I deployed an app though the GUI ( Duplicati from truecharts for obvious use case). After it was up I added extra volumes of type hostPath for the datasets I wanted to protect. I am guessing where I went wrong was the automatic permissions checkbox because all of the datasets I added appear to have had chown -R apps:app on them overwriting my previous permission layout. Is the way forward to be more robust in your ACL's or did I need to be more careful when setting up my app with the UID/GID and unchecking that automatic permission box when I add host storage?