Kvindo™ Cloud Docs
A TCP Listener operates at Layer 4. It accepts raw TCP connections on a Load Balancer and forwards them to Target Groups without inspecting the payload — the right choice for any non-HTTP TCP service (databases, message brokers, custom protocols).
• Load balancer — the LB this listener belongs to (spec.loadbalancerId)
• Interface — which side to bind: all, public, or private — no server-side default; the console preselects all
• Ports — the TCP ports the listener accepts on (no host filtering at L4)
• Security rules — optional IP allow/deny list applied before routing
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Load balancer | spec.loadbalancerId |
spec.loadbalancer_id |
No | ULID — references a Load Balancer | — | No | The load balancer this listener belongs to |
| Interface | spec.interface |
spec.interface |
No | string — all / public / private |
— | No | Which network interface to bind on. No server-side default — the console preselects all for convenience, but the API rejects a missing/empty value |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Tie-breaking priority when multiple listeners match |
| Ports | spec.ports |
spec.ports |
No | list of string — integers only, 1-65535 (no "8000-8010" range form) |
— | No | TCP ports the listener accepts connections on. At least one required. Port 22 is reserved for the Loadbalancer VM's own SSH access and is rejected. Each port must be unique across every listener (of any protocol) on the same Load Balancer |
| Security rules | spec.securityRules |
spec.security_rules |
Yes | list of rule objects | [] |
No | IP allow/deny list applied before routing |
| Order | spec.securityRules[].order |
order |
Yes | integer | — | No | Evaluation order of the rule within this listener's allow/deny list — rules are checked in ascending order and the first one whose IPv4/IPv6 blocks contain the client IP decides allow or deny; traffic matching no rule is denied by default |
| Description | spec.securityRules[].description |
description |
Yes | string (nullable) | — | No | Free-form note on what the rule is for |
| Action | spec.securityRules[].action |
action |
No | string — allow / deny |
— | No | Whether to allow or deny the matched IPs |
| IPv4 blocks | spec.securityRules[].ipV4Blocks |
ipv4_blocks |
Yes | list of string — CIDR | [] |
No | IPv4 ranges the rule matches |
| IPv6 blocks | spec.securityRules[].ipV6Blocks |
ipv6_blocks |
Yes | list of string — CIDR | [] |
No | IPv6 ranges the rule matches. IPv6 is not yet implemented — this field is reserved for future use |
A TCP listener on port 5432, restricted to an office network with a security rule.
Terraform
Python SDK
kc CLI
Resource docs
More in this section