Kvindo™ Cloud Docs
An OpenVPN instance is a managed VPN server that gives remote users secure, encrypted access to the private resources in a VPC subnet. Clients authenticate with a per-user certificate; what they can reach through the tunnel is controlled by the User Settings profiles attached to each user — nothing is routed unless a profile allows it.
• VPC subnet — the subnet the server is attached to (spec.vpcSubnetId); clients can reach its CIDR over the tunnel only if a User Settings profile lists it under allowed. Immutable after creation
• Floating IP — the public address clients connect to; without one the server has no public entry point (spec.floatingIpId). Required at creation, but can be changed afterward
• Tier — a reserved field for future use (spec.tier); only standard is accepted today
• Users — each OpenVPN User gets its own certificate and a downloadable .ovpn profile; a User Settings profile controls which traffic is routed through the VPN
• Addons — optional Prometheus sidecars. Nothing is installed unless you list it (spec.addons), and removing it from the list uninstalls it on the next change
Provisioning does not use the internet: the OpenVPN package, nginx, easy-rsa, ufw, every system package and the Ansible that drives the install all come from the image, so a VPN works on a subnet with no NAT or egress. Clients still reach it through its floating IP, and it still needs to resolve any domains you allow by name.
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Tier | spec.tier |
spec.tier |
No | string | standard |
No | Reserved for future use — only standard is accepted today |
| VPC subnet | spec.vpcSubnetId |
spec.vpc_subnet_id |
No | ULID — references a VPC Subnet | — | No | Subnet the server is attached to; reachable through the tunnel when allowed by a User Settings profile. Immutable after creation |
| Floating IP | spec.floatingIpId |
spec.floating_ip_id |
No | ULID — references a Floating IP | — | No | Public address clients connect to |
| Addons | spec.addons |
spec.addons |
Yes | list of objects | — | No | Optional Prometheus sidecars. Empty means none. Editable, and removing an entry uninstalls that addon |
| Addon name | addons[].name |
addons[].name |
No | string (≤32) | — | No | node_exporter — host CPU, memory, disk and network metrics for your Prometheus |
| Addon version | addons[].version |
addons[].version |
No | string (≤16) | — | No | Required — the platform will not pick a build for you. node_exporter currently offers 1.12.1, and an unlisted version is rejected at submit |
Once an addon is applied, its scrape target is reported read-only in status.addons (as name@version) and status.nodeExporterEndpoints. The address is the VPN server's private IP with port 9100: the exporter is unauthenticated, so it listens on the private interface only, is blocked on the public one, and is not reachable through the floating IP.
A VPN server on an existing subnet, reachable at an existing floating IP. Add OpenVPN Users to issue client profiles.
Terraform
Python SDK
kc CLI
Resource docs
Examples