Kvindo™ Cloud Docs

Language
External Peering Peer

A VPC Peering External Peer is the non-Kvindo side of a VPC Peering — a network outside Kvindo Cloud (another provider, or on-premises). Kvindo establishes an encrypted tunnel to the peer's router over SSH and advertises the given CIDRs across it.

Key concepts

• VPC Peering — the peering this external side joins (spec.vpcPeeringId)

• SSH access — how Kvindo reaches the remote router: user, IP, port, and an optional SSH Private Key

• Advertised CIDRs — the remote networks made reachable from the Kvindo side (spec.ipV4Cidrs)

• Private IPv4 — the tunnel address of the remote endpoint (spec.privateIpV4)

On the Kvindo side: an External Peer alone only opens the tunnel — it has no subnet field of its own. An internal VPC Peering Peer on the same VPC Peering is also required to actually terminate the Kvindo side. Once both exist, the same Route Table + Route Table Route + Security Group requirement as the internal Peering Peer page applies for anything beyond that peer's own gateway VM.
On the remote side: the remote host's own firewall must separately allow inbound SSH (for Kvindo's configuration push) and UDP 500/4500 + ESP (IPsec) — that's infrastructure Kvindo does not configure for you.
Maintainer endpoint: Kvindo also runs a small maintainer daemon on the remote host, bound to its private IP on port 28079, exposing a /metrics endpoint with peer ids/IPs and per-direction tunnel health. It is reachable only from the private network (not from the public internet).
Parameters
UI Name API / kc name Terraform name Optional Format Default Is read only Description
VPC Peering spec.vpcPeeringId spec.vpc_peering_id No ULID — references a VPC Peering — No The peering this external side joins
SSH Private Key spec.sshPrivateKeyId spec.ssh_private_key_id No ULID — references an SSH Private Key — No Key used to reach the remote router
SSH User spec.sshUser spec.ssh_user No string — No SSH user on the remote router — no server-side default, set it explicitly (typically root)
SSH Port spec.sshPort spec.ssh_port Yes integer (0–65535) — No SSH port on the remote router — no server-side default, set it explicitly (typically 22)
SSH IPv4 spec.sshIpV4 spec.ssh_ipv4 No string — IPv4 — No Address Kvindo connects to over SSH
Private IPv4 spec.privateIpV4 spec.private_ipv4 No string — IPv4 — No Tunnel address of the remote endpoint
Advertised CIDRs spec.ipV4Cidrs spec.ipv4_cidrs No list of string — CIDR — No Remote networks advertised to the Kvindo side
Validation

• SSH IPv4 and Private IPv4 must be a bare IPv4 address (no CIDR suffix)

• Every entry in Advertised CIDRs must parse as a valid CIDR

• 0.0.0.0/0 is refused as an advertised CIDR

Examples

A peering plus an external peer reachable over SSH, advertising a remote 10.20.0.0/16 network. This standalone example exists because external peering requires a real remote SSH endpoint rather than something the shared Networking guide's mock-mode walkthrough can safely create — external peering is also covered in each guide's own External peers section.

Terraform

Python SDK

kc CLI

Related pages

Resource docs

Examples

More in this section

An unhandled error has occurred. Reload 🗙