Add pgaudit Extension Support with Automated CI/CD Infrastructure

.github/workflows/build-pgaudit.yml

@@ -0,0 +1,205 @@
+name: Build pgaudit Extension
+
+on:
+  push:
+    paths:
+      - 'pgaudit/**'
+  workflow_call:
+    inputs:
+      pgaudit-version:
+        required: true
+        type: string
+      pg-version:
+        required: false
+        type: string
+        default: "18"
+      distro:
+        required: false
+        type: string
+        default: "bookworm"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Clone pgaudit source
+        if: github.event_name == 'workflow_call'
+        run: |
+          git clone https://github.com/pgaudit/pgaudit.git pgaudit/source
+          cd pgaudit/source
+          git checkout ${{ inputs.pgaudit-version }}
+
+      - name: Get latest pgaudit version for push
+        if: github.event_name == 'push'
+        id: version
+        run: |
+          LATEST=$(curl -s https://api.github.com/repos/pgaudit/pgaudit/releases/latest | jq -r '.tag_name')
+          echo "version=${LATEST}" >> $GITHUB_OUTPUT
+          git clone https://github.com/pgaudit/pgaudit.git pgaudit/source
+          cd pgaudit/source
+          git checkout ${LATEST}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        run: |
+          cd pgaudit
+          PGAUDIT_VER="${{ inputs.pgaudit-version || steps.version.outputs.version }}"
+
+          # Choose target and set variables based on branch
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            # Build all combinations for main branch
+            REGISTRY="ghcr.io/${{ github.repository_owner }}" \
+            PGAUDIT_VERSION="${PGAUDIT_VER}" \
+            docker buildx bake \
+              --set "*.context=source" \
+              --set "*.args.PGAUDIT_VERSION=${PGAUDIT_VER}" \
+              pgaudit-all \
+              --push
+          else
+            # Build single combination for feature branch
+            TARGET="pgaudit-feature"
+            REGISTRY="ghcr.io/${{ github.repository_owner }}" \
+            PG_VERSION="${{ inputs.pg-version || '18' }}" \
+            DISTRO="${{ inputs.distro || 'bookworm' }}" \
+            PGAUDIT_VERSION="${PGAUDIT_VER}" \
+            BRANCH_NAME="${{ github.ref_name }}" \
+            docker buildx bake \
+              --set pgaudit-feature.context=source \
+              --set "*.args.PG_VERSION=${{ inputs.pg-version || '18' }}" \
+              --set "*.args.DISTRO=${{ inputs.distro || 'bookworm' }}" \
+              --set "*.args.PGAUDIT_VERSION=${PGAUDIT_VER}" \
+              ${TARGET} \
+              --push
+          fi
+
+  smoke-test:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get version from build
+        id: get-version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_call" ]; then
+            echo "version=${{ inputs.pgaudit-version }}" >> $GITHUB_OUTPUT
+          else
+            LATEST=$(curl -s https://api.github.com/repos/pgaudit/pgaudit/releases/latest | jq -r '.tag_name')
+            echo "version=${LATEST}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Kind Cluster
+        uses: helm/kind-action@v1
+        with:
+          version: v0.30.0
+          kubectl_version: v1.34.0
+          node_image: kindest/node:v1.34.0
+          config: kind-config.yaml
+
+
+      # - name: Check Kind Cluster Status
+      #   run: |
+      #     echo "Kind cluster 'kind' is ready."
+      #     kubectl cluster-info
+      #     kubectl get nodes
+
+      - name: Install CloudNativePG Operator
+        run: |
+          # Get latest CNPG release
+          CNPG_VERSION=$(curl -s https://api.github.com/repos/cloudnative-pg/cloudnative-pg/releases/latest | jq -r '.tag_name')
+          echo "Installing CloudNativePG operator version: ${CNPG_VERSION}"
+
+          # Extract version without 'v' prefix for branch name
+          BRANCH_VERSION=$(echo ${CNPG_VERSION} | sed 's/^v//' | cut -d. -f1,2)
+
+          # Install CNPG operator using correct URL format
+          kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${BRANCH_VERSION}/releases/cnpg-${CNPG_VERSION#v}.yaml
+
+      - name: Verify CNPG Operator Installation
+        run: |
+          # Wait for operator deployment to be ready
+          kubectl wait --for=condition=Available deployment/cnpg-controller-manager -n cnpg-system --timeout=120s
+
+          # Check operator status
+          kubectl get pods -n cnpg-system
+          kubectl get deployment -n cnpg-system
+
+          # Verify CRDs are installed
+          kubectl get crd | grep postgresql
+
+          echo "✅ CloudNativePG operator installed successfully"
+
+      - name: Create Postgres Cluster with Extension
+        run: |
+          PG_VER="${{ inputs.pg-version || '18' }}"
+          DISTRO="${{ inputs.distro || 'bookworm' }}"
+          PGAUDIT_VER="${{ steps.get-version.outputs.version }}"
+
+          # Set image tag based on branch
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            IMAGE_TAG="ghcr.io/${{ github.repository_owner }}/pgaudit:${PG_VER}-${PGAUDIT_VER}-${DISTRO}"
+          else
+            IMAGE_TAG="ghcr.io/${{ github.repository_owner }}/pgaudit:${PG_VER}-${PGAUDIT_VER}-${{ github.ref_name }}-${DISTRO}"
+          fi
+
+          echo "Testing with image: ${IMAGE_TAG}"
+
+          # Create test pod with pgaudit extension
+          kubectl apply -f - <<EOF
+          apiVersion: postgresql.cnpg.io/v1
+          kind: Cluster
+          metadata:
+            name: postgresql-with-extensions
+            namespace: cnpg-system
+          spec:
+            instances: 1
+            imageName: ghcr.io/cloudnative-pg/postgresql:${PG_VER}-${DISTRO}
+            postgresql:
+              extensions:
+                - name: pgaudit
+                  image:
+                    reference: ${IMAGE_TAG}
+            storage:
+              storageClass: standard
+              size: 1Gi
+          EOF
+          kubectl wait --for=jsonpath='{.status.phase}=Cluster in healthy state' cluster/postgresql-with-extensions --timeout=300s -n cnpg-system
+          echo "✅ PostgreSQL cluster with pgaudit extension is ready"
+
+      - name: Verify pgaudit Extension
+        run: |
+          EXTENSION_NAME="pgaudit"
+          NAMESPACE="cnpg-system"
+          POD_NAME="postgresql-with-extensions-1"
+          CONTAINER_NAME="postgres"
+
+          echo "🔍 Checking if ${EXTENSION_NAME} extension is available..."
+
+          # Wait a bit for the extension to be fully loaded
+          sleep 10
+
+          # Check if extension is available in pg_available_extensions
+          if kubectl exec "$POD_NAME" -n "$NAMESPACE" -c "$CONTAINER_NAME" -- sh -c \
+             "psql -U postgres -d postgres -t -c \"SELECT name FROM pg_available_extensions WHERE name = '$EXTENSION_NAME';\"" | \
+             grep -q "$EXTENSION_NAME"; then
+              echo "✅ Success! The '$EXTENSION_NAME' extension is available."
+          else
+              echo "❌ Failure! The '$EXTENSION_NAME' extension was NOT found in pg_available_extensions."
+          fi
+
+      - name: Tag successful build
+        if: success() && github.ref == 'refs/heads/main'
+        run: |
+          git tag "pgaudit-${{ steps.get-version.outputs.version }}"
+          git push origin "pgaudit-${{ steps.get-version.outputs.version }}"

.github/workflows/pgaudit-release-monitor.yml

@@ -0,0 +1,39 @@
+name: Monitor pgaudit Releases
+
+on:
+  schedule:
+    - cron: '0 2 * * *'  # Daily at 2 AM UTC
+  workflow_dispatch:
+
+jobs:
+  check-release:
+    runs-on: ubuntu-latest
+    outputs:
+      new-version: ${{ steps.check.outputs.new-version }}
+      should-build: ${{ steps.check.outputs.should-build }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for new pgaudit release
+        id: check
+        run: |
+          # Get latest release from GitHub API
+          LATEST=$(curl -s https://api.github.com/repos/pgaudit/pgaudit/releases/latest | jq -r '.tag_name')
+
+          # Check if we already built this version
+          if git tag | grep -q "pgaudit-${LATEST}"; then
+            echo "Version ${LATEST} already built"
+            echo "should-build=false" >> $GITHUB_OUTPUT
+          else
+            echo "New version found: ${LATEST}"
+            echo "new-version=${LATEST}" >> $GITHUB_OUTPUT
+            echo "should-build=true" >> $GITHUB_OUTPUT
+          fi
+
+  build-and-test:
+    needs: check-release
+    if: needs.check-release.outputs.should-build == 'true'
+    uses: ./.github/workflows/build-pgaudit.yml
+    with:
+      pgaudit-version: ${{ needs.check-release.outputs.new-version }}
+    secrets: inherit

README.md

@@ -20,8 +20,7 @@ in CloudNativePG.
 
 ## Supported Extensions
 
-Currently: **none**.
-This repository lays the foundation for packaging extensions going forward.
+- **pgaudit** - PostgreSQL Audit Extension for detailed session and object audit logging
 
 ---
 

kind-config.yaml

@@ -0,0 +1,4 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+featureGates:
+  ImageVolume: true

pgaudit/Dockerfile

@@ -0,0 +1,20 @@
+FROM ghcr.io/cloudnative-pg/postgresql:18-minimal-bookworm AS builder
+
+USER 0
+
+COPY . /tmp/pgaudit
+
+RUN set -eux; \
+	mkdir -p /opt/extension && \
+	apt-get update && \
+	apt-get install -y --no-install-recommends build-essential git "postgresql-server-dev-18=18*" libkrb5-dev libxml2-dev && \
+	cd /tmp/pgaudit && \
+	git checkout REL_18_STABLE && \
+	PG_CONFIG=/usr/lib/postgresql/18/bin/pg_config USE_PGXS=1 make clean && \
+	PG_CONFIG=/usr/lib/postgresql/18/bin/pg_config USE_PGXS=1 OPTFLAGS="" make && \
+	PG_CONFIG=/usr/lib/postgresql/18/bin/pg_config USE_PGXS=1 make install datadir=/opt/extension/share/ pkglibdir=/opt/extension/lib/
+
+FROM scratch
+
+COPY --from=builder /opt/extension/lib/ /lib/
+COPY --from=builder /opt/extension/share/ /share/

pgaudit/README.md

@@ -0,0 +1,44 @@
+# pgaudit Extension
+
+PostgreSQL Audit Extension for detailed session and object audit logging.
+
+## Supported Versions
+
+| PostgreSQL | pgaudit | Distros | Status |
+|------------|---------|---------|--------|
+| 18         | 18.0    | bookworm, trixie | ✅ Active |
+
+## Usage
+
+### PostgreSQL 18
+```yaml
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres-with-pgaudit
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:18-bookworm
+  postgresql:
+    extensions:
+      - name: pgaudit
+        image:
+          reference: ghcr.io/cloudnative-pg/pgaudit:18-18.0-bookworm
+    parameters:
+      shared_preload_libraries: "pgaudit"
+      pgaudit.log: "all"
+  storage:
+    size: 1Gi
+```
+
+
+
+## Available Images
+
+- `ghcr.io/cloudnative-pg/pgaudit:18-18.0-bookworm`
+- `ghcr.io/cloudnative-pg/pgaudit:18-18.0-trixie`
+
+## Links
+
+- [pgaudit Documentation](https://github.com/pgaudit/pgaudit)
+- [CloudNativePG Extensions Guide](https://cloudnative-pg.io/documentation/current/imagevolume_extensions/)