turns out it was important

apps/recipes/deployment.yaml

@@ -18,6 +18,47 @@ spec:
     spec:
       restartPolicy: Always
       initContainers:
+      - name: init-chmod-data
+        env:
+          - name: SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: recipes
+                key: secret-key
+          - name: DB_ENGINE
+            value: django.db.backends.sqlite3
+        image: recipes
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: 250m
+            memory: 64Mi
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          source venv/bin/activate
+          echo "Updating database"
+          python manage.py migrate
+          python manage.py collectstatic_js_reverse
+          python manage.py collectstatic --noinput
+          echo "Setting media file attributes"
+          chown -R 65534:65534 /opt/recipes/mediafiles
+          find /opt/recipes/mediafiles -type d | xargs -r chmod 755
+          find /opt/recipes/mediafiles -type f | xargs -r chmod 644
+          echo "Done"
+        securityContext:
+          runAsUser: 0
+        volumeMounts:
+        - mountPath: /opt/recipes/mediafiles
+          name: media
+          # mount as subPath due to lost+found on ext4 pvc
+          subPath: files
+        - mountPath: /opt/recipes/staticfiles
+          name: static
+          # mount as subPath due to lost+found on ext4 pvc
+          subPath: files
       containers:
       - name: recipes-nginx
         image: nginx:latest
@@ -88,7 +129,7 @@ spec:
             subPath: files
         env:
           - name: DEBUG
-            value: "1"
+            value: "0"
           - name: ALLOWED_HOSTS
             value: '*'
           - name: SECRET_KEY