diff --git a/.github/ci/cr.yaml b/.github/ci/cr.yaml
index cf0773377..5eb50afb1 100644
--- a/.github/ci/cr.yaml
+++ b/.github/ci/cr.yaml
@@ -1,3 +1,3 @@
 skip-existing: true
 generate-release-notes: false
-release-notes-file: RELEASE_NOTES.md
+release-notes-file: RELEASE_NOTES
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 095568656..8a18635e4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -91,7 +91,7 @@ jobs:
                 yq -M -i '.annotations["artifacthub.io/changes"] = (load_str(strenv(CHANGELOG)) | capture("## Next release[\s]*(?P<changes>[\s\S]*?)[\s]*##") | .changes | split("\n") | .[] |= sub("^[\s]*-[\s]+", "") | filter(length > 0) | to_yaml)' $CHART_FILE
 
                 # Create release notes
-                cat <<EOT > ${CHART_DIR}/RELEASE_NOTES.md
+                cat <<EOT > ${CHART_DIR}/RELEASE_NOTES
           # Release notes for version $CHART_VERSION
 
           $RELEASE_DATE
@@ -108,7 +108,7 @@ jobs:
           done
 
       - name: Release
-        if: ${{ hashFiles('charts/*/RELEASE_NOTES.md') != '' }}
+        if: ${{ hashFiles('charts/*/RELEASE_NOTES') != '' }}
         uses: helm/chart-releaser-action@v1.6.0
         env:
           CR_TOKEN: "${{ secrets.VM_BOT_GH_TOKEN }}"
@@ -116,7 +116,7 @@ jobs:
           config: .github/ci/cr.yaml
 
       - name: Release OCI
-        if: ${{ hashFiles('charts/*/RELEASE_NOTES.md') != '' }}
+        if: ${{ hashFiles('charts/*/RELEASE_NOTES') != '' }}
         run: |
           helm registry login \
             -u ${{ github.actor }} \
@@ -124,7 +124,7 @@ jobs:
             ghcr.io
           mkdir -p .cr-release-packages
           for chart in charts/*; do
-            if [ ! -f $chart/RELEASE_NOTES.md ]; then
+            if [ ! -f $chart/RELEASE_NOTES ]; then
               echo "no release notes for chart $chart. removing it from uploading..."
               rm -rf .cr-release-packages/$(basename $chart)*
             fi
@@ -132,9 +132,9 @@ jobs:
           find .cr-release-packages -name "*.tgz" -exec helm push {} oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/helm-charts \;
 
       - name: Automatic update changelogs and readme
-        if: ${{ hashFiles('charts/*/RELEASE_NOTES.md') != '' }}
+        if: ${{ hashFiles('charts/*/RELEASE_NOTES') != '' }}
         run: |
-          rm -rf charts/*/RELEASE_NOTES.md
+          rm -rf charts/*/RELEASE_NOTES
           export VM_GIT_BRANCH_NAME="changelog-update-$(date +%s)"
           git checkout -b "${VM_GIT_BRANCH_NAME}"
           git add charts/*/CHANGELOG.md
diff --git a/charts/victoria-metrics-distributed/CHANGELOG.md b/charts/victoria-metrics-distributed/CHANGELOG.md
index cc7f0a2ec..d5f205b8f 100644
--- a/charts/victoria-metrics-distributed/CHANGELOG.md
+++ b/charts/victoria-metrics-distributed/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## Next release
 
+- upgraded operator, it's required to [update CRDs manually](../victoriametrics-k8s-stack/#upgrade-guide)
 - bump version of VM components to [v1.108.1](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.108.1)
 - Exclude markdown files from package
 
diff --git a/charts/victoria-metrics-distributed/Chart.lock b/charts/victoria-metrics-distributed/Chart.lock
index 78c761003..691638236 100644
--- a/charts/victoria-metrics-distributed/Chart.lock
+++ b/charts/victoria-metrics-distributed/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
   version: 0.0.35
 - name: victoria-metrics-k8s-stack
   repository: https://victoriametrics.github.io/helm-charts
-  version: 0.31.2
-digest: sha256:8aea0e33f8476426a515ac680920ec0fe1c746dcf9bc52036fa0ec85c3216d45
-generated: "2024-12-17T20:40:43.627868213Z"
+  version: 0.33.0
+digest: sha256:7568dd9bf5e761a36ebd8c41a0397d1eaaf859bdab53b644e535a64928f17653
+generated: "2024-12-19T23:14:43.949215+02:00"
diff --git a/charts/victoria-metrics-distributed/Chart.yaml b/charts/victoria-metrics-distributed/Chart.yaml
index 01f17f808..e949858d3 100644
--- a/charts/victoria-metrics-distributed/Chart.yaml
+++ b/charts/victoria-metrics-distributed/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: victoria-metrics-distributed
 description: A Helm chart for Running VMCluster on Multiple Availability Zones
 type: application
-version: 0.6.2
+version: 0.7.0
 appVersion: "v1.108.1"
 sources:
   - https://github.com/VictoriaMetrics/helm-charts
@@ -36,6 +36,6 @@ dependencies:
     version: "0.0.*"
     repository: https://victoriametrics.github.io/helm-charts
   - name: victoria-metrics-k8s-stack
-    version: "0.31.*"
+    version: "0.33.*"
     repository: https://victoriametrics.github.io/helm-charts
     condition: victoria-metrics-k8s-stack.enabled
diff --git a/charts/victoria-metrics-distributed/README.md b/charts/victoria-metrics-distributed/README.md
index 3a826e4f2..8c32ba3ad 100644
--- a/charts/victoria-metrics-distributed/README.md
+++ b/charts/victoria-metrics-distributed/README.md
@@ -1,4 +1,4 @@
-![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 0.6.2](https://img.shields.io/badge/Version-0.6.2-informational?style=flat-square)
+![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/victoriametrics)](https://artifacthub.io/packages/helm/victoriametrics/victoria-metrics-distributed)
 [![Slack](https://img.shields.io/badge/join%20slack-%23victoriametrics-brightgreen.svg)](https://slack.victoriametrics.com/)
 
diff --git a/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-balancer.yaml b/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-balancer.yaml
index 8451ae31d..4467b1ca3 100644
--- a/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-balancer.yaml
+++ b/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-balancer.yaml
@@ -20,17 +20,18 @@ metadata:
   {{- with $zone.read.perZone.vmauth.annotations }}
   annotations: {{ toYaml . | nindent 4 }}
   {{- end  }}
-spec: {{ tpl (toYaml (omit $zone.read.perZone.vmauth.spec "unauthorizedAccessConfig")) $ctx | nindent 2 }}
+spec: {{ tpl (toYaml (omit $zone.read.perZone.vmauth.spec "unauthorizedUserAccessSpec")) $ctx | nindent 2 }}
   {{- $clusterSpec := ($zone.vmcluster).spec | default dict }}
   {{- $_ := set $ctx "appKey" (list "zone" "vmcluster" "spec" "vmselect") }}
   {{- $_ := set $zone.vmcluster "spec" (mergeOverwrite (deepCopy $commonClusterSpec) (deepCopy $commonSpec) (deepCopy $clusterSpec)) }}
   {{- $_ := set $ctx "style" "managed" }}
-  unauthorizedAccessConfig:
-  - src_paths:
-    - "/select/.+"
-    url_prefix: 
-    - {{ include "vm.url" $ctx }}
-    {{- $_ := unset $ctx "style" }}
+  unauthorizedUserAccessSpec:
+    url_map:
+      - src_paths:
+          - "/select/.+"
+        url_prefix:
+          - {{ include "vm.url" $ctx }}
+  {{- $_ := unset $ctx "style" }}
 {{- end }}
 {{- end }}
 
diff --git a/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-proxy.yaml b/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-proxy.yaml
index 6fe0025c5..7ad7fbab9 100644
--- a/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-proxy.yaml
+++ b/charts/victoria-metrics-distributed/templates/per-az/vmauth-read-proxy.yaml
@@ -20,35 +20,36 @@ metadata:
   annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
 {{- $spec := mergeOverwrite (deepCopy $.Values.common.vmauth.spec) (deepCopy (($zone.common).spec)) (deepCopy (((($zone.read).crossZone).vmauth).spec)) }}
-spec: {{ tpl (toYaml (omit $spec "unauthorizedAccessConfig")) $ctx | nindent 2 }}
-  unauthorizedAccessConfig:
-  - src_paths:
-    - "/select/.+"
-    load_balancing_policy: first_available
-    retry_status_codes:
-    - 503
-    {{- $_ := set $ctx "style" "managed" }}
-    {{- $urls := default list }}
-    {{- if $zone.read.allow }}
-      {{- $_ := set $ctx "appKey" (list "zone" "read" "perZone" "vmauth" "spec") }}
-      {{- $urls = append $urls (include "vm.url" $ctx) }}
-    {{- end }}
-    {{- range $j, $c := $.Values.availabilityZones }}
-      {{- $cross := mergeOverwrite (deepCopy $.Values.zoneTpl) $c }}
-      {{- if and (ne $j $i) $cross.read.allow }}
-        {{- $_ := set $ctx "appKey" (list "zone" "read" "perZone" "vmauth" "spec") }}
-        {{- if (($cross.read).perZone).vmauth }}
-          {{- $urlSpec := $cross.read.perZone.vmauth.spec | default dict }}
-          {{- $_ := set $cross.read.perZone.vmauth "spec" (mergeOverwrite (deepCopy $.Values.common.vmauth.spec) $urlSpec) }}
+spec: {{ tpl (toYaml (omit $spec "unauthorizedUserAccessSpec")) $ctx | nindent 2 }}
+  unauthorizedUserAccessSpec:
+    url_map:
+      - src_paths:
+          - "/select/.+"
+        load_balancing_policy: first_available
+        retry_status_codes:
+          - 503
+        {{- $_ := set $ctx "style" "managed" }}
+        {{- $urls := default list }}
+        {{- if $zone.read.allow }}
+          {{- $_ := set $ctx "appKey" (list "zone" "read" "perZone" "vmauth" "spec") }}
+          {{- $urls = append $urls (include "vm.url" $ctx) }}
         {{- end }}
-        {{- $_ := set $ctx "zone" $cross }}
-        {{- $urls = append $urls (include "vm.url" $ctx)}}
-      {{- end }}
-    {{- end }}
-    {{- if empty $urls }}
-      {{- fail (printf "No read backend urls defined for vmauth in AZ %s" $zone.name) -}}
-    {{- end }}
-    url_prefix: {{ toYaml $urls | nindent 4 }}
-    {{- $_ := unset $ctx "style" }}
+        {{- range $j, $c := $.Values.availabilityZones }}
+          {{- $cross := mergeOverwrite (deepCopy $.Values.zoneTpl) $c }}
+          {{- if and (ne $j $i) $cross.read.allow }}
+            {{- $_ := set $ctx "appKey" (list "zone" "read" "perZone" "vmauth" "spec") }}
+            {{- if (($cross.read).perZone).vmauth }}
+              {{- $urlSpec := $cross.read.perZone.vmauth.spec | default dict }}
+              {{- $_ := set $cross.read.perZone.vmauth "spec" (mergeOverwrite (deepCopy $.Values.common.vmauth.spec) $urlSpec) }}
+            {{- end }}
+            {{- $_ := set $ctx "zone" $cross }}
+            {{- $urls = append $urls (include "vm.url" $ctx)}}
+          {{- end }}
+        {{- end }}
+        {{- if empty $urls }}
+          {{- fail (printf "No read backend urls defined for vmauth in AZ %s" $zone.name) -}}
+        {{- end }}
+        url_prefix: {{ toYaml $urls | nindent 10 }}
+        {{- $_ := unset $ctx "style" }}
 {{- end }}
 {{- end }}
diff --git a/charts/victoria-metrics-distributed/templates/per-az/vmauth-write-balancer.yaml b/charts/victoria-metrics-distributed/templates/per-az/vmauth-write-balancer.yaml
index 437a108b7..aed8722bf 100644
--- a/charts/victoria-metrics-distributed/templates/per-az/vmauth-write-balancer.yaml
+++ b/charts/victoria-metrics-distributed/templates/per-az/vmauth-write-balancer.yaml
@@ -19,16 +19,17 @@ metadata:
   {{- with $zone.write.vmauth.annotations }}
   annotations: {{ toYaml . | nindent 4 }}
   {{- end  }}
-spec: {{ tpl (toYaml (omit $zone.write.vmauth.spec "unauthorizedAccessConfig")) $ctx | nindent 2 }}
+spec: {{ tpl (toYaml (omit $zone.write.vmauth.spec "unauthorizedUserAccessSpec")) $ctx | nindent 2 }}
   {{- $_ := set $ctx "style" "managed" }}
   {{- $clusterSpec := ($zone.vmcluster).spec | default dict }}
   {{- $_ := set $zone.vmcluster "spec" (mergeOverwrite (deepCopy $commonClusterSpec) (deepCopy $commonSpec) (deepCopy $clusterSpec)) }}
   {{- $_ := set $ctx "appKey" (list "zone" "vmcluster" "spec" "vminsert") }}
-  unauthorizedAccessConfig:
-  - src_paths:
-    - "/insert/.+"
-    url_prefix:
-    - {{ include "vm.url" $ctx }}
-    {{- $_ := unset $ctx "style" }}
+  unauthorizedUserAccessSpec:
+    url_map:
+      - src_paths:
+          - "/insert/.+"
+        url_prefix:
+          - {{ include "vm.url" $ctx }}
+  {{- $_ := unset $ctx "style" }}
 {{- end }}
 {{- end }}
diff --git a/charts/victoria-metrics-distributed/templates/vmauth-read.yaml b/charts/victoria-metrics-distributed/templates/vmauth-read.yaml
index 11facae67..5ef62be20 100644
--- a/charts/victoria-metrics-distributed/templates/vmauth-read.yaml
+++ b/charts/victoria-metrics-distributed/templates/vmauth-read.yaml
@@ -18,27 +18,28 @@ metadata:
   annotations: {{ toYaml . | nindent 4 }}
   {{- end  }}
 spec:
-  {{- with (omit $auth.spec "unauthorizedAccessConfig") }}
+  {{- with (omit $auth.spec "unauthorizedUserAccessSpec") }}
   {{- toYaml . | nindent 2 }}
   {{- end }}
-  unauthorizedAccessConfig:
-  - src_paths:
-    - "/select/.+"
-    load_balancing_policy: first_available
-    {{- $_ := set $ctx "style" "managed" }}
-    {{- $urls := default list }}
-    {{- range $i, $z := $.Values.availabilityZones }}
-      {{- $zone := mergeOverwrite (deepCopy $.Values.zoneTpl) $z }}
-      {{- $authSpec := ((($zone.read).crossZone).vmauth).spec | default dict }}
-      {{- $_ := set $zone.read.crossZone.vmauth "spec" (mergeOverwrite (deepCopy $commonAuth.spec) $authSpec) }}
-      {{- $_ := set $ctx "zone" $zone }}
-      {{- $_ := set $ctx "appKey" (list "zone" "read" "crossZone" "vmauth" "spec") }}
-      {{- $urls = append $urls (include "vm.url" $ctx) }}
-    {{- end }}
-    {{- $_ := unset $ctx "style" }}
-    {{- if empty $urls }}
-      {{- fail "No global vmauth read backend urls defined" -}}
-    {{- end }}
-    url_prefix: {{ toYaml $urls | nindent 4 }}
+  unauthorizedUserAccessSpec:
+    url_map:
+      - src_paths:
+          - "/select/.+"
+        load_balancing_policy: first_available
+        {{- $_ := set $ctx "style" "managed" }}
+        {{- $urls := default list }}
+        {{- range $i, $z := $.Values.availabilityZones }}
+          {{- $zone := mergeOverwrite (deepCopy $.Values.zoneTpl) $z }}
+          {{- $authSpec := ((($zone.read).crossZone).vmauth).spec | default dict }}
+          {{- $_ := set $zone.read.crossZone.vmauth "spec" (mergeOverwrite (deepCopy $commonAuth.spec) $authSpec) }}
+          {{- $_ := set $ctx "zone" $zone }}
+          {{- $_ := set $ctx "appKey" (list "zone" "read" "crossZone" "vmauth" "spec") }}
+          {{- $urls = append $urls (include "vm.url" $ctx) }}
+        {{- end }}
+        {{- $_ := unset $ctx "style" }}
+        {{- if empty $urls }}
+          {{- fail "No global vmauth read backend urls defined" -}}
+        {{- end }}
+        url_prefix: {{ toYaml $urls | nindent 10 }}
 {{- end }}
 
diff --git a/charts/victoria-metrics-distributed/templates/vmauth-write.yaml b/charts/victoria-metrics-distributed/templates/vmauth-write.yaml
index 3c2398e43..18f015d3b 100644
--- a/charts/victoria-metrics-distributed/templates/vmauth-write.yaml
+++ b/charts/victoria-metrics-distributed/templates/vmauth-write.yaml
@@ -18,30 +18,31 @@ metadata:
   annotations: {{ toYaml . | nindent 4 }}
   {{- end  }}
 spec:
-  {{- with (omit $auth.spec "unauthorizedAccessConfig") }}
+  {{- with (omit $auth.spec "unauthorizedUserAccessSpec") }}
   {{- toYaml . | nindent 2 }}
   {{- end }}
-  unauthorizedAccessConfig:
-  - src_paths:
-    - "/api/v1/write"
-    - "/prometheus/api/v1/write"
-    - "/write"
-    - "/api/v1/import"
-    - "/api/v1/import/.+"
-    {{- $_ := set $ctx "style" "managed" }}
-    {{- $urls := default list }}
-    {{- $commonAgentSpec := (((.Values).common).vmagent).spec | default dict }}
-    {{- range $i, $z := $.Values.availabilityZones }}
-      {{- $zone := mergeOverwrite (deepCopy $.Values.zoneTpl) $z }}
-      {{- $agentSpec := $zone.vmagent.spec | default dict }}
-      {{- $_ := set $zone.vmagent "spec" (mergeOverwrite (deepCopy $commonAgentSpec) $agentSpec) }}
-      {{- $_ := set $ctx "zone" $zone }}
-      {{- $_ := set $ctx "appKey" (list "zone" "vmagent" "spec") }}
-      {{- $urls = append $urls (include "vm.url" $ctx) }}
-    {{- end }}
-    {{- $_ := unset $ctx "style" }}
-    {{- if empty $urls }}
-      {{- fail "No global vmauth write backend urls defined" -}}
-    {{- end }}
-    url_prefix: {{ toYaml $urls | nindent 4 }}
+  unauthorizedUserAccessSpec:
+    url_map:
+      - src_paths:
+          - "/api/v1/write"
+          - "/prometheus/api/v1/write"
+          - "/write"
+          - "/api/v1/import"
+          - "/api/v1/import/.+"
+        {{- $_ := set $ctx "style" "managed" }}
+        {{- $urls := default list }}
+        {{- $commonAgentSpec := (((.Values).common).vmagent).spec | default dict }}
+        {{- range $i, $z := $.Values.availabilityZones }}
+          {{- $zone := mergeOverwrite (deepCopy $.Values.zoneTpl) $z }}
+          {{- $agentSpec := $zone.vmagent.spec | default dict }}
+          {{- $_ := set $zone.vmagent "spec" (mergeOverwrite (deepCopy $commonAgentSpec) $agentSpec) }}
+          {{- $_ := set $ctx "zone" $zone }}
+          {{- $_ := set $ctx "appKey" (list "zone" "vmagent" "spec") }}
+          {{- $urls = append $urls (include "vm.url" $ctx) }}
+        {{- end }}
+        {{- $_ := unset $ctx "style" }}
+        {{- if empty $urls }}
+          {{- fail "No global vmauth write backend urls defined" -}}
+        {{- end }}
+        url_prefix: {{ toYaml $urls | nindent 10 }}
 {{- end }}
diff --git a/charts/victoria-metrics-distributed/tests/__snapshot__/vmauth_test.yaml.snap b/charts/victoria-metrics-distributed/tests/__snapshot__/vmauth_test.yaml.snap
index 8307f1f00..289233669 100644
--- a/charts/victoria-metrics-distributed/tests/__snapshot__/vmauth_test.yaml.snap
+++ b/charts/victoria-metrics-distributed/tests/__snapshot__/vmauth_test.yaml.snap
@@ -25,11 +25,12 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - src_paths:
-            - /select/.+
-          url_prefix:
-            - http://vmselect-vmcluster-zone-eu-1.NAMESPACE.svc.cluster.local.:8481
+      unauthorizedUserAccessSpec:
+        url_map:
+          - src_paths:
+              - /select/.+
+            url_prefix:
+              - http://vmselect-vmcluster-zone-eu-1.NAMESPACE.svc.cluster.local.:8481
   2: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -56,11 +57,12 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - src_paths:
-            - /select/.+
-          url_prefix:
-            - http://vmselect-vmcluster-zone-us-1.NAMESPACE.svc.cluster.local.:8481
+      unauthorizedUserAccessSpec:
+        url_map:
+          - src_paths:
+              - /select/.+
+            url_prefix:
+              - http://vmselect-vmcluster-zone-us-1.NAMESPACE.svc.cluster.local.:8481
   3: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -85,15 +87,16 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - load_balancing_policy: first_available
-          retry_status_codes:
-            - 503
-          src_paths:
-            - /select/.+
-          url_prefix:
-            - http://vmauth-vmauth-read-balancer-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
-            - http://vmauth-vmauth-read-balancer-zone-us-1.NAMESPACE.svc.cluster.local.:8427
+      unauthorizedUserAccessSpec:
+        url_map:
+          - load_balancing_policy: first_available
+            retry_status_codes:
+              - 503
+            src_paths:
+              - /select/.+
+            url_prefix:
+              - http://vmauth-vmauth-read-balancer-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
+              - http://vmauth-vmauth-read-balancer-zone-us-1.NAMESPACE.svc.cluster.local.:8427
   4: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -118,15 +121,16 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - load_balancing_policy: first_available
-          retry_status_codes:
-            - 503
-          src_paths:
-            - /select/.+
-          url_prefix:
-            - http://vmauth-vmauth-read-balancer-zone-us-1.NAMESPACE.svc.cluster.local.:8427
-            - http://vmauth-vmauth-read-balancer-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
+      unauthorizedUserAccessSpec:
+        url_map:
+          - load_balancing_policy: first_available
+            retry_status_codes:
+              - 503
+            src_paths:
+              - /select/.+
+            url_prefix:
+              - http://vmauth-vmauth-read-balancer-zone-us-1.NAMESPACE.svc.cluster.local.:8427
+              - http://vmauth-vmauth-read-balancer-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
   5: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -153,11 +157,12 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - src_paths:
-            - /insert/.+
-          url_prefix:
-            - http://vminsert-vmcluster-zone-eu-1.NAMESPACE.svc.cluster.local.:8480
+      unauthorizedUserAccessSpec:
+        url_map:
+          - src_paths:
+              - /insert/.+
+            url_prefix:
+              - http://vminsert-vmcluster-zone-eu-1.NAMESPACE.svc.cluster.local.:8480
   6: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -184,11 +189,12 @@ vmauth should match snapshot:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
           whenUnsatisfiable: ScheduleAnyway
-      unauthorizedAccessConfig:
-        - src_paths:
-            - /insert/.+
-          url_prefix:
-            - http://vminsert-vmcluster-zone-us-1.NAMESPACE.svc.cluster.local.:8480
+      unauthorizedUserAccessSpec:
+        url_map:
+          - src_paths:
+              - /insert/.+
+            url_prefix:
+              - http://vminsert-vmcluster-zone-us-1.NAMESPACE.svc.cluster.local.:8480
   7: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -206,13 +212,14 @@ vmauth should match snapshot:
       image:
         tag: v1.0.3
       port: "8427"
-      unauthorizedAccessConfig:
-        - load_balancing_policy: first_available
-          src_paths:
-            - /select/.+
-          url_prefix:
-            - http://vmauth-vmauth-read-proxy-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
-            - http://vmauth-vmauth-read-proxy-zone-us-1.NAMESPACE.svc.cluster.local.:8427
+      unauthorizedUserAccessSpec:
+        url_map:
+          - load_balancing_policy: first_available
+            src_paths:
+              - /select/.+
+            url_prefix:
+              - http://vmauth-vmauth-read-proxy-zone-eu-1.NAMESPACE.svc.cluster.local.:8427
+              - http://vmauth-vmauth-read-proxy-zone-us-1.NAMESPACE.svc.cluster.local.:8427
   8: |
     apiVersion: operator.victoriametrics.com/v1beta1
     kind: VMAuth
@@ -230,13 +237,14 @@ vmauth should match snapshot:
       image:
         tag: v1.0.2
       port: "8427"
-      unauthorizedAccessConfig:
-        - src_paths:
-            - /api/v1/write
-            - /prometheus/api/v1/write
-            - /write
-            - /api/v1/import
-            - /api/v1/import/.+
-          url_prefix:
-            - http://vmagent-vmagent-zone-eu-1.NAMESPACE.svc.cluster.local.:8429
-            - http://vmagent-vmagent-zone-us-1.NAMESPACE.svc.cluster.local.:8429
+      unauthorizedUserAccessSpec:
+        url_map:
+          - src_paths:
+              - /api/v1/write
+              - /prometheus/api/v1/write
+              - /write
+              - /api/v1/import
+              - /api/v1/import/.+
+            url_prefix:
+              - http://vmagent-vmagent-zone-eu-1.NAMESPACE.svc.cluster.local.:8429
+              - http://vmagent-vmagent-zone-us-1.NAMESPACE.svc.cluster.local.:8429