fix: add SELinux relabel init container for persistent volumes (#41)

Kubernetes may assign MCS categories to volumes that differ from the
pod's SELinux level, making data inaccessible (EACCES on mkdir/read).
This is unavoidable with shared PVCs where the kubelet relabels
volumes with random categories on each pod creation.

Adds a privileged init container that runs chcon -R on the data mount
before the app starts, ensuring labels always match the pod's context.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

internal/resources/statefulset.go

@@ -63,6 +63,31 @@ func BuildStatefulSet(instance *paperclipv1alpha1.Instance, extraPodAnnotations
 		podSpec.TopologySpreadConstraints = instance.Spec.Availability.TopologySpreadConstraints
 	}
 
+	// SELinux relabel init container: ensures the data volume labels match
+	// the pod's SELinux context. Required because Kubernetes may assign MCS
+	// categories to the volume that differ from the pod's level, making
+	// the data inaccessible. Runs as privileged to perform chcon.
+	if instance.Spec.Storage.Persistence.Enabled {
+		seLevel := "s0"
+		if instance.Spec.Security.PodSecurityContext != nil &&
+			instance.Spec.Security.PodSecurityContext.SELinuxOptions != nil &&
+			instance.Spec.Security.PodSecurityContext.SELinuxOptions.Level != "" {
+			seLevel = instance.Spec.Security.PodSecurityContext.SELinuxOptions.Level
+		}
+		podSpec.InitContainers = append(podSpec.InitContainers, corev1.Container{
+			Name:    "selinux-relabel",
+			Image:   "fedora:latest",
+			Command: []string{"chcon", "-R", "system_u:object_r:container_file_t:" + seLevel, DataMountPath},
+			VolumeMounts: []corev1.VolumeMount{
+				{Name: DataVolumeName, MountPath: DataMountPath},
+			},
+			SecurityContext: &corev1.SecurityContext{
+				Privileged: Ptr(true),
+				RunAsUser:  Ptr(int64(0)),
+			},
+		})
+	}
+
 	// Onboarding init container: runs non-interactive setup and admin bootstrap
 	// before the server starts. Only runs when config doesn't exist yet.
 	podSpec.InitContainers = append(podSpec.InitContainers, buildOnboardInitContainer(instance))