not contain any of: " ; { } $ # \ or CR/LF |
| Path type | spec.pathRewriteAction.pathType |
path_type |
No | string — exact / regex / prefix |
— | No | How Source path is matched |
| Set request headers | spec.setRequestHeadersAction |
spec.set_request_headers_action |
Yes | object (nullable) | — | No | Add or overwrite request headers before forwarding; composes with a forward action |
| Headers | spec.setRequestHeadersAction.headers |
headers |
No | map of string to string | — | No | Header name → value pairs to set on the request. Header names and values must not contain any of: " ; { } $ # \ or CR/LF |
| Set response headers | spec.setResponseHeadersAction |
spec.set_response_headers_action |
Yes | object (nullable) | — | No | Add or overwrite response headers before returning to the client; composes with a forward action |
| Headers | spec.setResponseHeadersAction.headers |
headers |
No | map of string to string | — | No | Header name → value pairs to set on the response. Header names and values must not contain any of: " ; { } $ # \ or CR/LF |
| Delete request headers | spec.deleteRequestHeadersAction |
spec.delete_request_headers_action |
Yes | object (nullable) | — | No | Remove request headers before forwarding; composes with a forward action |
| Headers | spec.deleteRequestHeadersAction.headers |
headers |
No | list of string | — | No | Header names to remove from the request. Must not contain any of: " ; { } $ # \ or CR/LF |
| Delete response headers | spec.deleteResponseHeadersAction |
spec.delete_response_headers_action |
Yes | object (nullable) | — | No | Remove response headers before returning to the client; composes with a forward action |
| Headers | spec.deleteResponseHeadersAction.headers |
headers |
No | list of string | — | No | Header names to remove from the response. Must not contain any of: " ; { } $ # \ or CR/LF |
A rule on an HTTPS listener that forwards decrypted requests to a Target Group's backends on port 80.
Terraform
Python SDK
kc CLI
Resource docs
Examples
More in this section