Usage of /usr/bin/cluster-api-azure-controller:
      --add_dir_header                            If true, adds the file directory to the header of the log messages
      --alsologtostderr                           log to standard error as well as files (no effect when -logtostderr=true)
      --alsologtostderrthreshold severity         logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)
      --api-call-timeout duration                 The maximum duration CAPZ will wait for each Azure API request before it is considered long running and performed async (e.g. 10s) (default 2s)
      --azurecluster-concurrency int              Number of AzureClusters to process simultaneously (default 10)
      --azuremachine-concurrency int              Number of AzureMachines to process simultaneously (default 10)
      --azuremachinepool-concurrency int          Number of AzureMachinePools to process simultaneously (default 10)
      --azuremachinepoolmachine-concurrency int   Number of AzureMachinePoolMachines to process simultaneously (default 10)
      --bootstrap-config-gvk string               (Deprecated) Provide fully qualified GVK string to override default kubeadm config watch source, in the form of Kind.version.group (default: KubeadmConfig.v1beta1.bootstrap.cluster.x-k8s.io)
      --debouncing-timer duration                 The minimum interval the controller should wait after a successful reconciliation of a particular object before reconciling it again (default 10s)
      --diagnostics-address string                The address the diagnostics endpoint binds to. Per default metrics are served via https and withauthentication/authorization. To serve via http and without authentication/authorization set --insecure-diagnostics. If --insecure-diagnostics is not set the diagnostics endpoint also serves pprof endpoints and an endpoint to change the log level. (default ":8443")
      --disable-controllers-or-webhooks strings   Comma-separated list of controllers or webhooks to disable. The list can contain the following values: DisableASOSecretController,DisableAzureJSONMachineController
      --enable-tracing                            Enable tracing to the opentelemetry-collector service in the same namespace.
      --feature-gates mapStringBool               A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                                  AKSResourceHealth=true|false (ALPHA - default=false)
                                                  APIServerILB=true|false (ALPHA - default=false)
                                                  AllAlpha=true|false (ALPHA - default=false)
                                                  AllBeta=true|false (BETA - default=false)
                                                  ClusterTopology=true|false (ALPHA - default=false)
                                                  EdgeZone=true|false (ALPHA - default=false)
                                                  InPlaceUpdates=true|false (ALPHA - default=false)
                                                  KubeadmBootstrapFormatIgnition=true|false (ALPHA - default=false)
                                                  MachinePool=true|false (BETA - default=true)
                                                  MachineSetPreflightChecks=true|false (BETA - default=true)
                                                  MachineTaintPropagation=true|false (ALPHA - default=false)
                                                  PriorityQueue=true|false (BETA - default=true)
                                                  ReconcilerRateLimiting=true|false (BETA - default=true)
                                                  RuntimeSDK=true|false (ALPHA - default=false)
                                                  SkipMachinePoolModelReconciliation=true|false (ALPHA - default=false)
      --health-addr string                        The address the health endpoint binds to. (default ":9440")
      --insecure-diagnostics                      Enable insecure diagnostics serving. For more details see the description of --diagnostics-address.
      --kubeconfig string                         Paths to a kubeconfig. Only required if out-of-cluster.
      --leader-elect                              Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --leader-elect-lease-duration duration      Interval at which non-leader candidates will wait to force acquire leadership (duration string) (default 15s)
      --leader-elect-renew-deadline duration      Duration that the leading controller manager will retry refreshing leadership before giving up (duration string) (default 10s)
      --leader-elect-retry-period duration        Duration the LeaderElector clients should wait between tries of actions (duration string) (default 2s)
      --leader-election-namespace string          Namespace that the controller performs leader election in. If unspecified, the controller will discover which namespace it is running in.
      --legacy_stderr_threshold_behavior          If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true)
      --log_backtrace_at traceLocation            when logging hits line file:N, emit a stack trace (default :0)
      --log_dir string                            If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log_file string                           If non-empty, use this log file (no effect when -logtostderr=true)
      --log_file_max_size uint                    Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                               log to standard error instead of files (default true)
      --namespace string                          Namespace that the controller watches to reconcile cluster-api objects. If unspecified, the controller watches for cluster-api objects across all namespaces.
      --one_output                                If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --profiler-address string                   Bind address to expose the pprof profiler (e.g. localhost:6060)
      --reconcile-timeout duration                The maximum duration a reconcile loop can run (e.g. 10m) (default 1h30m0s)
      --reconciler-requeue duration               The duration to wait before retrying after a transient reconcile error occurs (e.g. 15s) (default 15s)
      --service-reconcile-timeout duration        The maximum duration each Azure service reconcile can run (e.g. 90m) (default 12s)
      --skip_headers                              If true, avoid header prefixes in the log messages
      --skip_log_headers                          If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --stderrthreshold severity                  logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)
      --sync-period duration                      The minimum interval at which watched resources are reconciled (e.g. 15m) (default 10m0s)
      --tls-cipher-suites strings                 Comma-separated list of cipher suites for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). If omitted, the default Go cipher suites will be used.
                                                  Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                  Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-curve-preferences int32Slice          Comma-separated list of numeric Go crypto/tls CurveID values, as the allowed key exchange mechanisms for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). The supported values depend on the Go version used. See https://pkg.go.dev/crypto/tls#CurveID for values supported for each Go version. The order of the list is ignored, and key exchange mechanisms are chosen by Go from this list using an internal preference order. If omitted, the default Go curves will be used. (default [])
      --tls-min-version string                    The minimum TLS version in use by the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true).
                                                  Possible values are VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. (default "VersionTLS12")
  -v, --v Level                                   number for the log level verbosity
      --vmodule moduleSpec                        comma-separated list of pattern=N settings for file-filtered logging
      --watch-filter string                       Label value that the controller watches to reconcile cluster-api objects. Label key is always cluster.x-k8s.io/watch-filter. If unspecified, the controller watches for all cluster-api objects.
      --webhook-cert-dir string                   The webhook certificate directory, where the server should find the TLS certificate and key. (default "/tmp/k8s-webhook-server/serving-certs/")
      --webhook-port int                          The webhook server port the manager will listen on. (default 9443)