PXC-5321 [DOCS] - 8.4 Update clone.md and encrypt-traffic.md

[patrickbirch]

modified:   docs/clone-sst.md
modified:   docs/encrypt-traffic.md modified: docs/xtrabackup-sst.md

[jaideepkarande]

LGTM
But 2 clarifications that may help.

[jaideepkarande]

Why it has been removed?

jaideepkarande:PXC-5267-8.4:scripts$ grep encrypt_threads *
grep: firewall: Is a directory
grep: sys_schema: Is a directory
grep: systemd: Is a directory
wsrep_sst_xtrabackup-v2.sh:encrypt_threads=-1
wsrep_sst_xtrabackup-v2.sh:    encrypt_threads=$(parse_cnf sst encrypt-threads -1)
wsrep_sst_xtrabackup-v2.sh:    if [[ $encrypt_threads -le 0 ]]; then
wsrep_sst_xtrabackup-v2.sh:        encrypt_threads=4

[patrickbirch]

encrypt_threads was removed because it only applied to encrypt=1, and that SST mode is gone in 8.4.

It came out in 93cc6da (PXC-5321 [DOCS] - 8.4 Update clone.md and encrypt-traffic.md) from docs/xtrabackup-sst.md. The old text said the option was passed as XtraBackup --encrypt-threads only when encrypt=1.

On this branch, [sst] encrypt is documented as 0 or 4 only. 4 is SSL (ssl-ca / ssl-cert / ssl-key), which is also the default via pxc-encrypt-cluster-traffic. Payload encryption with an XtraBackup key (encrypt, encrypt-key, encrypt-key-file) is already called out as not allowed for SST and will error.

So the section was leftover from the old key-based path. With encrypt=1 unsupported, --encrypt-threads is not used for SST, and documenting a default of 4 would be misleading.

In wsrep_sst_xtrabackup-v2.sh the value is parsed and defaulted to 4, then never passed on. There is no --encrypt-threads=$encrypt_threads anywhere in the 8.4 script. Compare that with backup_threads, which is appended as --parallel=.

PXC no longer supports encrypt=1,2,3

These are no longer supported (since we no longer support encrypt=1)
They were used to encrypt the backup as it's being transferred, this is now done using SSL (encrypt=4)