From 1543a248a4bba5edc52dc2f9a9f330b95a896aa8 Mon Sep 17 00:00:00 2001 From: Oguzhan Ozmen Date: Fri, 17 Jul 2026 19:08:23 +0000 Subject: [PATCH] rgw/admin: guard bilog autotrim on non-exporting (archive) zones The background sync-log-trim thread already skips bucket trim on zones whose sync module does not export data , but the admin command had no equivalent guard, so running it on an archive zone could delete instance metadata the zone is meant to retain. So, refuse the command on non-exporting zones unless --yes-i-really-mean-it is given. Fixes: https://tracker.ceph.com/issues/78364 Signed-off-by: Oguzhan Ozmen --- src/rgw/radosgw-admin/radosgw-admin.cc | 13 +++++++++++++ src/test/rgw/rgw_multi/tests_az.py | 11 +++++++++++ 2 files changed, 24 insertions(+) diff --git a/src/rgw/radosgw-admin/radosgw-admin.cc b/src/rgw/radosgw-admin/radosgw-admin.cc index eb174f43f876..4d294e685011 100644 --- a/src/rgw/radosgw-admin/radosgw-admin.cc +++ b/src/rgw/radosgw-admin/radosgw-admin.cc @@ -11431,6 +11431,19 @@ next: } if (opt_cmd == OPT::BILOG_AUTOTRIM) { + // The background sync-log-trim thread only runs bucket trim on zones whose + // sync module exports data. Non-exporting zones (e.g. archive) deliberately + // forbid bucket-instance removal. Likewise, here, we add the same guard for + // user triggered auto-trim. + if (!static_cast(driver)->svc()->zone->sync_module_exports_data() && + !yes_i_really_mean_it) { + cerr << "This zone's sync module does not export data (e.g. an archive zone). " + "bilog autotrim can remove bucket instance metadata that this zone type " + "is meant to retain.\n" + "do you really mean it? (requires --yes-i-really-mean-it)" << std::endl; + return EPERM; + } + RGWCoroutinesManager crs(driver->ctx(), driver->get_cr_registry()); RGWHTTPManager http(driver->ctx(), crs.get_completion_mgr()); int ret = http.start(); diff --git a/src/test/rgw/rgw_multi/tests_az.py b/src/test/rgw/rgw_multi/tests_az.py index 7ad708350dc5..3d99a61b3b8a 100644 --- a/src/test/rgw/rgw_multi/tests_az.py +++ b/src/test/rgw/rgw_multi/tests_az.py @@ -595,3 +595,14 @@ def test_az_versioning_support_in_zones(): key_az = bucket_az.get_key("foo", version_id=obj_az_version_id) p19 = key_az.get_contents_as_string(encoding='ascii') == "zero" assert_equal(p19, True) + + +def test_az_bilog_autotrim_refused_on_archive_zone(): + """ bilog autotrim must refuse on an archive zone without --yes-i-really-mean-it """ + _, az_zones = init_env() + az_zone = az_zones[0] + # a non-exporting (archive) zone forbids bucket-instance removal + _, retcode = az_zone.zone.cluster.admin(['bilog', 'autotrim'], check_retcode=False) + assert_not_equal(retcode, 0) + # the escape hatch still lets a user force it + az_zone.zone.cluster.admin(['bilog', 'autotrim', '--yes-i-really-mean-it']) -- 2.47.3