Usage of /usr/bin/manager:
  -blocker-refresh-interval duration
    	Minimum interval between Deferred/Infeasible blocker recomputes when not resizing. Zero (default) recomputes every reconcile; set e.g. 5m for large Recommend fleets.
  -collector-ttl duration
    	How long unused Prometheus collectors stay cached before eviction. (default 10m0s)
  -datadog-api-key-secret string
    	Name of a Secret in the operator namespace holding the Datadog API key. Used only when cluster AttuneDefaults chose the Datadog block, not a policy or AttuneNamespaceDefaults block. Empty keeps the policy-namespace lookup of apiKeySecretRef. An optional app-key in the same Secret is still read.
  -datadog-api-key-secret-key string
    	Key in --datadog-api-key-secret that holds the Datadog API key. (default "api-key")
  -enable-webhooks
    	Enable admission webhooks for defaulting and validation. (default true)
  -fleet-report-cluster-id string
    	Optional cluster identifier written into the fleet report (e.g. prod-us-east-1).
  -fleet-report-configmap string
    	Name of the fleet report ConfigMap. (default "attune-fleet-report")
  -fleet-report-enabled
    	When true, periodically write a versioned fleet summary ConfigMap for multi-cluster collectors.
  -fleet-report-interval duration
    	How often to refresh the fleet report ConfigMap when enabled. (default 5m0s)
  -fleet-report-namespace string
    	Namespace for the fleet report ConfigMap. Defaults to the pod namespace (POD_NAMESPACE) or attune-system.
  -health-probe-bind-address string
    	The address the health probe endpoint binds to. (default ":8081")
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -leader-elect
    	Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
  -max-concurrent-reconciles int
    	Maximum number of AttunePolicy reconciles running in parallel. Increase for large clusters with many policies. Helm clusterSize presets raise this further. (default 2)
  -max-history-window duration
    	Optional operator-level ceiling for metrics historyWindow (e.g. 72h for large fleets). Zero disables extra clamp.
  -max-pods-in-metrics-query int
    	When a workload has more pods than this, sample this many for metrics pod=~ regexes. Negative disables sampling. (default 100)
  -max-profile-samples int
    	Maximum samples passed to recommendation BuildProfile after downsampling. Negative disables the cap. (default 10000)
  -max-prometheus-series int
    	Maximum series kept from a Prometheus range query matrix. Zero uses the collector default; negative disables the cap. (default 5000)
  -max-status-recommendations int
    	Default cap for status.recommendations entries (full set still used for resizes). Overridable per policy. (default 100)
  -max-workload-workers int
    	Maximum parallel workers processing workloads within a single AttunePolicy reconcile. (default 10)
  -metrics-bind-address string
    	The address the metrics endpoint binds to. (default ":8080")
  -min-query-step duration
    	Optional operator-level floor for metrics queryStep (e.g. 10m for large fleets). Zero disables extra clamp.
  -pod-label-selector string
    	Optional Kubernetes label selector for operator pod keep diagnostics and future ListWatch filtering (e.g. 'attune.io/managed=true'). Combined with dynamic selectors from active policies. All watched pods are field-stripped; empty Spec stubs are not used.
  -prometheus-bearer-token-key string
    	Key in --prometheus-bearer-token-secret that holds the bearer token. (default "token")
  -prometheus-bearer-token-secret string
    	Name of a Secret in the operator namespace. Sent as Prometheus bearer auth only for an address taken from cluster AttuneDefaults, when resolved headers do not already include Authorization. A policy-set bearerTokenSecret is read in the policy namespace and does not fall back. An inherited cluster name falls back only when that Secret is NotFound.
  -prometheus-burst int
    	Maximum burst for Prometheus query throttle. (default 20)
  -prometheus-qps float
    	Maximum Prometheus queries per second. Increase for large clusters with many policies. (default 10)
  -prometheus-query-service-account string
    	TokenRequest this ServiceAccount in the operator namespace instead of the manager projected token. Enables operator Prometheus bearer auth with the same address rules as --prometheus-use-service-account-token.
  -prometheus-timeout duration
    	Maximum time allowed for workload processing (including Prometheus queries) during a single reconciliation cycle. If exceeded, partial results are used and the status condition indicates the timeout. (default 5m0s)
  -prometheus-use-service-account-token
    	When true, send operator Prometheus bearer auth for addresses from cluster AttuneDefaults (not policy, namespace defaults, or auto-discovery, and not when Authorization headers are already set).
  -requeue-jitter duration
    	Maximum extra delay added only to full cooldown RequeueAfter values. Skipped while Ready is InsufficientData or MetricsUnavailable. Set to 0 to disable. (default 2m0s)
  -sigv4-allowed-role-arns value
    	Repeatable glob of IAM role ARNs a namespace author may set on sigv4.roleArn or cloudwatch.roleArn. * matches any characters, including /. Empty rejects those fields. Cluster AttuneDefaults is not filtered.
  -sigv4-allowed-workspace-hosts value
    	Repeatable glob of Prometheus hosts a namespace author may sign with sigv4 and no roleArn. Empty rejects that shape. Cluster AttuneDefaults is not filtered.
  -slo-guardrail-enforce-namespace
    	When true, tenant SLO guardrails that would use operator Prometheus credentials gain namespace=<policy namespace> on every selector. A conflicting matcher is not sent. When false, those guardrails are skipped. (default true)
  -status-include-explanations
    	When true, write recommendation explanation chains to status. Overridable per policy. (default true)
  -watch-namespaces string
    	Comma-separated list of namespaces to watch. Empty means all namespaces (cluster-scoped). Reduces informer cache memory on large clusters where policies exist in a few namespaces. Run multiple controller instances with disjoint lists to shard by namespace.
  -weekly-report-enabled
    	When true, post one cluster rightsizing report per ISO week. Default off.
  -weekly-report-endpoint value
    	Repeatable chat endpoint as name/secretName/secretKey. The URL is a key in that Secret in the operator namespace. At most two.
  -zap-devel
    	Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
  -zap-encoder value
    	Zap log encoding (one of 'json' or 'console')
  -zap-log-level value
    	Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic' or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
  -zap-stacktrace-level value
    	Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
  -zap-time-encoding value
    	Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.