fix(helm): chown the clickhouse volume to the configured run-as user, not a fixed uid

The volume-permissions init container hardcoded chown -R 101:101, ignoring clickhouse.securityContext.runAsUser/runAsGroup. Anyone who overrides the run-as user (e.g. for a restricted cluster policy) got a data directory owned by an account the server no longer runs as, so it failed to start on the adopted volume. Derive the uid/gid from securityContext (defaulting to 101). Also document the transient ReadWriteOnce multi-attach warning during the upgrade window so operators don't abort mid-migration.

Author: nicktrn

docs/self-hosting/kubernetes.mdx

@@ -124,6 +124,12 @@ The same move applies to the bundled PostgreSQL (`postgres-password`) and MinIO
 
 The bundled ClickHouse runs the official `clickhouse/clickhouse-server` image instead of the Bitnami subchart. The chart adopts your existing data volume automatically, with three caveats covered under [ClickHouse](#clickhouse) in external services: rendering without cluster access, pinned Bitnami image tags, and storage that doesn't support `fsGroup`.
 
+<Note>
+  The data volume is `ReadWriteOnce`, so during the upgrade the new ClickHouse pod may sit in
+  `ContainerCreating` with a multi-attach warning for a minute while the old pod still holds the
+  volume. This clears itself once the old pod is removed later in the same upgrade - don't abort.
+</Note>
+
 ## Configuration
 
 Most values map directly to the environment variables documented in the [webapp](/self-hosting/env/webapp) and [supervisor](/self-hosting/env/supervisor) environment variable overview.

hosting/k8s/helm/templates/clickhouse.yaml

@@ -78,7 +78,7 @@ spec:
         - name: volume-permissions
           image: "{{ .Values.global.imageRegistry | default .Values.clickhouse.volumePermissions.image.registry }}/{{ .Values.clickhouse.volumePermissions.image.repository }}:{{ .Values.clickhouse.volumePermissions.image.tag }}"
           imagePullPolicy: {{ .Values.clickhouse.volumePermissions.image.pullPolicy }}
-          command: ["sh", "-c", "chown -R 101:101 /var/lib/clickhouse"]
+          command: ["sh", "-c", "chown -R {{ .Values.clickhouse.securityContext.runAsUser | default 101 }}:{{ .Values.clickhouse.securityContext.runAsGroup | default 101 }} /var/lib/clickhouse"]
           securityContext:
             runAsUser: 0
             runAsNonRoot: false