fix(collector): default fsGroup when volumeClaimTemplates are present

Collectors using persistent storage via volumeClaimTemplates can fail
with "permission denied" on PVC mounts when running as a non-root user
without fsGroup set. The mutating webhook now defaults
podSecurityContext.fsGroup to 65532 (the upstream collector image's
nonroot UID) when VCTs are present and no fsGroup is configured.

An explicitly set fsGroup is never overwritten.

Author: ozzywalsh

.chloggen/fix_fsgroup-default-vct.yaml

@@ -0,0 +1,20 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
+component: collector
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Collectors using persistent storage no longer fail with "permission denied" on volume mounts when running as a non-root user.
+
+# One or more tracking issues related to the change
+issues: [5836]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  The mutating webhook now defaults podSecurityContext.fsGroup to 65532 when
+  volumeClaimTemplates are present and no fsGroup is set. This ensures kubelet
+  chowns the PVC mount so the collector process can write to it. An explicitly
+  set fsGroup is never overwritten.

internal/webhook/collector_webhook.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation"
@@ -97,6 +98,16 @@ func (c CollectorWebhook) Default(_ context.Context, otelcol *v1beta1.OpenTeleme
 	if len(otelcol.Spec.ManagementState) == 0 {
 		otelcol.Spec.ManagementState = v1beta1.ManagementStateManaged
 	}
+	if len(otelcol.Spec.VolumeClaimTemplates) > 0 {
+		if otelcol.Spec.PodSecurityContext == nil {
+			otelcol.Spec.PodSecurityContext = &corev1.PodSecurityContext{}
+		}
+		if otelcol.Spec.PodSecurityContext.FSGroup == nil {
+			defaultFSGroup := int64(65532)
+			otelcol.Spec.PodSecurityContext.FSGroup = &defaultFSGroup
+		}
+	}
+
 	if featuregate.EnableOperandNetworkPolicy.IsEnabled() && otelcol.Spec.NetworkPolicy.Enabled == nil {
 		trueVal := true
 		otelcol.Spec.NetworkPolicy.Enabled = &trueVal

internal/webhook/collector_webhook_test.go

@@ -512,6 +512,99 @@ func TestCollectorDefaultingWebhook(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "StatefulSet with volumeClaimTemplates gets default fsGroup",
+			otelcol: v1beta1.OpenTelemetryCollector{
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode: v1beta1.ModeStatefulSet,
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+			expected: v1beta1.OpenTelemetryCollector{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{},
+				},
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode:            v1beta1.ModeStatefulSet,
+					UpgradeStrategy: v1beta1.UpgradeStrategyAutomatic,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						Replicas:        &one,
+						ManagementState: v1beta1.ManagementStateManaged,
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(65532)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "StatefulSet with volumeClaimTemplates preserves explicit fsGroup",
+			otelcol: v1beta1.OpenTelemetryCollector{
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode: v1beta1.ModeStatefulSet,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(1000)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+			expected: v1beta1.OpenTelemetryCollector{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{},
+				},
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode:            v1beta1.ModeStatefulSet,
+					UpgradeStrategy: v1beta1.UpgradeStrategyAutomatic,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						Replicas:        &one,
+						ManagementState: v1beta1.ManagementStateManaged,
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(1000)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 
 	bv := func(_ context.Context, collector v1beta1.OpenTelemetryCollector) admission.Warnings {