fix(helm): make the clickhouse chown init idempotent so it doesn't re-walk on every restart

Because the adopted-volume condition stays true for the life of the release, the ownership init container runs on every pod restart, and an unconditional recursive chown re-walks the whole database each time - minutes of delay on large or network-backed data. Skip the chown when the volume root is already owned by the run-as user (mirroring fsGroupChangePolicy: OnRootMismatch), so only the first mount after adoption pays the cost.

Author: nicktrn

hosting/k8s/helm/templates/clickhouse.yaml

@@ -78,7 +78,12 @@ spec:
         - name: volume-permissions
           image: "{{ .Values.global.imageRegistry | default .Values.clickhouse.volumePermissions.image.registry }}/{{ .Values.clickhouse.volumePermissions.image.repository }}:{{ .Values.clickhouse.volumePermissions.image.tag }}"
           imagePullPolicy: {{ .Values.clickhouse.volumePermissions.image.pullPolicy }}
-          command: ["sh", "-c", "chown -R {{ .Values.clickhouse.securityContext.runAsUser | default 101 }}:{{ .Values.clickhouse.securityContext.runAsGroup | default 101 }} /var/lib/clickhouse"]
+          {{- $chownUser := .Values.clickhouse.securityContext.runAsUser | default 101 }}
+          {{- $chownGroup := .Values.clickhouse.securityContext.runAsGroup | default 101 }}
+          {{- /* Idempotent: skip the recursive chown when the volume root is already
+                 owned by the run-as user, so it doesn't re-walk the whole database on
+                 every restart (only the first mount after adoption pays the cost). */}}
+          command: ["sh", "-c", "test \"$(stat -c %u /var/lib/clickhouse)\" = \"{{ $chownUser }}\" || chown -R {{ $chownUser }}:{{ $chownGroup }} /var/lib/clickhouse"]
           securityContext:
             runAsUser: 0
             runAsNonRoot: false