Added pg_partman extension

[egkristi]

Following the template and Contribution instructions.
This is the pg_partman extension.
Closes #205

[gbartolini]

Thanks @egkristi for the contribution. However, as the contribution guide says, we need an issue to be created before the PR. Could you please do it and then link the PR to the issue? Thanks.

[tix79a]

Hello, any news about this extension ?

[gbartolini]

Yes!

[gbartolini]

Thanks for following this standard

[GabriFedi97]

We can keep bin_path as [] in case we agree on https://github.com/cloudnative-pg/postgres-extensions-containers/pull/159/changes#r3601885000

[gbartolini]

Do you think you can resolve the conflict?

Is it feasible to add a specific smoke test for the extension?

[duje-gradient]

Hi, any updates on when this extension will be released in an official image? It would be highly appreciated by the community as it saves teams from maintaining custom builds.

[GabriFedi97]

This python scripts have hard dependencies on python and psycopg2 so adding them straight to the /bin directory is not enough to have them working properly. The dependencies should be packaged as well in the extension container in a way they can be resolved by those scripts at runtime. As far as I understand, they are there mainly for maintenance operations and are not referenced directly by the extension. I'd rather avoid including them here as I believe the extension container should be kept as light as possible. Those scripts seem more client-side tools as they connect to Postgres over the network; they don't need to run inside the Postgres container at all. We can explore and document alternatives to execute them externally in a way they can run in a K8s env and target a CNPG Cluster.

[GabriFedi97]

I was able to execute the scripts externally via a Kubernetes Job created in the CNPG Cluster namespace. Leaving the Job definition as a POC:

apiVersion: batch/v1
kind: Job
metadata:
  name: partman-maint-poc
  namespace: <your-cluster-namespace>
  labels:
    app: partman-maint-poc
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app: partman-maint-poc
    spec:
      restartPolicy: Never
      containers:
      - name: maint
        image: python:3-slim
        # --- Connection info shared from the CNPG-generated app secret ---
        env:
        - name: DB_URI
          valueFrom: { secretKeyRef: { name: pg-partman-app, key: uri } }
        - name: PGHOST
          value: pg-partman-rw
        - name: PGPORT
          valueFrom: { secretKeyRef: { name: pg-partman-app, key: port } }
        - name: PGUSER
          valueFrom: { secretKeyRef: { name: pg-partman-app, key: username } }
        - name: PGPASSWORD
          valueFrom: { secretKeyRef: { name: pg-partman-app, key: password } }
        - name: PGDATABASE
          valueFrom: { secretKeyRef: { name: pg-partman-app, key: dbname } }
        # Verify the CNPG server cert against the cluster CA
        - name: PGSSLMODE
          value: verify-full
        - name: PGSSLROOTCERT
          value: /etc/ca/ca.crt
        volumeMounts:
        - name: ca
          mountPath: /etc/ca
          readOnly: true
        command: ["bash", "-c"]
        args:
        - |
          set -euo pipefail

          echo "### 1. Install dependencies"
          apt-get update && apt-get install -y --no-install-recommends curl
          pip install --root-user-action=ignore --no-cache-dir psycopg2-binary

          echo "### 2. Fetch the pg_partman maintenance scripts (v5.4.3)"
          mkdir -p /opt/partman && cd /opt/partman
          for s in check_unique_constraint dump_partition vacuum_maintenance; do
            curl -sfLO "https://raw.githubusercontent.com/pgpartman/pg_partman/v5.4.3/bin/common/$s.py" \
            || curl -sfLO "https://raw.githubusercontent.com/pgpartman/pg_partman/v5.4.3/bin/$s.py"
          done
          chmod +x ./*.py
          ls -l ./*.py

          echo "### 3. Prove the scripts run (deps satisfied)"
          python vacuum_maintenance.py --help

          echo "### 4. Best-effort real run against the cluster"
          python vacuum_maintenance.py -c "$DB_URI" --all \
            && echo "vacuum_maintenance completed" \
            || echo "NOTE: script ran but exited non-zero (likely partman privileges/config) — mechanism is proven"

          echo "### DONE"
      volumes:
      - name: ca
        secret:
          secretName: pg-partman-ca

To make it work properly I had to grant the app user the permissions to the part_config and part_config_sub tables:

GRANT ALL PRIVILEGES ON TABLE part_config, part_config_sub TO app;

This is merely a POC to show the approach. We can revisit the details in case we agree on the proposal.

[GabriFedi97]

This section would have to change to document the alternative way to execute the scripts in case we agree on https://github.com/cloudnative-pg/postgres-extensions-containers/pull/159/changes#r3601885000.

[GabriFedi97]

We can keep bin_path as [] in case we agree on https://github.com/cloudnative-pg/postgres-extensions-containers/pull/159/changes#r3601885000