From ca44039cbb7f26a07b2354d49678dcec81679c2e Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Wed, 16 Sep 2026 11:38:34 +0530 Subject: [PATCH 1/4] implementencrytpatrest --- .../learn/pages/clusters-and-availability/xdcr-overview.adoc | 4 ++++ .../pages/security/native-encryption-at-rest-overview.adoc | 3 +++ 2 files changed, 7 insertions(+) diff --git a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc index fc26f92bfb..70bde35f79 100644 --- a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc +++ b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc @@ -250,6 +250,10 @@ Before attempting to enable half-secure replications, see the important informat For step-by-step procedures, see xref:manage:manage-xdcr/secure-xdcr-replication.adoc[Secure a Replication]. +In addition to the connection security described above, Couchbase Server's native encryption at rest also protects XDCR's persisted data. +When the administrator enables Configuration Encryption, Couchbase Server automatically encrypts XDCR metadata — including remote-cluster references, replication specifications, checkpoints, and collection mappings. +When the administrator enables Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest]. + [#xdcr-advanced-settings] == XDCR Advanced Settings diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index c35357e780..53df9ecae8 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -94,6 +94,9 @@ This includes: * Logs of some services are not encrypted by NS Server. For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled. + +* Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata. +XDCR checkpoints, collection manifests, and broken maps use a separate storage mechanism (simple_store). Couchbase Server treats XDCR's log file (goxdcr.log) like other log files, and encrypts it when you enable encryption for logs. ==== [#when-data-is-encrypted] From dc02f717a159eb99fa40d257455c464bf0e21c2c Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Fri, 18 Sep 2026 20:30:11 +0530 Subject: [PATCH 2/4] Updating review comment --- .../pages/security/native-encryption-at-rest-overview.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 53df9ecae8..80fa217301 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -96,7 +96,7 @@ This includes: For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled. * Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata. -XDCR checkpoints, collection manifests, and broken maps use a separate storage mechanism (simple_store). Couchbase Server treats XDCR's log file (goxdcr.log) like other log files, and encrypts it when you enable encryption for logs. +XDCR checkpoints, collection manifests, and broken maps are stored in a separate internal storage mechanism and they are encrypted as well. ==== [#when-data-is-encrypted] From d4f0144454787a990a4c919219bf9742d30e80b8 Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Wed, 23 Sep 2026 14:04:41 +0530 Subject: [PATCH 3/4] Updating review comment2 --- .../pages/clusters-and-availability/xdcr-overview.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc index 70bde35f79..1a8c34d743 100644 --- a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc +++ b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc @@ -250,9 +250,9 @@ Before attempting to enable half-secure replications, see the important informat For step-by-step procedures, see xref:manage:manage-xdcr/secure-xdcr-replication.adoc[Secure a Replication]. -In addition to the connection security described above, Couchbase Server's native encryption at rest also protects XDCR's persisted data. -When the administrator enables Configuration Encryption, Couchbase Server automatically encrypts XDCR metadata — including remote-cluster references, replication specifications, checkpoints, and collection mappings. -When the administrator enables Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest]. +In addition to the connection security described above, Couchbase Server's native encryption at rest also protects the data that XDCR writes to disk. +When you enable Configuration Encryption, Couchbase Server encrypts XDCR metadata, including remote-cluster references, replication specifications, checkpoints, and collection mappings. When you enable Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. +For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest]. [#xdcr-advanced-settings] == XDCR Advanced Settings From 475d771e614ab7d29ed53d0c95bf942a1f0358e0 Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Wed, 23 Sep 2026 14:21:56 +0530 Subject: [PATCH 4/4] Updating review comment2 --- .../pages/security/native-encryption-at-rest-overview.adoc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 80fa217301..42991e0257 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -95,8 +95,7 @@ This includes: * Logs of some services are not encrypted by NS Server. For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled. -* Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata. -XDCR checkpoints, collection manifests, and broken maps are stored in a separate internal storage mechanism and they are encrypted as well. +* Couchbase Server stores XDCR checkpoints, collection manifests, and broken maps in a separate internal storage mechanism, and also encrypts this data when you enable encryption for configuration data. ==== [#when-data-is-encrypted]