diff --git a/api/operator/v1beta1/vmextra_types.go b/api/operator/v1beta1/vmextra_types.go
index efb2d4cc4..891f60da5 100644
--- a/api/operator/v1beta1/vmextra_types.go
+++ b/api/operator/v1beta1/vmextra_types.go
@@ -1207,6 +1207,9 @@ type CommonConfigReloaderParams struct {
 	// available since v0.57.0 version
 	// +optional
 	ConfigReloadAuthKeySecret *corev1.SecretKeySelector `json:"configReloadAuthKeySecret,omitempty"`
+	// ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container
+	// +optional
+	ConfigReloaderEmptyDir *corev1.EmptyDirVolumeSource `json:"configReloaderEmptyDir,omitempty"`
 }
 
 // CommonApplicationDeploymentParams defines common params
diff --git a/api/operator/v1beta1/zz_generated.deepcopy.go b/api/operator/v1beta1/zz_generated.deepcopy.go
index da990529b..363e7bc50 100644
--- a/api/operator/v1beta1/zz_generated.deepcopy.go
+++ b/api/operator/v1beta1/zz_generated.deepcopy.go
@@ -536,6 +536,11 @@ func (in *CommonConfigReloaderParams) DeepCopyInto(out *CommonConfigReloaderPara
 		*out = new(v1.SecretKeySelector)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ConfigReloaderEmptyDir != nil {
+		in, out := &in.ConfigReloaderEmptyDir, &out.ConfigReloaderEmptyDir
+		*out = new(v1.EmptyDirVolumeSource)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CommonConfigReloaderParams.
diff --git a/config/crd/overlay/crd.yaml b/config/crd/overlay/crd.yaml
index 0fc012eb8..9f7a6cef4 100644
--- a/config/crd/overlay/crd.yaml
+++ b/config/crd/overlay/crd.yaml
@@ -7928,6 +7928,31 @@ spec:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
+              configReloaderEmptyDir:
+                description: ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral
+                  volume, that is shared with main container
+                properties:
+                  medium:
+                    description: |-
+                      medium represents what type of storage medium should back this directory.
+                      The default is "" which means to use the node's default medium.
+                      Must be an empty string (default) or Memory.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    type: string
+                  sizeLimit:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: |-
+                      sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                      The size limit is also applicable for memory medium.
+                      The maximum usage on memory medium EmptyDir would be the minimum value between
+                      the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                      The default is nil which means that the limit is undefined.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                    x-kubernetes-int-or-string: true
+                type: object
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
@@ -17686,6 +17711,31 @@ spec:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
+              configReloaderEmptyDir:
+                description: ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral
+                  volume, that is shared with main container
+                properties:
+                  medium:
+                    description: |-
+                      medium represents what type of storage medium should back this directory.
+                      The default is "" which means to use the node's default medium.
+                      Must be an empty string (default) or Memory.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    type: string
+                  sizeLimit:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: |-
+                      sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                      The size limit is also applicable for memory medium.
+                      The maximum usage on memory medium EmptyDir would be the minimum value between
+                      the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                      The default is nil which means that the limit is undefined.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                    x-kubernetes-int-or-string: true
+                type: object
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
@@ -19756,6 +19806,31 @@ spec:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
+              configReloaderEmptyDir:
+                description: ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral
+                  volume, that is shared with main container
+                properties:
+                  medium:
+                    description: |-
+                      medium represents what type of storage medium should back this directory.
+                      The default is "" which means to use the node's default medium.
+                      Must be an empty string (default) or Memory.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    type: string
+                  sizeLimit:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: |-
+                      sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                      The size limit is also applicable for memory medium.
+                      The maximum usage on memory medium EmptyDir would be the minimum value between
+                      the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                      The default is nil which means that the limit is undefined.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                    x-kubernetes-int-or-string: true
+                type: object
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
@@ -24509,6 +24584,31 @@ spec:
                 - key
                 type: object
                 x-kubernetes-map-type: atomic
+              configReloaderEmptyDir:
+                description: ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral
+                  volume, that is shared with main container
+                properties:
+                  medium:
+                    description: |-
+                      medium represents what type of storage medium should back this directory.
+                      The default is "" which means to use the node's default medium.
+                      Must be an empty string (default) or Memory.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    type: string
+                  sizeLimit:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: |-
+                      sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                      The size limit is also applicable for memory medium.
+                      The maximum usage on memory medium EmptyDir would be the minimum value between
+                      the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                      The default is nil which means that the limit is undefined.
+                      More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                    x-kubernetes-int-or-string: true
+                type: object
               configReloaderExtraArgs:
                 additionalProperties:
                   type: string
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 013172f72..a4e1aa003 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -27,6 +27,7 @@ aliases:
 * FEATURE: [vlagent](https://docs.victoriametrics.com/operator/resources/vlagent): support logs collection. See [#1501](https://github.com/VictoriaMetrics/operator/issues/1501).
 * FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): use `operator_bad_objects_total` metric with `object_namespace` and `crd` labels to track invalid objects managed by VMAgent, VMAuth, VMAlert and VMAlertmanager. Old `operator_alertmanager_bad_objects_count` and `operator_vmalert_bad_objects_count` are deprecated and will be removed in next releases.
 * FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): added HPA support for all cluster CR storage. See [#1678](https://github.com/VictoriaMetrics/operator/issues/1678).
+* FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): added VM_CONFIG_RELOADER_EMPTY_DIR global variable and `spec.configReloaderEmptyDir` parameter that allows to set emptyDir volume section for configurations volume. See [#1711](https://github.com/VictoriaMetrics/operator/issues/1711).
 
 * BUGFIX: [vmoperator](https://docs.victoriametrics.com/operator/): fixed HPA cleanup logic for all cluster resources, before it was constantly recreated. Bug introduced in [this commit](https://github.com/VictoriaMetrics/operator/commit/983d1678c37497a7d03d2f57821219fd4975deec).
 * BUGFIX: [VMCluster](https://docs.victoriametrics.com/operator/resources/vmcluster/), [VLCluster](https://docs.victoriametrics.com/operator/resources/vlcluster/) and [VTCluster](https://docs.victoriametrics.com/operator/resources/vtcluster/): prevent cluster load balancer secret from infinite reconcile.
diff --git a/docs/api.md b/docs/api.md
index c8ab466da..e9a72ed6e 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -671,7 +671,6 @@ Appears in: [VMAnomalyMonitoringSpec](#vmanomalymonitoringspec)
 
 VMAnomalyMonitoringPushSpec defines metrics push configuration
 
-
 VMAnomaly uses prometheus text exposition format
 
 Appears in: [VMAnomalyMonitoringSpec](#vmanomalymonitoringspec)
@@ -1474,6 +1473,7 @@ Appears in: [VMAgentSpec](#vmagentspec), [VMAlertSpec](#vmalertspec), [VMAlertma
 | Field | Description |
 | --- | --- |
 | configReloadAuthKeySecret<a href="#commonconfigreloaderparams-configreloadauthkeysecret" id="commonconfigreloaderparams-configreloadauthkeysecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>ConfigReloadAuthKeySecret defines optional secret reference authKey for /-/reload API requests.<br />Given secret reference will be added to the application and vm-config-reloader as volume<br />available since v0.57.0 version |
+| configReloaderEmptyDir<a href="#commonconfigreloaderparams-configreloaderemptydir" id="commonconfigreloaderparams-configreloaderemptydir">#</a><br/>_[EmptyDirVolumeSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#emptydirvolumesource-v1-core)_ | _(Optional)_<br/>ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container |
 | configReloaderExtraArgs<a href="#commonconfigreloaderparams-configreloaderextraargs" id="commonconfigreloaderparams-configreloaderextraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container<br />for example resyncInterval: "30s" |
 | configReloaderImage<a href="#commonconfigreloaderparams-configreloaderimage" id="commonconfigreloaderparams-configreloaderimage">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImage defines image:tag for config-reloader container |
 | configReloaderImageTag<a href="#commonconfigreloaderparams-configreloaderimagetag" id="commonconfigreloaderparams-configreloaderimagetag">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImageTag defines image:tag for config-reloader container<br />Deprecated: use configReloaderImage instead |
@@ -1609,6 +1609,7 @@ Appears in: [VMAlertmanagerSpec](#vmalertmanagerspec)
 | Field | Description |
 | --- | --- |
 | key<a href="#configmapkeyreference-key" id="configmapkeyreference-key">#</a><br/>_string_ | _(Required)_<br/>The ConfigMap key to refer to. |
+| name<a href="#configmapkeyreference-name" id="configmapkeyreference-name">#</a><br/>_string_ | _(Optional)_<br/>Name of the referent.<br />This field is effectively required, but due to backwards compatibility is<br />allowed to be empty. Instances of this type with an empty value here are<br />almost certainly wrong.<br />More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
 
 
 #### ConsulSDConfig
@@ -1817,7 +1818,6 @@ Appears in: [VLInsert](#vlinsert), [VLSelect](#vlselect), [VLStorage](#vlstorage
 
 EmbeddedHTTPRoute describes httproute configuration options.
 
-
 Requires gateway-controller CRD installed and VM_GATEWAY_API_ENABLED=true env var
 See https://gateway-api.sigs.k8s.io/guides/#installing-a-gateway-controller
 
@@ -1899,7 +1899,7 @@ Appears in: [VLAgentSpec](#vlagentspec), [VLInsert](#vlinsert), [VLSelect](#vlse
 | maxUnavailable<a href="#embeddedpoddisruptionbudgetspec-maxunavailable" id="embeddedpoddisruptionbudgetspec-maxunavailable">#</a><br/>_[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#intorstring-intstr-util)_ | _(Optional)_<br/>An eviction is allowed if at most "maxUnavailable" pods selected by<br />"selector" are unavailable after the eviction, i.e. even in absence of<br />the evicted pod. For example, one can prevent all voluntary evictions<br />by specifying 0. This is a mutually exclusive setting with "minAvailable". |
 | minAvailable<a href="#embeddedpoddisruptionbudgetspec-minavailable" id="embeddedpoddisruptionbudgetspec-minavailable">#</a><br/>_[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#intorstring-intstr-util)_ | _(Optional)_<br/>An eviction is allowed if at least "minAvailable" pods selected by<br />"selector" will still be available after the eviction, i.e. even in the<br />absence of the evicted pod.  So for example you can prevent all voluntary<br />evictions by specifying "100%". |
 | selectorLabels<a href="#embeddedpoddisruptionbudgetspec-selectorlabels" id="embeddedpoddisruptionbudgetspec-selectorlabels">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>replaces default labels selector generated by operator<br />it's useful when you need to create custom budget |
-| unhealthyPodEvictionPolicy<a href="#embeddedpoddisruptionbudgetspec-unhealthypodevictionpolicy" id="embeddedpoddisruptionbudgetspec-unhealthypodevictionpolicy">#</a><br/>_string_ | _(Optional)_<br/>UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods<br /><br />Valid policies are IfHealthyBudget and AlwaysAllow.<br />If no policy is specified, the default behavior will be used,<br />which corresponds to the IfHealthyBudget policy.<br />Available from operator v0.64.0 |
+| unhealthyPodEvictionPolicy<a href="#embeddedpoddisruptionbudgetspec-unhealthypodevictionpolicy" id="embeddedpoddisruptionbudgetspec-unhealthypodevictionpolicy">#</a><br/>_string_ | _(Optional)_<br/>UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods<br />Valid policies are IfHealthyBudget and AlwaysAllow.<br />If no policy is specified, the default behavior will be used,<br />which corresponds to the IfHealthyBudget policy.<br />Available from operator v0.64.0 |
 
 
 #### EmbeddedProbes
@@ -2051,7 +2051,6 @@ The private IP address is used by default, but may be changed to
 the public IP address with relabeling.
 See [here](https://docs.victoriametrics.com/victoriametrics/sd_configs/#gce_sd_configs)
 
-
 The GCE service discovery will load the Google Cloud credentials
 from the file specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
 See https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
@@ -2838,7 +2837,7 @@ Appears in: [CommonScrapeParams](#commonscrapeparams), [VMAgentSpec](#vmagentspe
 | basicAuth<a href="#scrapeclass-basicauth" id="scrapeclass-basicauth">#</a><br/>_[BasicAuth](#basicauth)_ | _(Optional)_<br/>BasicAuth allow an endpoint to authenticate over basic authentication |
 | bearerTokenFile<a href="#scrapeclass-bearertokenfile" id="scrapeclass-bearertokenfile">#</a><br/>_string_ | _(Optional)_<br/>File to read bearer token for scraping targets. |
 | bearerTokenSecret<a href="#scrapeclass-bearertokensecret" id="scrapeclass-bearertokensecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>Secret to mount to read bearer token for scraping targets. The secret<br />needs to be in the same namespace as the scrape object and accessible by<br />the victoria-metrics operator. |
-| default<a href="#scrapeclass-default" id="scrapeclass-default">#</a><br/>_boolean_ | _(Optional)_<br/>default defines that the scrape applies to all scrape objects that<br />don't configure an explicit scrape class name.<br /><br />Only one scrape class can be set as the default. |
+| default<a href="#scrapeclass-default" id="scrapeclass-default">#</a><br/>_boolean_ | _(Optional)_<br/>default defines that the scrape applies to all scrape objects that<br />don't configure an explicit scrape class name.<br />Only one scrape class can be set as the default. |
 | metricRelabelConfigs<a href="#scrapeclass-metricrelabelconfigs" id="scrapeclass-metricrelabelconfigs">#</a><br/>_[RelabelConfig](#relabelconfig) array_ | _(Optional)_<br/>MetricRelabelConfigs to apply to samples after scrapping. |
 | name<a href="#scrapeclass-name" id="scrapeclass-name">#</a><br/>_string_ | _(Required)_<br/>name of the scrape class. |
 | oauth2<a href="#scrapeclass-oauth2" id="scrapeclass-oauth2">#</a><br/>_[OAuth2](#oauth2)_ | _(Optional)_<br/>OAuth2 defines auth configuration |
@@ -3114,9 +3113,9 @@ Appears in: [StreamAggrConfig](#streamaggrconfig)
 
 | Field | Description |
 | --- | --- |
-| by<a href="#streamaggrrule-by" id="streamaggrrule-by">#</a><br/>_string array_ | _(Optional)_<br/>By is an optional list of labels for grouping input series.<br /><br />See also Without.<br /><br />If neither By nor Without are set, then the Outputs are calculated<br />individually per each input time series. |
+| by<a href="#streamaggrrule-by" id="streamaggrrule-by">#</a><br/>_string array_ | _(Optional)_<br/>By is an optional list of labels for grouping input series.<br />See also Without.<br />If neither By nor Without are set, then the Outputs are calculated<br />individually per each input time series. |
 | dedup_interval<a href="#streamaggrrule-dedup_interval" id="streamaggrrule-dedup_interval">#</a><br/>_string_ | _(Optional)_<br/>DedupInterval is an optional interval for deduplication. |
-| drop_input_labels<a href="#streamaggrrule-drop_input_labels" id="streamaggrrule-drop_input_labels">#</a><br/>_string_ | _(Optional)_<br/>DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.<br /><br />Labels are dropped before de-duplication and aggregation. |
+| drop_input_labels<a href="#streamaggrrule-drop_input_labels" id="streamaggrrule-drop_input_labels">#</a><br/>_string_ | _(Optional)_<br/>DropInputLabels is an optional list with labels, which must be dropped before further processing of input samples.<br />Labels are dropped before de-duplication and aggregation. |
 | enable_windows<a href="#streamaggrrule-enable_windows" id="streamaggrrule-enable_windows">#</a><br/>_boolean_ | _(Optional)_<br/>EnableWindows enables aggregating data in separate windows |
 | flush_on_shutdown<a href="#streamaggrrule-flush_on_shutdown" id="streamaggrrule-flush_on_shutdown">#</a><br/>_boolean_ | _(Optional)_<br/>FlushOnShutdown defines whether to flush the aggregation state on process termination<br />or config reload. Is `false` by default.<br />It is not recommended changing this setting, unless unfinished aggregations states<br />are preferred to missing data points. |
 | ignoreFirstSampleInterval<a href="#streamaggrrule-ignorefirstsampleinterval" id="streamaggrrule-ignorefirstsampleinterval">#</a><br/>_string_ | _(Required)_<br/>IgnoreFirstSampleInterval sets interval for total and prometheus_total during which first samples will be ignored |
@@ -3125,12 +3124,12 @@ Appears in: [StreamAggrConfig](#streamaggrconfig)
 | input_relabel_configs<a href="#streamaggrrule-input_relabel_configs" id="streamaggrrule-input_relabel_configs">#</a><br/>_[RelabelConfig](#relabelconfig) array_ | _(Optional)_<br/>InputRelabelConfigs is an optional relabeling rules, which are applied on the input<br />before aggregation. |
 | interval<a href="#streamaggrrule-interval" id="streamaggrrule-interval">#</a><br/>_string_ | _(Required)_<br/>Interval is the interval between aggregations. |
 | keep_metric_names<a href="#streamaggrrule-keep_metric_names" id="streamaggrrule-keep_metric_names">#</a><br/>_boolean_ | _(Optional)_<br/>KeepMetricNames instructs to leave metric names as is for the output time series without adding any suffix. |
-| match<a href="#streamaggrrule-match" id="streamaggrrule-match">#</a><br/>_[StringOrArray](#stringorarray)_ | _(Optional)_<br/>Match is a label selector (or list of label selectors) for filtering time series for the given selector.<br /><br />If the match isn't set, then all the input time series are processed. |
+| match<a href="#streamaggrrule-match" id="streamaggrrule-match">#</a><br/>_[StringOrArray](#stringorarray)_ | _(Optional)_<br/>Match is a label selector (or list of label selectors) for filtering time series for the given selector.<br />If the match isn't set, then all the input time series are processed. |
 | no_align_flush_to_interval<a href="#streamaggrrule-no_align_flush_to_interval" id="streamaggrrule-no_align_flush_to_interval">#</a><br/>_boolean_ | _(Optional)_<br/>NoAlignFlushToInterval disables aligning of flushes to multiples of Interval.<br />By default flushes are aligned to Interval. |
 | output_relabel_configs<a href="#streamaggrrule-output_relabel_configs" id="streamaggrrule-output_relabel_configs">#</a><br/>_[RelabelConfig](#relabelconfig) array_ | _(Optional)_<br/>OutputRelabelConfigs is an optional relabeling rules, which are applied<br />on the aggregated output before being sent to remote storage. |
-| outputs<a href="#streamaggrrule-outputs" id="streamaggrrule-outputs">#</a><br/>_string array_ | _(Required)_<br/>Outputs is a list of output aggregate functions to produce.<br /><br />The following names are allowed:<br /><br />- total - aggregates input counters<br />- increase - counts the increase over input counters<br />- count_series - counts the input series<br />- count_samples - counts the input samples<br />- sum_samples - sums the input samples<br />- last - the last biggest sample value<br />- min - the minimum sample value<br />- max - the maximum sample value<br />- avg - the average value across all the samples<br />- stddev - standard deviation across all the samples<br />- stdvar - standard variance across all the samples<br />- histogram_bucket - creates VictoriaMetrics histogram for input samples<br />- quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]<br /><br />The output time series will have the following names:<br /><br />  input_name:aggr_<interval>_<output> |
+| outputs<a href="#streamaggrrule-outputs" id="streamaggrrule-outputs">#</a><br/>_string array_ | _(Required)_<br/>Outputs is a list of output aggregate functions to produce.<br />The following names are allowed:<br />- total - aggregates input counters<br />- increase - counts the increase over input counters<br />- count_series - counts the input series<br />- count_samples - counts the input samples<br />- sum_samples - sums the input samples<br />- last - the last biggest sample value<br />- min - the minimum sample value<br />- max - the maximum sample value<br />- avg - the average value across all the samples<br />- stddev - standard deviation across all the samples<br />- stdvar - standard variance across all the samples<br />- histogram_bucket - creates VictoriaMetrics histogram for input samples<br />- quantiles(phi1, ..., phiN) - quantiles' estimation for phi in the range [0..1]<br />The output time series will have the following names:<br />  input_name:aggr_<interval>_<output> |
 | staleness_interval<a href="#streamaggrrule-staleness_interval" id="streamaggrrule-staleness_interval">#</a><br/>_string_ | _(Optional)_<br/>Staleness interval is interval after which the series state will be reset if no samples have been sent during it.<br />The parameter is only relevant for outputs: total, total_prometheus, increase, increase_prometheus and histogram_bucket. |
-| without<a href="#streamaggrrule-without" id="streamaggrrule-without">#</a><br/>_string array_ | _(Optional)_<br/>Without is an optional list of labels, which must be excluded when grouping input series.<br /><br />See also By.<br /><br />If neither By nor Without are set, then the Outputs are calculated<br />individually per each input time series. |
+| without<a href="#streamaggrrule-without" id="streamaggrrule-without">#</a><br/>_string array_ | _(Optional)_<br/>Without is an optional list of labels, which must be excluded when grouping input series.<br />See also By.<br />If neither By nor Without are set, then the Outputs are calculated<br />individually per each input time series. |
 
 
 #### StringOrArray
@@ -3562,6 +3561,7 @@ Appears in: [VMAgent](#vmagent)
 | claimTemplates<a href="#vmagentspec-claimtemplates" id="vmagentspec-claimtemplates">#</a><br/>_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#persistentvolumeclaim-v1-core) array_ | _(Required)_<br/>ClaimTemplates allows adding additional VolumeClaimTemplates for VMAgent in StatefulMode |
 | configMaps<a href="#vmagentspec-configmaps" id="vmagentspec-configmaps">#</a><br/>_string array_ | _(Optional)_<br/>ConfigMaps is a list of ConfigMaps in the same namespace as the Application<br />object, which shall be mounted into the Application container<br />at /etc/vm/configs/CONFIGMAP_NAME folder |
 | configReloadAuthKeySecret<a href="#vmagentspec-configreloadauthkeysecret" id="vmagentspec-configreloadauthkeysecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>ConfigReloadAuthKeySecret defines optional secret reference authKey for /-/reload API requests.<br />Given secret reference will be added to the application and vm-config-reloader as volume<br />available since v0.57.0 version |
+| configReloaderEmptyDir<a href="#vmagentspec-configreloaderemptydir" id="vmagentspec-configreloaderemptydir">#</a><br/>_[EmptyDirVolumeSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#emptydirvolumesource-v1-core)_ | _(Optional)_<br/>ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container |
 | configReloaderExtraArgs<a href="#vmagentspec-configreloaderextraargs" id="vmagentspec-configreloaderextraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container<br />for example resyncInterval: "30s" |
 | configReloaderImage<a href="#vmagentspec-configreloaderimage" id="vmagentspec-configreloaderimage">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImage defines image:tag for config-reloader container |
 | configReloaderImageTag<a href="#vmagentspec-configreloaderimagetag" id="vmagentspec-configreloaderimagetag">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImageTag defines image:tag for config-reloader container<br />Deprecated: use configReloaderImage instead |
@@ -3767,6 +3767,7 @@ Appears in: [VMAlert](#vmalert)
 | affinity<a href="#vmalertspec-affinity" id="vmalertspec-affinity">#</a><br/>_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#affinity-v1-core)_ | _(Optional)_<br/>Affinity If specified, the pod's scheduling constraints. |
 | configMaps<a href="#vmalertspec-configmaps" id="vmalertspec-configmaps">#</a><br/>_string array_ | _(Optional)_<br/>ConfigMaps is a list of ConfigMaps in the same namespace as the Application<br />object, which shall be mounted into the Application container<br />at /etc/vm/configs/CONFIGMAP_NAME folder |
 | configReloadAuthKeySecret<a href="#vmalertspec-configreloadauthkeysecret" id="vmalertspec-configreloadauthkeysecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>ConfigReloadAuthKeySecret defines optional secret reference authKey for /-/reload API requests.<br />Given secret reference will be added to the application and vm-config-reloader as volume<br />available since v0.57.0 version |
+| configReloaderEmptyDir<a href="#vmalertspec-configreloaderemptydir" id="vmalertspec-configreloaderemptydir">#</a><br/>_[EmptyDirVolumeSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#emptydirvolumesource-v1-core)_ | _(Optional)_<br/>ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container |
 | configReloaderExtraArgs<a href="#vmalertspec-configreloaderextraargs" id="vmalertspec-configreloaderextraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container<br />for example resyncInterval: "30s" |
 | configReloaderImage<a href="#vmalertspec-configreloaderimage" id="vmalertspec-configreloaderimage">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImage defines image:tag for config-reloader container |
 | configReloaderImageTag<a href="#vmalertspec-configreloaderimagetag" id="vmalertspec-configreloaderimagetag">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImageTag defines image:tag for config-reloader container<br />Deprecated: use configReloaderImage instead |
@@ -3905,6 +3906,7 @@ Appears in: [VMAlertmanager](#vmalertmanager)
 | configNamespaceSelector<a href="#vmalertmanagerspec-confignamespaceselector" id="vmalertmanagerspec-confignamespaceselector">#</a><br/>_[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#labelselector-v1-meta)_ | _(Optional)_<br/> ConfigNamespaceSelector defines namespace selector for VMAlertmanagerConfig.<br />Works in combination with Selector.<br />NamespaceSelector nil - only objects at VMAlertmanager namespace.<br />Selector nil - only objects at NamespaceSelector namespaces.<br />If both nil - behaviour controlled by selectAllByDefault |
 | configRawYaml<a href="#vmalertmanagerspec-configrawyaml" id="vmalertmanagerspec-configrawyaml">#</a><br/>_string_ | _(Optional)_<br/>ConfigRawYaml - raw configuration for alertmanager,<br />it helps it to start without secret.<br />priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret. |
 | configReloadAuthKeySecret<a href="#vmalertmanagerspec-configreloadauthkeysecret" id="vmalertmanagerspec-configreloadauthkeysecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>ConfigReloadAuthKeySecret defines optional secret reference authKey for /-/reload API requests.<br />Given secret reference will be added to the application and vm-config-reloader as volume<br />available since v0.57.0 version |
+| configReloaderEmptyDir<a href="#vmalertmanagerspec-configreloaderemptydir" id="vmalertmanagerspec-configreloaderemptydir">#</a><br/>_[EmptyDirVolumeSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#emptydirvolumesource-v1-core)_ | _(Optional)_<br/>ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container |
 | configReloaderExtraArgs<a href="#vmalertmanagerspec-configreloaderextraargs" id="vmalertmanagerspec-configreloaderextraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container<br />for example resyncInterval: "30s" |
 | configReloaderImage<a href="#vmalertmanagerspec-configreloaderimage" id="vmalertmanagerspec-configreloaderimage">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImage defines image:tag for config-reloader container |
 | configReloaderImageTag<a href="#vmalertmanagerspec-configreloaderimagetag" id="vmalertmanagerspec-configreloaderimagetag">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImageTag defines image:tag for config-reloader container<br />Deprecated: use configReloaderImage instead |
@@ -4077,6 +4079,7 @@ Appears in: [VMAuth](#vmauth)
 | affinity<a href="#vmauthspec-affinity" id="vmauthspec-affinity">#</a><br/>_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#affinity-v1-core)_ | _(Optional)_<br/>Affinity If specified, the pod's scheduling constraints. |
 | configMaps<a href="#vmauthspec-configmaps" id="vmauthspec-configmaps">#</a><br/>_string array_ | _(Optional)_<br/>ConfigMaps is a list of ConfigMaps in the same namespace as the Application<br />object, which shall be mounted into the Application container<br />at /etc/vm/configs/CONFIGMAP_NAME folder |
 | configReloadAuthKeySecret<a href="#vmauthspec-configreloadauthkeysecret" id="vmauthspec-configreloadauthkeysecret">#</a><br/>_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#secretkeyselector-v1-core)_ | _(Optional)_<br/>ConfigReloadAuthKeySecret defines optional secret reference authKey for /-/reload API requests.<br />Given secret reference will be added to the application and vm-config-reloader as volume<br />available since v0.57.0 version |
+| configReloaderEmptyDir<a href="#vmauthspec-configreloaderemptydir" id="vmauthspec-configreloaderemptydir">#</a><br/>_[EmptyDirVolumeSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#emptydirvolumesource-v1-core)_ | _(Optional)_<br/>ConfigReloaderEmptyDir sets emptyDir for reloader ephemeral volume, that is shared with main container |
 | configReloaderExtraArgs<a href="#vmauthspec-configreloaderextraargs" id="vmauthspec-configreloaderextraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ConfigReloaderExtraArgs that will be passed to  VMAuths config-reloader container<br />for example resyncInterval: "30s" |
 | configReloaderImage<a href="#vmauthspec-configreloaderimage" id="vmauthspec-configreloaderimage">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImage defines image:tag for config-reloader container |
 | configReloaderImageTag<a href="#vmauthspec-configreloaderimagetag" id="vmauthspec-configreloaderimagetag">#</a><br/>_string_ | _(Optional)_<br/>ConfigReloaderImageTag defines image:tag for config-reloader container<br />Deprecated: use configReloaderImage instead |
@@ -4090,7 +4093,7 @@ Appears in: [VMAuth](#vmauth)
 | dnsConfig<a href="#vmauthspec-dnsconfig" id="vmauthspec-dnsconfig">#</a><br/>_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#poddnsconfig-v1-core)_ | _(Optional)_<br/>Specifies the DNS parameters of a pod.<br />Parameters specified here will be merged to the generated DNS<br />configuration based on DNSPolicy. |
 | dnsPolicy<a href="#vmauthspec-dnspolicy" id="vmauthspec-dnspolicy">#</a><br/>_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#dnspolicy-v1-core)_ | _(Optional)_<br/>DNSPolicy sets DNS policy for the pod |
 | drop_src_path_prefix_parts<a href="#vmauthspec-drop_src_path_prefix_parts" id="vmauthspec-drop_src_path_prefix_parts">#</a><br/>_integer_ | _(Optional)_<br/>DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#dropping-request-path-prefix) for more details. |
-| dump_request_on_errors<a href="#vmauthspec-dump_request_on_errors" id="vmauthspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br /><br />available since v1.107.0 vmauth version |
+| dump_request_on_errors<a href="#vmauthspec-dump_request_on_errors" id="vmauthspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br />available since v1.107.0 vmauth version |
 | externalConfig<a href="#vmauthspec-externalconfig" id="vmauthspec-externalconfig">#</a><br/>_[ExternalConfig](#externalconfig)_ | _(Optional)_<br/>ExternalConfig defines a source of external VMAuth configuration.<br />If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders |
 | extraArgs<a href="#vmauthspec-extraargs" id="vmauthspec-extraargs">#</a><br/>_object (keys:string, values:string)_ | _(Optional)_<br/>ExtraArgs that will be passed to the application container<br />for example remoteWrite.tmpDataPath: /tmp |
 | extraEnvs<a href="#vmauthspec-extraenvs" id="vmauthspec-extraenvs">#</a><br/>_[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#envvar-v1-core) array_ | _(Optional)_<br/>ExtraEnvs that will be passed to the application container |
@@ -4139,7 +4142,7 @@ Appears in: [VMAuth](#vmauth)
 | tlsConfig<a href="#vmauthspec-tlsconfig" id="vmauthspec-tlsconfig">#</a><br/>_[TLSConfig](#tlsconfig)_ | _(Optional)_<br/>TLSConfig defines tls configuration for the backend connection |
 | tolerations<a href="#vmauthspec-tolerations" id="vmauthspec-tolerations">#</a><br/>_[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#toleration-v1-core) array_ | _(Optional)_<br/>Tolerations If specified, the pod's tolerations. |
 | topologySpreadConstraints<a href="#vmauthspec-topologyspreadconstraints" id="vmauthspec-topologyspreadconstraints">#</a><br/>_[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#topologyspreadconstraint-v1-core) array_ | _(Optional)_<br/>TopologySpreadConstraints embedded kubernetes pod configuration option,<br />controls how pods are spread across your cluster among failure-domains<br />such as regions, zones, nodes, and other user-defined topology domains<br />https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ |
-| unauthorizedAccessConfig<a href="#vmauthspec-unauthorizedaccessconfig" id="vmauthspec-unauthorizedaccessconfig">#</a><br/>_[UnauthorizedAccessConfigURLMap](#unauthorizedaccessconfigurlmap) array_ | _(Required)_<br/>UnauthorizedAccessConfig configures access for un authorized users<br /><br />Deprecated: use unauthorizedUserAccessSpec instead<br />will be removed at v1.0 release |
+| unauthorizedAccessConfig<a href="#vmauthspec-unauthorizedaccessconfig" id="vmauthspec-unauthorizedaccessconfig">#</a><br/>_[UnauthorizedAccessConfigURLMap](#unauthorizedaccessconfigurlmap) array_ | _(Required)_<br/>UnauthorizedAccessConfig configures access for un authorized users<br />Deprecated: use unauthorizedUserAccessSpec instead<br />will be removed at v1.0 release |
 | unauthorizedUserAccessSpec<a href="#vmauthspec-unauthorizeduseraccessspec" id="vmauthspec-unauthorizeduseraccessspec">#</a><br/>_[VMAuthUnauthorizedUserAccessSpec](#vmauthunauthorizeduseraccessspec)_ | _(Optional)_<br/>UnauthorizedUserAccessSpec defines unauthorized_user config section of vmauth config |
 | updateStrategy<a href="#vmauthspec-updatestrategy" id="vmauthspec-updatestrategy">#</a><br/>_[DeploymentStrategyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#deploymentstrategytype-v1-apps)_ | _(Optional)_<br/>UpdateStrategy - overrides default update strategy.<br />Available from operator v0.64.0 |
 | useDefaultResources<a href="#vmauthspec-usedefaultresources" id="vmauthspec-usedefaultresources">#</a><br/>_boolean_ | _(Optional)_<br/>UseDefaultResources controls resource settings<br />By default, operator sets built-in resource requirements |
@@ -4167,7 +4170,7 @@ Appears in: [VMAuthSpec](#vmauthspec)
 | default_url<a href="#vmauthunauthorizeduseraccessspec-default_url" id="vmauthunauthorizeduseraccessspec-default_url">#</a><br/>_string array_ | _(Required)_<br/>DefaultURLs backend url for non-matching paths filter<br />usually used for default backend with error message |
 | discover_backend_ips<a href="#vmauthunauthorizeduseraccessspec-discover_backend_ips" id="vmauthunauthorizeduseraccessspec-discover_backend_ips">#</a><br/>_boolean_ | _(Required)_<br/>DiscoverBackendIPs instructs discovering URLPrefix backend IPs via DNS. |
 | drop_src_path_prefix_parts<a href="#vmauthunauthorizeduseraccessspec-drop_src_path_prefix_parts" id="vmauthunauthorizeduseraccessspec-drop_src_path_prefix_parts">#</a><br/>_integer_ | _(Optional)_<br/>DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#dropping-request-path-prefix) for more details. |
-| dump_request_on_errors<a href="#vmauthunauthorizeduseraccessspec-dump_request_on_errors" id="vmauthunauthorizeduseraccessspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br /><br />available since v1.107.0 vmauth version |
+| dump_request_on_errors<a href="#vmauthunauthorizeduseraccessspec-dump_request_on_errors" id="vmauthunauthorizeduseraccessspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br />available since v1.107.0 vmauth version |
 | headers<a href="#vmauthunauthorizeduseraccessspec-headers" id="vmauthunauthorizeduseraccessspec-headers">#</a><br/>_string array_ | _(Optional)_<br/>Headers represent additional http headers, that vmauth uses<br />in form of ["header_key: header_value"]<br />multiple values for header key:<br />["header_key: value1,value2"]<br />it's available since 1.68.0 version of vmauth |
 | ip_filters<a href="#vmauthunauthorizeduseraccessspec-ip_filters" id="vmauthunauthorizeduseraccessspec-ip_filters">#</a><br/>_[VMUserIPFilters](#vmuseripfilters)_ | _(Optional)_<br/>IPFilters defines per target src ip filters<br />supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/#ip-filters) |
 | load_balancing_policy<a href="#vmauthunauthorizeduseraccessspec-load_balancing_policy" id="vmauthunauthorizeduseraccessspec-load_balancing_policy">#</a><br/>_string_ | _(Optional)_<br/>LoadBalancingPolicy defines load balancing policy to use for backend urls.<br />Supported policies: least_loaded, first_available.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#load-balancing) for more details (default "least_loaded") |
@@ -4968,7 +4971,7 @@ Appears in: [VMAuthSpec](#vmauthspec), [VMAuthUnauthorizedUserAccessSpec](#vmaut
 | default_url<a href="#vmuserconfigoptions-default_url" id="vmuserconfigoptions-default_url">#</a><br/>_string array_ | _(Required)_<br/>DefaultURLs backend url for non-matching paths filter<br />usually used for default backend with error message |
 | discover_backend_ips<a href="#vmuserconfigoptions-discover_backend_ips" id="vmuserconfigoptions-discover_backend_ips">#</a><br/>_boolean_ | _(Required)_<br/>DiscoverBackendIPs instructs discovering URLPrefix backend IPs via DNS. |
 | drop_src_path_prefix_parts<a href="#vmuserconfigoptions-drop_src_path_prefix_parts" id="vmuserconfigoptions-drop_src_path_prefix_parts">#</a><br/>_integer_ | _(Optional)_<br/>DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#dropping-request-path-prefix) for more details. |
-| dump_request_on_errors<a href="#vmuserconfigoptions-dump_request_on_errors" id="vmuserconfigoptions-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br /><br />available since v1.107.0 vmauth version |
+| dump_request_on_errors<a href="#vmuserconfigoptions-dump_request_on_errors" id="vmuserconfigoptions-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br />available since v1.107.0 vmauth version |
 | headers<a href="#vmuserconfigoptions-headers" id="vmuserconfigoptions-headers">#</a><br/>_string array_ | _(Optional)_<br/>Headers represent additional http headers, that vmauth uses<br />in form of ["header_key: header_value"]<br />multiple values for header key:<br />["header_key: value1,value2"]<br />it's available since 1.68.0 version of vmauth |
 | ip_filters<a href="#vmuserconfigoptions-ip_filters" id="vmuserconfigoptions-ip_filters">#</a><br/>_[VMUserIPFilters](#vmuseripfilters)_ | _(Optional)_<br/>IPFilters defines per target src ip filters<br />supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/#ip-filters) |
 | load_balancing_policy<a href="#vmuserconfigoptions-load_balancing_policy" id="vmuserconfigoptions-load_balancing_policy">#</a><br/>_string_ | _(Optional)_<br/>LoadBalancingPolicy defines load balancing policy to use for backend urls.<br />Supported policies: least_loaded, first_available.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#load-balancing) for more details (default "least_loaded") |
@@ -5008,7 +5011,7 @@ Appears in: [VMUser](#vmuser)
 | disable_secret_creation<a href="#vmuserspec-disable_secret_creation" id="vmuserspec-disable_secret_creation">#</a><br/>_boolean_ | _(Required)_<br/>DisableSecretCreation skips related secret creation for vmuser |
 | discover_backend_ips<a href="#vmuserspec-discover_backend_ips" id="vmuserspec-discover_backend_ips">#</a><br/>_boolean_ | _(Required)_<br/>DiscoverBackendIPs instructs discovering URLPrefix backend IPs via DNS. |
 | drop_src_path_prefix_parts<a href="#vmuserspec-drop_src_path_prefix_parts" id="vmuserspec-drop_src_path_prefix_parts">#</a><br/>_integer_ | _(Optional)_<br/>DropSrcPathPrefixParts is the number of `/`-delimited request path prefix parts to drop before proxying the request to backend.<br />See [here](https://docs.victoriametrics.com/victoriametrics/vmauth/#dropping-request-path-prefix) for more details. |
-| dump_request_on_errors<a href="#vmuserspec-dump_request_on_errors" id="vmuserspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br /><br />available since v1.107.0 vmauth version |
+| dump_request_on_errors<a href="#vmuserspec-dump_request_on_errors" id="vmuserspec-dump_request_on_errors">#</a><br/>_boolean_ | _(Optional)_<br/>DumpRequestOnErrors instructs vmauth to return detailed request params to the client<br />if routing rules don't allow to forward request to the backends.<br />Useful for debugging `src_hosts` and `src_headers` based routing rules<br />available since v1.107.0 vmauth version |
 | generatePassword<a href="#vmuserspec-generatepassword" id="vmuserspec-generatepassword">#</a><br/>_boolean_ | _(Optional)_<br/>GeneratePassword instructs operator to generate password for user<br />if spec.password if empty. |
 | headers<a href="#vmuserspec-headers" id="vmuserspec-headers">#</a><br/>_string array_ | _(Optional)_<br/>Headers represent additional http headers, that vmauth uses<br />in form of ["header_key: header_value"]<br />multiple values for header key:<br />["header_key: value1,value2"]<br />it's available since 1.68.0 version of vmauth |
 | ip_filters<a href="#vmuserspec-ip_filters" id="vmuserspec-ip_filters">#</a><br/>_[VMUserIPFilters](#vmuseripfilters)_ | _(Optional)_<br/>IPFilters defines per target src ip filters<br />supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/#ip-filters) |
diff --git a/docs/env.md b/docs/env.md
index f4b012ab9..884811703 100644
--- a/docs/env.md
+++ b/docs/env.md
@@ -9,13 +9,14 @@
 | WATCH_NAMESPACE: `-` <a href="#variables-watch-namespace" id="variables-watch-namespace">#</a><br>Defines a list of namespaces to be watched by operator. Operator don't perform any cluster wide API calls if namespaces not empty. In case of empty list it performs only clusterwide api calls. |
 | VM_CONTAINERREGISTRY: `-` <a href="#variables-vm-containerregistry" id="variables-vm-containerregistry">#</a><br>container registry name prefix, e.g. docker.io |
 | VM_CUSTOMCONFIGRELOADERIMAGE: `-` <a href="#variables-vm-customconfigreloaderimage" id="variables-vm-customconfigreloaderimage">#</a><br>Deprecated: use VM_CONFIG_RELOADER_IMAGE instead |
-| VM_CONFIG_RELOADER_IMAGE: `victoriametrics/operator:config-reloader-${VM_OPERATOR_VERSION}` <a href="#variables-vm-config-reloader-image" id="variables-vm-config-reloader-image">#</a> |
 | VM_PSPAUTOCREATEENABLED: `false` <a href="#variables-vm-pspautocreateenabled" id="variables-vm-pspautocreateenabled">#</a> |
 | VM_ENABLETCP6: `false` <a href="#variables-vm-enabletcp6" id="variables-vm-enabletcp6">#</a> |
-| VM_CONFIG_RELOADER_LIMIT_CPU: `unlimited` <a href="#variables-vm-config-reloader-limit-cpu" id="variables-vm-config-reloader-limit-cpu">#</a><br>defines global resource.limits.cpu for all config-reloader containers |
+| VM_CONFIG_RELOADER_IMAGE: `victoriametrics/operator:config-reloader-${VM_OPERATOR_VERSION}` <a href="#variables-vm-config-reloader-image" id="variables-vm-config-reloader-image">#</a><br>default image for all config-reloader containers |
 | VM_CONFIG_RELOADER_LIMIT_MEMORY: `unlimited` <a href="#variables-vm-config-reloader-limit-memory" id="variables-vm-config-reloader-limit-memory">#</a><br>defines global resource.limits.memory for all config-reloader containers |
-| VM_CONFIG_RELOADER_REQUEST_CPU: `10m` <a href="#variables-vm-config-reloader-request-cpu" id="variables-vm-config-reloader-request-cpu">#</a><br>defines global resource.requests.cpu for all config-reloader containers |
+| VM_CONFIG_RELOADER_LIMIT_CPU: `unlimited` <a href="#variables-vm-config-reloader-limit-cpu" id="variables-vm-config-reloader-limit-cpu">#</a><br>defines global resource.limits.cpu for all config-reloader containers |
 | VM_CONFIG_RELOADER_REQUEST_MEMORY: `25Mi` <a href="#variables-vm-config-reloader-request-memory" id="variables-vm-config-reloader-request-memory">#</a><br>defines global resource.requests.memory for all config-reloader containers |
+| VM_CONFIG_RELOADER_REQUEST_CPU: `10m` <a href="#variables-vm-config-reloader-request-cpu" id="variables-vm-config-reloader-request-cpu">#</a><br>defines global resource.requests.cpu for all config-reloader containers |
+| VM_CONFIG_RELOADER_EMPTY_DIR: `{}` <a href="#variables-vm-config-reloader-empty-dir" id="variables-vm-config-reloader-empty-dir">#</a><br>defines emptyDir configuration for config reloader volume |
 | VM_VLOGSDEFAULT_IMAGE: `victoriametrics/victoria-logs` <a href="#variables-vm-vlogsdefault-image" id="variables-vm-vlogsdefault-image">#</a> |
 | VM_VLOGSDEFAULT_VERSION: `${VM_LOGS_VERSION}` <a href="#variables-vm-vlogsdefault-version" id="variables-vm-vlogsdefault-version">#</a> |
 | VM_VLOGSDEFAULT_PORT: `9428` <a href="#variables-vm-vlogsdefault-port" id="variables-vm-vlogsdefault-port">#</a> |
diff --git a/internal/config/config.go b/internal/config/config.go
index 6ddbf08b1..2fd0a7012 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,6 +1,7 @@
 package config
 
 import (
+	"encoding/json"
 	"fmt"
 	"math/rand"
 	"os"
@@ -13,6 +14,7 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo"
 	"github.com/caarlos0/env/v11"
 	"github.com/prometheus/client_golang/prometheus"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 )
@@ -57,6 +59,19 @@ func getEnvOpts() env.Options {
 	return envOpts
 }
 
+// Resource is useful for generic resource building
+// uses the same memory layout as resources at config
+type Resource struct {
+	Limit struct {
+		Mem string
+		Cpu string
+	}
+	Request struct {
+		Mem string
+		Cpu string
+	}
+}
+
 // ApplicationDefaults is useful for generic default building
 // uses the same memory as application default at config
 type ApplicationDefaults struct {
@@ -76,19 +91,6 @@ type ApplicationDefaults struct {
 	}
 }
 
-// Resource is useful for generic resource building
-// uses the same memory layout as resources at config
-type Resource struct {
-	Limit struct {
-		Mem string
-		Cpu string
-	}
-	Request struct {
-		Mem string
-		Cpu string
-	}
-}
-
 //genvars:true
 type BaseOperatorConf struct {
 	MetricsVersion    string `default:"${VM_METRICS_VERSION}" env:"VM_METRICS_VERSION,expand"`
@@ -107,18 +109,31 @@ type BaseOperatorConf struct {
 	ContainerRegistry string `default:"" env:"VM_CONTAINERREGISTRY"`
 	// Deprecated: use VM_CONFIG_RELOADER_IMAGE instead
 	CustomConfigReloaderImage string `env:"VM_CUSTOMCONFIGRELOADERIMAGE"`
-	ConfigReloaderImage       string `default:"victoriametrics/operator:config-reloader-${VM_OPERATOR_VERSION}" env:"VM_CONFIG_RELOADER_IMAGE,expand"`
 	PSPAutoCreateEnabled      bool   `default:"false" env:"VM_PSPAUTOCREATEENABLED"`
 	EnableTCP6                bool   `default:"false" env:"VM_ENABLETCP6"`
 
-	// defines global resource.limits.cpu for all config-reloader containers
-	ConfigReloaderLimitCPU string `default:"unlimited" env:"VM_CONFIG_RELOADER_LIMIT_CPU"`
-	// defines global resource.limits.memory for all config-reloader containers
-	ConfigReloaderLimitMemory string `default:"unlimited" env:"VM_CONFIG_RELOADER_LIMIT_MEMORY"`
-	// defines global resource.requests.cpu for all config-reloader containers
-	ConfigReloaderRequestCPU string `default:"10m" env:"VM_CONFIG_RELOADER_REQUEST_CPU"`
-	// defines global resource.requests.memory for all config-reloader containers
-	ConfigReloaderRequestMemory string `default:"25Mi" env:"VM_CONFIG_RELOADER_REQUEST_MEMORY"`
+	// defines global config reloader parameters
+	ConfigReloader struct {
+		// default image for all config-reloader containers
+		Image    string `default:"victoriametrics/operator:config-reloader-${VM_OPERATOR_VERSION}" env:",expand"`
+		Resource struct {
+			Limit struct {
+				// defines global resource.limits.memory for all config-reloader containers
+				Mem string `default:"unlimited" env:"MEMORY"`
+				// defines global resource.limits.cpu for all config-reloader containers
+				Cpu string `default:"unlimited"`
+			} `prefix:"LIMIT_"`
+			Request struct {
+				// defines global resource.requests.memory for all config-reloader containers
+				Mem string `default:"25Mi" env:"MEMORY"`
+				// defines global resource.requests.cpu for all config-reloader containers
+				Cpu string `default:"10m"`
+			} `prefix:"REQUEST_"`
+		}
+		// defines emptyDir configuration for config reloader volume
+		EmptyDir string                       `default:"{}"`
+		emptyDir *corev1.EmptyDirVolumeSource `env:"-"`
+	} `prefix:"VM_CONFIG_RELOADER_"`
 
 	VLogsDefault struct {
 		Image               string `default:"victoriametrics/victoria-logs"`
@@ -533,8 +548,13 @@ func (boc *BaseOperatorConf) ResyncAfterDuration() time.Duration {
 	return boc.ForceResyncInterval + time.Duration(p*float64(dv))
 }
 
+// ConfigReloaderEmptyDir returns emptyDir section for config reloader
+func (boc *BaseOperatorConf) ConfigReloaderEmptyDir() *corev1.EmptyDirVolumeSource {
+	return boc.ConfigReloader.emptyDir
+}
+
 // Validate - validates config on best effort.
-func (boc BaseOperatorConf) Validate() error {
+func (boc BaseOperatorConf) validate() error {
 	for _, ns := range boc.WatchNamespaces {
 		if !validNamespaceRegex.MatchString(ns) {
 			return fmt.Errorf("namespace=%q doesn't match regex=%q", ns, validNamespaceRegex.String())
@@ -564,28 +584,9 @@ func (boc BaseOperatorConf) Validate() error {
 		return nil
 	}
 
-	if boc.ConfigReloaderLimitMemory != UnLimitedResource {
-		if _, err := resource.ParseQuantity(boc.ConfigReloaderLimitMemory); err != nil {
-			return fmt.Errorf("cannot parse global config-reloader resource limit memory: %w", err)
-		}
-	}
-	if boc.ConfigReloaderLimitCPU != UnLimitedResource {
-		if _, err := resource.ParseQuantity(boc.ConfigReloaderLimitCPU); err != nil {
-			return fmt.Errorf("cannot parse global config-reloader resource limit cpu: %w", err)
-		}
-	}
-
-	if len(boc.ConfigReloaderRequestMemory) > 0 && boc.ConfigReloaderRequestMemory != UnLimitedResource {
-		if _, err := resource.ParseQuantity(boc.ConfigReloaderRequestMemory); err != nil {
-			return fmt.Errorf("cannot parse global config-reloader resource request memory: %w", err)
-		}
-	}
-	if len(boc.ConfigReloaderRequestCPU) > 0 && boc.ConfigReloaderRequestCPU != UnLimitedResource {
-		if _, err := resource.ParseQuantity(boc.ConfigReloaderRequestCPU); err != nil {
-			return fmt.Errorf("cannot parse global config-reloader resource request cpu: %w", err)
-		}
+	if err := validateResource("config-reloader", Resource(boc.ConfigReloader.Resource)); err != nil {
+		return err
 	}
-
 	if err := validateResource("vmagent", Resource(boc.VMAgentDefault.Resource)); err != nil {
 		return err
 	}
@@ -654,9 +655,14 @@ func MustGetBaseConfig() *BaseOperatorConf {
 			panic(err)
 		}
 		if c.CustomConfigReloaderImage != "" {
-			c.ConfigReloaderImage = c.CustomConfigReloaderImage
+			c.ConfigReloader.Image = c.CustomConfigReloaderImage
+		}
+		var emptyDir corev1.EmptyDirVolumeSource
+		if err := json.Unmarshal([]byte(c.ConfigReloader.EmptyDir), &emptyDir); err != nil {
+			panic(fmt.Errorf(`failed to parse VM_CONFIG_RELOADER_EMPTY_DIR value %q as JSON object for EmptyDirVolumeSource (example: {"medium":"Memory","sizeLimit":"1Gi"}): %w`, c.ConfigReloader.EmptyDir, err))
 		}
-		if err := c.Validate(); err != nil {
+		c.ConfigReloader.emptyDir = &emptyDir
+		if err := c.validate(); err != nil {
 			panic(err)
 		}
 		opConf = &c
diff --git a/internal/controller/operator/factory/build/defaults.go b/internal/controller/operator/factory/build/defaults.go
index 46e5df262..cd5bb49cd 100644
--- a/internal/controller/operator/factory/build/defaults.go
+++ b/internal/controller/operator/factory/build/defaults.go
@@ -583,27 +583,15 @@ func addDefaultsToConfigReloader(common *vmv1beta1.CommonConfigReloaderParams, u
 		if common.ConfigReloaderImageTag != "" {
 			common.ConfigReloaderImage = common.ConfigReloaderImageTag
 		} else {
-			common.ConfigReloaderImage = c.ConfigReloaderImage
+			common.ConfigReloaderImage = c.ConfigReloader.Image
 		}
 	}
+	if common.ConfigReloaderEmptyDir == nil {
+		common.ConfigReloaderEmptyDir = c.ConfigReloaderEmptyDir()
+	}
 
 	common.ConfigReloaderImage = formatContainerImage(c.ContainerRegistry, common.ConfigReloaderImage)
-	common.ConfigReloaderResources = Resources(common.ConfigReloaderResources, config.Resource{
-		Limit: struct {
-			Mem string
-			Cpu string
-		}{
-			Cpu: c.ConfigReloaderLimitCPU,
-			Mem: c.ConfigReloaderLimitMemory,
-		},
-		Request: struct {
-			Mem string
-			Cpu string
-		}{
-			Cpu: c.ConfigReloaderRequestCPU,
-			Mem: c.ConfigReloaderRequestMemory,
-		},
-	}, useDefaultResources)
+	common.ConfigReloaderResources = Resources(common.ConfigReloaderResources, config.Resource(c.ConfigReloader.Resource), useDefaultResources)
 }
 
 func addDefaultsToVMBackup(cr *vmv1beta1.VMBackup, useDefaultResources bool, appDefaults *config.ApplicationDefaults) {
diff --git a/internal/controller/operator/factory/vmagent/vmagent.go b/internal/controller/operator/factory/vmagent/vmagent.go
index fb5534832..2b5be47d9 100644
--- a/internal/controller/operator/factory/vmagent/vmagent.go
+++ b/internal/controller/operator/factory/vmagent/vmagent.go
@@ -566,7 +566,7 @@ func newPodSpec(cr *vmv1beta1.VMAgent, ac *build.AssetsCache) (*corev1.PodSpec,
 		volumes = append(volumes, corev1.Volume{
 			Name: "config-out",
 			VolumeSource: corev1.VolumeSource{
-				EmptyDir: &corev1.EmptyDirVolumeSource{},
+				EmptyDir: cr.Spec.ConfigReloaderEmptyDir,
 			},
 		})
 		volumes = append(volumes, corev1.Volume{
diff --git a/internal/controller/operator/factory/vmalertmanager/statefulset.go b/internal/controller/operator/factory/vmalertmanager/statefulset.go
index 2ec708707..362a51874 100644
--- a/internal/controller/operator/factory/vmalertmanager/statefulset.go
+++ b/internal/controller/operator/factory/vmalertmanager/statefulset.go
@@ -256,7 +256,7 @@ func makeStatefulSetSpec(cr *vmv1beta1.VMAlertmanager) (*appsv1.StatefulSetSpec,
 		{
 			Name: configVolumeName,
 			VolumeSource: corev1.VolumeSource{
-				EmptyDir: &corev1.EmptyDirVolumeSource{},
+				EmptyDir: cr.Spec.ConfigReloaderEmptyDir,
 			},
 		},
 		// use a different volume mount for the case of vm config-reloader
diff --git a/internal/controller/operator/factory/vmauth/vmauth.go b/internal/controller/operator/factory/vmauth/vmauth.go
index 764641709..5e40e17b2 100644
--- a/internal/controller/operator/factory/vmauth/vmauth.go
+++ b/internal/controller/operator/factory/vmauth/vmauth.go
@@ -305,7 +305,7 @@ func makeSpecForVMAuth(cr *vmv1beta1.VMAuth) (*corev1.PodTemplateSpec, error) {
 		volumes = append(volumes, corev1.Volume{
 			Name: "config-out",
 			VolumeSource: corev1.VolumeSource{
-				EmptyDir: &corev1.EmptyDirVolumeSource{},
+				EmptyDir: cr.Spec.ConfigReloaderEmptyDir,
 			},
 		})
 		m := corev1.VolumeMount{