Kong VPC Hub | API Request Flow

Kong VPC Hub | API Request Flow An architecture diagram generated by Archify. Internal Control Plane · Internal API configuration · Konnect | North America (US) | 2 dedicated CPs Internal Control Plane Internal API configuration Public Control Plane · Published API configuration only · Konnect | North America (US) | 2 dedicated CPs Public Control Plane Published API configuration only App A · Internal API consumer · Provider A VPC | Account A | Tokyo App A Internal API consumer Private DP pool · Self-hosted Kong | Tokyo · Kong Hub VPC | Platform Account | Tokyo (ap-northeast-1) Private DP pool Self-hosted Kong | Tokyo Public API DP pool · Self-hosted Kong | Tokyo · Kong Hub VPC | Platform Account | Tokyo (ap-northeast-1) Public API DP pool Self-hosted Kong | Tokyo External App · Approved public APIs only · Architecture component External App Approved public APIs only App B · Internal APIs · Provider B VPC | Account B | Tokyo App B Internal APIs App C · Internal + selected public APIs · Provider C VPC | Account C | Tokyo App C Internal + selected public APIs Private HTTPS Private HTTPS Internal APIs Internet HTTPS Published APIs Outbound TLS :443 Outbound TLS :443 Konnect | North America (US) | 2 dedicated CPs Kong Hub VPC | Platform Account | Tokyo (ap-northeast-1) Provider A VPC | Account A | Tokyo Provider B VPC | Account B | Tokyo Provider C VPC | Account C | Tokyo

Runtime requests, not network definitions

  • • Arrows show API calls: A → Private DP → B / C; External App → Public DP → C.
  • • Peering A–Hub carries A → Hub; Peering B–Hub / C–Hub carries the upstream leg.

Exposure boundary

  • • Public ingress serves only explicitly published routes; upstream Apps stay private.
  • • Two separate CPs prevent internal-only routes from being synced to the public DP pool.

Review draft | Not a deployment blueprint

  • • DP pools run in Tokyo; CP connections carry configuration and telemetry, not API proxy traffic.
  • • LBs, subnets, HA replicas and security controls are omitted. VPC connectivity and return routes are required.