Kvindo™ Cloud Docs
A TCP Listener Rule forwards connections from a TCP Listener to a Target Group. Because TCP is Layer 4 there is no path matching — the rule simply directs the stream, optionally re-encrypting it with TLS to the backends.
• Listener — the TCP listener this rule belongs to (spec.tcpListenerId)
• Forward to TCP — send the raw stream to a Target Group (spec.forwardToTcpResponseAction)
• Forward to TLS — re-encrypt to the backends (spec.forwardToTlsResponseAction)
• Exactly one of Forward to TCP, Forward to TLS must be set — no more, no fewer
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Listener | spec.tcpListenerId |
spec.tcp_listener_id |
No | ULID — references a TCP Listener | — | No | The listener this rule belongs to |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Evaluation order; lower is checked first. Must be unique per listener — a second rule left at the default 0 while another rule on the same listener already has order 0 is rejected |
| Forward to TCP | spec.forwardToTcpResponseAction |
spec.forward_to_tcp_response_action |
Yes | object (nullable) | — | No | Forward the raw TCP stream to a Target Group. Exactly one of Forward to TCP, Forward to TLS must be set |
| Target group | spec.forwardToTcpResponseAction.targetGroupId |
target_group_id |
Yes | ULID (nullable) — references a Target Group | — | No | Target Group to forward to |
| Port mapping type | spec.forwardToTcpResponseAction.portMappingType |
port_mapping_type |
Yes | string — ANY_TO_ANY / ONE_TO_ONE |
ANY_TO_ANY |
No | How listener ports map to target group ports |
| To ports | spec.forwardToTcpResponseAction.toPorts |
to_ports |
No | list of string | — | No | Target ports to forward to |
| Forward to TLS | spec.forwardToTlsResponseAction |
spec.forward_to_tls_response_action |
Yes | object (nullable) | — | No | Forward to a Target Group, re-encrypting to the backends. Exactly one of Forward to TCP, Forward to TLS must be set |
| Target group | spec.forwardToTlsResponseAction.targetGroupId |
target_group_id |
Yes | ULID (nullable) — references a Target Group | — | No | Target Group to forward to |
| Port mapping type | spec.forwardToTlsResponseAction.portMappingType |
port_mapping_type |
Yes | string — ANY_TO_ANY / ONE_TO_ONE |
ANY_TO_ANY |
No | How listener ports map to target group ports |
| To ports | spec.forwardToTlsResponseAction.toPorts |
to_ports |
No | list of string | — | No | Target ports to forward to |
| TLS | spec.forwardToTlsResponseAction.tls |
tls |
Yes | object (nullable) | — | No | Backend TLS re-encryption config |
| mTLS certificate | spec.forwardToTlsResponseAction.tls.mTlsCertificateId |
m_tls_certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | Client certificate presented to the backend for mutual TLS |
| CA certificate | spec.forwardToTlsResponseAction.tls.caCertificateId |
ca_certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | CA certificate used to verify the backend's certificate |
| Verify | spec.forwardToTlsResponseAction.tls.verify |
verify |
Yes | boolean (nullable) | — | No | Whether to verify the backend's certificate |
| SNI server name | spec.forwardToTlsResponseAction.tls.sniServerName |
sni_server_name |
Yes | string (nullable, up to 128 chars) | — | No | SNI hostname sent to the backend during the TLS handshake. Must not contain any of: " ; { } $ # \ or CR/LF |
A rule that forwards the TCP stream to a database Target Group on port 5432.
Terraform
Python SDK
kc CLI
Resource docs
More in this section