fix(collector): default fsGroup when volumeClaimTemplates are present

.chloggen/fix_fsgroup-default-vct.yaml

@@ -0,0 +1,20 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
+component: collector
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Collectors using persistent storage no longer fail with "permission denied" on volume mounts when running as a non-root user.
+
+# One or more tracking issues related to the change
+issues: [5836]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  The mutating webhook now defaults podSecurityContext.fsGroup to 65532 when
+  volumeClaimTemplates are present and no fsGroup is set. This ensures kubelet
+  chowns the PVC mount so the collector process can write to it. An explicitly
+  set fsGroup is never overwritten.

internal/webhook/collector_webhook.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/go-logr/logr"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation"
@@ -100,6 +101,16 @@ func (c CollectorWebhook) Default(_ context.Context, otelcol *v1beta1.OpenTeleme
 	if len(otelcol.Spec.ManagementState) == 0 {
 		otelcol.Spec.ManagementState = v1beta1.ManagementStateManaged
 	}
+	if len(otelcol.Spec.VolumeClaimTemplates) > 0 {
+		if otelcol.Spec.PodSecurityContext == nil {
+			otelcol.Spec.PodSecurityContext = &corev1.PodSecurityContext{}
+		}
+		if otelcol.Spec.PodSecurityContext.FSGroup == nil {
+			defaultFSGroup := int64(65532)
+			otelcol.Spec.PodSecurityContext.FSGroup = &defaultFSGroup
+		}
+	}
+
 	if featuregate.EnableOperandNetworkPolicy.IsEnabled() && otelcol.Spec.NetworkPolicy.Enabled == nil {
 		trueVal := true
 		otelcol.Spec.NetworkPolicy.Enabled = &trueVal

internal/webhook/collector_webhook_test.go

@@ -517,6 +517,99 @@ func TestCollectorDefaultingWebhook(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "StatefulSet with volumeClaimTemplates gets default fsGroup",
+			otelcol: v1beta1.OpenTelemetryCollector{
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode: v1beta1.ModeStatefulSet,
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+			expected: v1beta1.OpenTelemetryCollector{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{},
+				},
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode:            v1beta1.ModeStatefulSet,
+					UpgradeStrategy: v1beta1.UpgradeStrategyAutomatic,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						Replicas:        &one,
+						ManagementState: v1beta1.ManagementStateManaged,
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(65532)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "StatefulSet with volumeClaimTemplates preserves explicit fsGroup",
+			otelcol: v1beta1.OpenTelemetryCollector{
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode: v1beta1.ModeStatefulSet,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(1000)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+			expected: v1beta1.OpenTelemetryCollector{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{},
+				},
+				Spec: v1beta1.OpenTelemetryCollectorSpec{
+					Mode:            v1beta1.ModeStatefulSet,
+					UpgradeStrategy: v1beta1.UpgradeStrategyAutomatic,
+					OpenTelemetryCommonFields: v1beta1.OpenTelemetryCommonFields{
+						Replicas:        &one,
+						ManagementState: v1beta1.ManagementStateManaged,
+						PodSecurityContext: &v1.PodSecurityContext{
+							FSGroup: ptr.To(int64(1000)),
+						},
+					},
+					StatefulSetCommonFields: v1beta1.StatefulSetCommonFields{
+						VolumeClaimTemplates: []v1.PersistentVolumeClaim{
+							{
+								ObjectMeta: metav1.ObjectMeta{Name: "storage"},
+								Spec: v1.PersistentVolumeClaimSpec{
+									AccessModes: []v1.PersistentVolumeAccessMode{v1.ReadWriteOnce},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 
 	bv := func(_ context.Context, collector v1beta1.OpenTelemetryCollector) admission.Warnings {