From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Fri, 17 Jul 2026 19:08:23 +0000 (+0000)
Subject: rgw/admin: guard bilog autotrim on non-exporting (archive) zones
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=1543a248a4bba5edc52dc2f9a9f330b95a896aa8;p=ceph.git

rgw/admin: guard bilog autotrim on non-exporting (archive) zones

The background sync-log-trim thread already skips bucket trim on zones whose
sync module does not export data , but the admin command had no equivalent
guard, so running it on an archive zone could delete instance metadata the
zone is meant to retain.

So, refuse the command on non-exporting zones unless --yes-i-really-mean-it is
given.

Fixes: https://tracker.ceph.com/issues/78364
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---

diff --git a/src/rgw/radosgw-admin/radosgw-admin.cc b/src/rgw/radosgw-admin/radosgw-admin.cc
index eb174f43f87..4d294e68501 100644
--- a/src/rgw/radosgw-admin/radosgw-admin.cc
+++ b/src/rgw/radosgw-admin/radosgw-admin.cc
@@ -11431,6 +11431,19 @@ next:
   }
 
   if (opt_cmd == OPT::BILOG_AUTOTRIM) {
+    // The background sync-log-trim thread only runs bucket trim on zones whose
+    // sync module exports data. Non-exporting zones (e.g. archive) deliberately
+    // forbid bucket-instance removal. Likewise, here, we add the same guard for
+    // user triggered auto-trim.
+    if (!static_cast<rgw::sal::RadosStore*>(driver)->svc()->zone->sync_module_exports_data() &&
+        !yes_i_really_mean_it) {
+      cerr << "This zone's sync module does not export data (e.g. an archive zone). "
+              "bilog autotrim can remove bucket instance metadata that this zone type "
+              "is meant to retain.\n"
+              "do you really mean it? (requires --yes-i-really-mean-it)" << std::endl;
+      return EPERM;
+    }
+
     RGWCoroutinesManager crs(driver->ctx(), driver->get_cr_registry());
     RGWHTTPManager http(driver->ctx(), crs.get_completion_mgr());
     int ret = http.start();
diff --git a/src/test/rgw/rgw_multi/tests_az.py b/src/test/rgw/rgw_multi/tests_az.py
index 7ad708350dc..3d99a61b3b8 100644
--- a/src/test/rgw/rgw_multi/tests_az.py
+++ b/src/test/rgw/rgw_multi/tests_az.py
@@ -595,3 +595,14 @@ def test_az_versioning_support_in_zones():
     key_az = bucket_az.get_key("foo", version_id=obj_az_version_id)
     p19 = key_az.get_contents_as_string(encoding='ascii') == "zero"
     assert_equal(p19, True)
+
+
+def test_az_bilog_autotrim_refused_on_archive_zone():
+    """ bilog autotrim must refuse on an archive zone without --yes-i-really-mean-it """
+    _, az_zones = init_env()
+    az_zone = az_zones[0]
+    # a non-exporting (archive) zone forbids bucket-instance removal
+    _, retcode = az_zone.zone.cluster.admin(['bilog', 'autotrim'], check_retcode=False)
+    assert_not_equal(retcode, 0)
+    # the escape hatch still lets a user force it
+    az_zone.zone.cluster.admin(['bilog', 'autotrim', '--yes-i-really-mean-it'])