Skip to content

[DOC-14349] Implement Encrypt at Rest #4176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pramodkumarka-sys wants to merge 2 commits into
base: release/8.5
Choose a base branch
from
+7 −0
Open

[DOC-14349] Implement Encrypt at Rest #4176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca44039
implementencrytpatrest
pramodkumarka-sys Sep 16, 2026
dc02f71
Updating review comment
pramodkumarka-sys Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions modules/learn/pages/clusters-and-availability/xdcr-overview.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,10 @@ Before attempting to enable half-secure replications, see the important informat

For step-by-step procedures, see xref:manage:manage-xdcr/secure-xdcr-replication.adoc[Secure a Replication].

In addition to the connection security described above, Couchbase Server's native encryption at rest also protects XDCR's persisted data.
When the administrator enables Configuration Encryption, Couchbase Server automatically encrypts XDCR metadata — including remote-cluster references, replication specifications, checkpoints, and collection mappings.
When the administrator enables Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest].

[#xdcr-advanced-settings]
== XDCR Advanced Settings

Expand Down
3 changes: 3 additions & 0 deletions modules/learn/pages/security/native-encryption-at-rest-overview.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ This includes:

* Logs of some services are not encrypted by NS Server.
For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled.

* Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata.
XDCR checkpoints, collection manifests, and broken maps are stored in a separate internal storage mechanism and they are encrypted as well.
====

[#when-data-is-encrypted]
Expand Down