fix(helm): auto-run the clickhouse chown init when adopting a bitnami volume

Upgrading the bundled ClickHouse from the Bitnami subchart to the official image adopts the old data volume, whose files are owned by the previous uid. The official server runs non-root (uid 101), so on storage where fsGroup can't relabel the volume (hostPath, NFS, local-path - common for self-hosters) it crashes with 'cd: /var/lib/clickhouse/data/: Permission denied'. Run the one-time chown init automatically whenever a volume is adopted (existingClaim set, explicitly or auto-detected); fresh installs create their own data and skip it, and volumePermissions.enabled still forces it. Verified live in kind: a bitnami->official upgrade on local-path storage now comes up with data and auth intact, with no manual flag.

Author: nicktrn

docs/self-hosting/kubernetes.mdx

@@ -345,9 +345,11 @@ redis:
 </Note>
 
 <Note>
-  On storage that doesn't support `fsGroup` ownership changes (for example NFS or hostPath), set
-  `clickhouse.volumePermissions.enabled: true` so a one-time init container fixes the data
-  volume's ownership for the non-root ClickHouse server.
+  When a volume is adopted from the Bitnami-based chart, a one-time init container fixes its
+  ownership for the non-root ClickHouse server. This runs automatically on `helm upgrade` (and
+  when you set `clickhouse.persistence.existingClaim`), so storage that doesn't support `fsGroup`
+  ownership changes (NFS, hostPath, local-path) works without manual steps. Set
+  `clickhouse.volumePermissions.enabled: true` to force it in other cases.
 </Note>
 
 **Direct configuration:**

hosting/k8s/helm/templates/clickhouse.yaml

@@ -68,7 +68,12 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.clickhouse.volumePermissions.enabled }}
+      {{- /* Adopting a volume from the Bitnami-based chart (auto-detected or an
+             explicit existingClaim) means the data is owned by the old uid. On
+             storage where fsGroup can't relabel it (hostPath, NFS, local-path),
+             the non-root server can't read it, so run the chown init container
+             automatically. Fresh installs create their own data and skip it. */}}
+      {{- if or .Values.clickhouse.volumePermissions.enabled $existingClaim }}
       initContainers:
         - name: volume-permissions
           image: "{{ .Values.global.imageRegistry | default .Values.clickhouse.volumePermissions.image.registry }}/{{ .Values.clickhouse.volumePermissions.image.repository }}:{{ .Values.clickhouse.volumePermissions.image.tag }}"