[AutoOps] Allow overriding parts of the agent collector configuration via spec.config/configRef

config/crds/v1/all-crds.yaml

@@ -2648,6 +2648,30 @@ spec:
                       This field cannot be used in combination with `name`.
                     type: string
                 type: object
+              config:
+                description: |-
+                  Config holds additional OpenTelemetry collector configuration for the AutoOps agent.
+                  User-supplied settings are merged between the operator baseline defaults and the
+                  operator-owned mandatory settings, which always take final precedence. This allows
+                  tuning knobs such as the sending_queue sizing, appending custom metricbeat modules,
+                  or defining additional exporters and pipelines. Supplying at least one autoops_es
+                  module replaces the operator's built-in modules entirely, giving full control over
+                  which metricsets are collected and at what period. Elasticsearch connection details
+                  (hosts, SSL), OTLP endpoint and authorization, and the healthcheck extension are
+                  always injected by the operator and cannot be overridden.
+                  At most one of [`config`, `configRef`] can be specified.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              configRef:
+                description: |-
+                  ConfigRef references a Kubernetes Secret holding the AutoOps agent configuration
+                  under the `autoops_es.yml` key. Applies the same merge semantics as `config`.
+                  At most one of [`config`, `configRef`] can be specified.
+                properties:
+                  secretName:
+                    description: SecretName is the name of the secret.
+                    type: string
+                type: object
               image:
                 description: Image is the AutoOps Agent Docker image to deploy.
                 type: string

config/crds/v1/resources/autoops.k8s.elastic.co_autoopsagentpolicies.yaml

@@ -69,6 +69,30 @@ spec:
                       This field cannot be used in combination with `name`.
                     type: string
                 type: object
+              config:
+                description: |-
+                  Config holds additional OpenTelemetry collector configuration for the AutoOps agent.
+                  User-supplied settings are merged between the operator baseline defaults and the
+                  operator-owned mandatory settings, which always take final precedence. This allows
+                  tuning knobs such as the sending_queue sizing, appending custom metricbeat modules,
+                  or defining additional exporters and pipelines. Supplying at least one autoops_es
+                  module replaces the operator's built-in modules entirely, giving full control over
+                  which metricsets are collected and at what period. Elasticsearch connection details
+                  (hosts, SSL), OTLP endpoint and authorization, and the healthcheck extension are
+                  always injected by the operator and cannot be overridden.
+                  At most one of [`config`, `configRef`] can be specified.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              configRef:
+                description: |-
+                  ConfigRef references a Kubernetes Secret holding the AutoOps agent configuration
+                  under the `autoops_es.yml` key. Applies the same merge semantics as `config`.
+                  At most one of [`config`, `configRef`] can be specified.
+                properties:
+                  secretName:
+                    description: SecretName is the name of the secret.
+                    type: string
+                type: object
               image:
                 description: Image is the AutoOps Agent Docker image to deploy.
                 type: string

deploy/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml

@@ -2669,6 +2669,30 @@ spec:
                       This field cannot be used in combination with `name`.
                     type: string
                 type: object
+              config:
+                description: |-
+                  Config holds additional OpenTelemetry collector configuration for the AutoOps agent.
+                  User-supplied settings are merged between the operator baseline defaults and the
+                  operator-owned mandatory settings, which always take final precedence. This allows
+                  tuning knobs such as the sending_queue sizing, appending custom metricbeat modules,
+                  or defining additional exporters and pipelines. Supplying at least one autoops_es
+                  module replaces the operator's built-in modules entirely, giving full control over
+                  which metricsets are collected and at what period. Elasticsearch connection details
+                  (hosts, SSL), OTLP endpoint and authorization, and the healthcheck extension are
+                  always injected by the operator and cannot be overridden.
+                  At most one of [`config`, `configRef`] can be specified.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              configRef:
+                description: |-
+                  ConfigRef references a Kubernetes Secret holding the AutoOps agent configuration
+                  under the `autoops_es.yml` key. Applies the same merge semantics as `config`.
+                  At most one of [`config`, `configRef`] can be specified.
+                properties:
+                  secretName:
+                    description: SecretName is the name of the secret.
+                    type: string
+                type: object
               image:
                 description: Image is the AutoOps Agent Docker image to deploy.
                 type: string

docs/reference/api-reference/main.md

@@ -304,6 +304,8 @@ AutoOpsAgentPolicy represents an Elastic AutoOps Policy resource in a Kubernetes
 | *`podTemplate`* __[PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#podtemplatespec-v1-core)__ | PodTemplate provides customization options (labels, annotations, affinity rules, resource requests, and so on) for the Agent pods |
 | *`revisionHistoryLimit`* __integer__ | RevisionHistoryLimit is the number of revisions to retain to allow rollback in the underlying Deployment. |
 | *`serviceAccountName`* __string__ | ServiceAccountName is used to check access to Elasticsearch resources in different namespaces.<br>Can only be used if ECK is enforcing RBAC on references (--enforce-rbac-on-refs flag).<br>The service account must have "get" permission on elasticsearch.k8s.elastic.co/elasticsearches<br>in the target namespaces. |
+| *`config`* __[Config](#config)__ | Config holds additional OpenTelemetry collector configuration for the AutoOps agent.<br>User-supplied settings are merged between the operator baseline defaults and the<br>operator-owned mandatory settings, which always take final precedence. This allows<br>tuning knobs such as the sending_queue sizing, appending custom metricbeat modules,<br>or defining additional exporters and pipelines. Supplying at least one autoops_es<br>module replaces the operator's built-in modules entirely, giving full control over<br>which metricsets are collected and at what period. Elasticsearch connection details<br>(hosts, SSL), OTLP endpoint and authorization, and the healthcheck extension are<br>always injected by the operator and cannot be overridden.<br>At most one of [`config`, `configRef`] can be specified. |
+| *`configRef`* __[ConfigSource](#configsource)__ | ConfigRef references a Kubernetes Secret holding the AutoOps agent configuration<br>under the `autoops_es.yml` key. Applies the same merge semantics as `config`.<br>At most one of [`config`, `configRef`] can be specified. |
 
 
 ### AutoOpsRef  [#autoopsref]
@@ -539,6 +541,7 @@ Config represents untyped YAML configuration.
 :::{admonition} Appears In:
 * [AgentSpec](#agentspec)
 * [ApmServerSpec](#apmserverspec)
+* [AutoOpsAgentPolicySpec](#autoopsagentpolicyspec)
 * [BeatSpec](#beatspec)
 * [ElasticsearchConfigPolicySpec](#elasticsearchconfigpolicyspec)
 * [EnterpriseSearchSpec](#enterprisesearchspec)
@@ -576,6 +579,7 @@ ConfigSource references configuration settings.
 
 :::{admonition} Appears In:
 * [AgentSpec](#agentspec)
+* [AutoOpsAgentPolicySpec](#autoopsagentpolicyspec)
 * [BeatSpec](#beatspec)
 * [EnterpriseSearchSpec](#enterprisesearchspec)
 * [EnterpriseSearchSpec](#enterprisesearchspec)

pkg/apis/autoops/v1alpha1/autoopsagentpolicy_types.go

@@ -17,6 +17,8 @@ const (
 	Kind = "AutoOpsAgentPolicy"
 	// AutoOpsAgentContainerName is the name of the main AutoOps Agent container in the pod.
 	AutoOpsAgentContainerName = "autoops-agent"
+	// ConfigFileName is the key used in the Secret referenced by ConfigRef.
+	ConfigFileName = "autoops_es.yml"
 )
 
 // +kubebuilder:object:root=true
@@ -84,6 +86,26 @@ type AutoOpsAgentPolicySpec struct {
 	// in the target namespaces.
 	// +optional
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`
+
+	// Config holds additional OpenTelemetry collector configuration for the AutoOps agent.
+	// User-supplied settings are merged between the operator baseline defaults and the
+	// operator-owned mandatory settings, which always take final precedence. This allows
+	// tuning knobs such as the sending_queue sizing, appending custom metricbeat modules,
+	// or defining additional exporters and pipelines. Supplying at least one autoops_es
+	// module replaces the operator's built-in modules entirely, giving full control over
+	// which metricsets are collected and at what period. Elasticsearch connection details
+	// (hosts, SSL), OTLP endpoint and authorization, and the healthcheck extension are
+	// always injected by the operator and cannot be overridden.
+	// At most one of [`config`, `configRef`] can be specified.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:pruning:PreserveUnknownFields
+	Config *commonv1.Config `json:"config,omitempty"`
+
+	// ConfigRef references a Kubernetes Secret holding the AutoOps agent configuration
+	// under the `autoops_es.yml` key. Applies the same merge semantics as `config`.
+	// At most one of [`config`, `configRef`] can be specified.
+	// +kubebuilder:validation:Optional
+	ConfigRef *commonv1.ConfigSource `json:"configRef,omitempty"`
 }
 
 // AutoOpsRef defines a reference to a secret containing connection details for AutoOps via Cloud Connect.