vmagent remoteWrite seems to ignore oauth2 configuration.

[TheDJVG]

I have the VMAgent object configured with the following remoteWrite:

  remoteWrite:
  - oauth2:
      clientIDSecret:
        key: remote-write-client
        name: project-secrets
      clientSecret:
        key: remote-write-secret
        name: project-secrets
      tokenURL: <redacted>
    url: https://metrics.<redacted>/api/v1/write
  - url: http://vmsingle-vmks-victoria-metrics-k8s-stack.victoria-metrics.svc.cluster.local.:8428/api/v1/write

I can see the operator updating the spec:

{
  "level": "info",
  "ts": "2026-08-07T14:34:51Z",
  "logger": "controller.VMAgent",
  "msg": "updating Deployment name=victoria-metrics/vmagent-vmks-victoria-metrics-k8s-stack, is_prev_nil=false",
  "vmagent": "vmks-victoria-metrics-k8s-stack",
  "namespace": "victoria-metrics",
  "spec_diff": {
    "spec.template.spec.containers[0].args[7]": {
      "--": "-remoteWrite.url=http://vmsingle-vmks-victoria-metrics-k8s-stack.victoria-metrics.svc.cluster.local.:8428/api/v1/write",
      "++": "-remoteWrite.url=https://metrics.<redacted>/api/v1/write,http://vmsingle-vmks-victoria-metrics-k8s-stack.victoria-metrics.svc.cluster.local.:8428/api/v1/write"
    }
  }
}

However it does not seem to set any of the auth related remoteWrite settings and thus unable to write to a protected endpoint.

Running operator victoriametrics/operator:v0.74.0

[AndrewChubatiuk]

problem is that you are relying on a wrong Oauth2 section in docs. both v1 and v1beta1 packages have OAuth2 and their IDs collide, so you're routed to invalid one. working on a fix for docs. for now just check a proper OAuth2 section in v1beta1

[TheDJVG]

Thanks for pointing that out and that was indeed the case, configured using v1beta1 and it's working as expected. Looking back I should've been able to spot it as the "Appears In" section linked did not include VMAgent.

Thanks for the quick followup!