couchbase-capella

Couchbase Capella

A skill for provisioning and configuring Couchbase Capella deployments — from free tier through production, covering networking, credentials, and application connectivity.

Distinct from:

• couchbase-sizing — Capella tier selection math
• couchbase-security-hardening — TLS, RBAC, and audit configuration once the cluster is running
• couchbase-backup-restore — Capella backup and restore

When this skill applies

• "How do I create a Capella cluster?"
• "How do I connect my app to Capella?"
• "What's the difference between database credentials and admin credentials?"
• "How do I set up allowed CIDRs / private networking?"
• "How do I set up VPC peering or PrivateLink with Capella?"
• "What are Capella orgs, projects, and clusters?"
• "How do I set up Capella App Services?"
• "Free tier vs paid — what are the differences?"

Pick the right reference

Question	Read
"Getting started — free tier, org/project structure, first cluster"	references/getting-started.md
"Networking — allowed CIDRs, VPC peering, PrivateLink"	references/networking.md
"Credentials — database users vs admin, connection strings"	references/credentials.md

Key Capella concepts

Organization → Project → Cluster is the hierarchy. Everything lives under an org. Projects group clusters by environment (dev, staging, prod). Clusters are the actual Couchbase deployments.

Database credentials ≠ cluster admin credentials. The admin credentials (used in the Capella UI) are for management only and should never be in your application code. Database credentials (created per cluster, scoped to buckets and roles) are what applications use. Always use database credentials for SDK connections.

Allowed CIDRs are IP allowlists at the cluster level. Your application's outbound IP(s) must be in the allowlist before connections are accepted. For production, use private networking (VPC peering or PrivateLink) instead of public-internet allowed CIDRs.