yeah i think this is more complex because of the sheer amount of external stuff that has to be brought in/persisted - will take a number of steps to get to the ideal state - but probably important that things get to a unified state together then have the relevant fixes happen iteratively bit by bit the helm-chart already appears to handle upgrade/changing UID/GID just fine as the initcontainers will just re-run and redo the permissions needed