chore(deps): update docker.io/volkerraschek/helm docker tag to v4

The reposilite entrypoint chowns /app to 977:977 whenever it starts as root. The plugin container downloaded
the jar as its own image user (101), so after the first start the file was owned by 977:977 with mode 0644.
Since the plugins emptyDir survives a container restart within the same pod, a restarted plugin container
could no longer overwrite the existing jar and aborted with "Permission denied", which left the pod in a
permanent Init:CrashLoopBackOff until the pod itself was recreated.

Run the plugin container as 977:977 by default and expose the security context as
deployment.pluginContainer.securityContext, so it can be aligned when PUID/PGID are overridden.

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -271,7 +271,7 @@ spec:
 ### Deployment
 
 | Name                                                    | Description                                                                                                | Value                                       |
-| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
 | `deployment.annotations`                                | Additional deployment annotations.                                                                         | `{}`                                        |
 | `deployment.labels`                                     | Additional deployment labels.                                                                              | `{}`                                        |
 | `deployment.additionalContainers`                       | List of additional containers.                                                                             | `[]`                                        |
@@ -300,6 +300,8 @@ spec:
 | `deployment.pluginContainer.image.repository`           | Image repository, eg. `curlimages/curl`.                                                                   | `curlimages/curl`                           |
 | `deployment.pluginContainer.image.tag`                  | Custom image tag, eg. `0.1.0`.                                                                             | `8.22.0`                                    |
 | `deployment.pluginContainer.image.pullPolicy`           | Image pull policy.                                                                                         | `IfNotPresent`                              |
+| `deployment.pluginContainer.securityContext.runAsGroup` | Group id of the plugin container.                                                                          | `977`                                       |
+| `deployment.pluginContainer.securityContext.runAsUser`  | User id of the plugin container.                                                                           | `977`                                       |
 | `deployment.priorityClassName`                          | PriorityClassName of the Reposilite deployment.                                                            | `""`                                        |
 | `deployment.replicas`                                   | Number of replicas for the Reposilite deployment.                                                          | `1`                                         |
 | `deployment.restartPolicy`                              | Restart policy of the Reposilite deployment.                                                               | `""`                                        |

templates/_deployment.tpl

@@ -71,7 +71,11 @@
 {{- if eq (include "reposilite.plugins.prometheus.enabled" $) "true" }}
 {{- $fileName := splitList "/" (tpl .Values.config.plugins.prometheus.url $) | last }}
 {{- $individualArgs := concat $pluginContainerArgs (list "--output" $fileName (tpl .Values.config.plugins.prometheus.url $)) }}
-{{- $initContainers = concat $initContainers (list (dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts)) }}
+{{- $pluginContainer := dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts }}
+{{- with .Values.deployment.pluginContainer.securityContext }}
+{{- $_ := set $pluginContainer "securityContext" . }}
+{{- end }}
+{{- $initContainers = concat $initContainers (list $pluginContainer) }}
 {{- end }}
 
 {{ toYaml (dict "initContainers" $initContainers) }}

unittests/deployment/configPlugins.yaml

@@ -30,6 +30,9 @@ tests:
         - https://reposilite.com/plugins/prometheus.jar
         name: download-prometheus-plugin
         image: docker.io/curlimages/curl:0.1.0
+        securityContext:
+          runAsGroup: 977
+          runAsUser: 977
         volumeMounts:
         - mountPath: /app/data/plugins
           name: plugins

values.yaml

@@ -178,6 +178,15 @@ deployment:
       tag: "8.22.0"
       pullPolicy: IfNotPresent
 
+    ## @param deployment.pluginContainer.securityContext.runAsGroup Group id of the plugin container.
+    ## @param deployment.pluginContainer.securityContext.runAsUser User id of the plugin container.
+    # Reposilite chowns /app to 977:977 when its entrypoint starts as root. Downloading the plugin as a
+    # different user leaves behind a file the plugin container can no longer overwrite, which breaks every
+    # restart that reuses the emptyDir. Align this with PUID/PGID when those are overridden.
+    securityContext:
+      runAsGroup: 977
+      runAsUser: 977
+
   ## @param deployment.priorityClassName PriorityClassName of the Reposilite deployment.
   priorityClassName: ""