/usr/bin/controller

Usage of /usr/bin/controller:
      --additional-sync-machine-annotations strings   List of regexes to select an additional set of labels to sync from a Machine to its associated Node. An annotation will be synced as long as it matches at least one of the regexes.
      --additional-sync-machine-labels strings        List of regexes to select an additional set of labels to sync from a Machine to its associated Node. A label will be synced as long as it matches at least one of the regexes.
      --cluster-concurrency int                       Number of clusters to process simultaneously (default 50)
      --clustercache-client-burst int                 Maximum number of queries that should be allowed in one burst from the cluster cache clients to the Kubernetes API server of workload clusters. (default 30)
      --clustercache-client-qps float32               Maximum queries per second from the cluster cache clients to the Kubernetes API server of workload clusters. (default 20)
      --clustercache-concurrency int                  Number of clusters to process simultaneously (default 100)
      --clusterclass-concurrency int                  Number of ClusterClasses to process simultaneously (default 10)
      --clusterresourceset-concurrency int            Number of cluster resource sets to process simultaneously (default 10)
      --clustertopology-concurrency int               Number of clusters to process simultaneously (default 50)
      --contention-profiling                          Enable block profiling
      --diagnostics-address string                    The address the diagnostics endpoint binds to. Per default metrics are served via https and withauthentication/authorization. To serve via http and without authentication/authorization set --insecure-diagnostics. If --insecure-diagnostics is not set the diagnostics endpoint also serves pprof endpoints and an endpoint to change the log level. (default ":8443")
      --extensionconfig-concurrency int               Number of extension configs to process simultaneously (default 10)
      --feature-gates mapStringBool                   A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                                      AllAlpha=true|false (ALPHA - default=false)
                                                      AllBeta=true|false (BETA - default=false)
                                                      ClusterTopology=true|false (ALPHA - default=false)
                                                      InPlaceUpdates=true|false (ALPHA - default=false)
                                                      KubeadmBootstrapFormatIgnition=true|false (ALPHA - default=false)
                                                      MachinePool=true|false (BETA - default=true)
                                                      MachineSetPreflightChecks=true|false (BETA - default=true)
                                                      MachineTaintPropagation=true|false (ALPHA - default=false)
                                                      PriorityQueue=true|false (BETA - default=true)
                                                      ReconcilerRateLimiting=true|false (BETA - default=true)
                                                      RuntimeSDK=true|false (ALPHA - default=false)
      --health-addr string                            The address the health endpoint binds to. (default ":9440")
      --insecure-diagnostics                          Enable insecure diagnostics serving. For more details see the description of --diagnostics-address.
      --kube-api-burst int                            Maximum number of queries that should be allowed in one burst from the controller client to the Kubernetes API server. (default 200)
      --kube-api-qps float32                          Maximum queries per second from the controller client to the Kubernetes API server. (default 100)
      --kubeconfig string                             Paths to a kubeconfig. Only required if out-of-cluster.
      --leader-elect                                  Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --leader-elect-lease-duration duration          Interval at which non-leader candidates will wait to force acquire leadership (duration string) (default 15s)
      --leader-elect-renew-deadline duration          Duration that the leading controller manager will retry refreshing leadership before giving up (duration string) (default 10s)
      --leader-elect-retry-period duration            Duration the LeaderElector clients should wait between tries of actions (duration string) (default 2s)
      --log-flush-frequency duration                  Maximum number of seconds between log flushes (default 5s)
      --log-json-info-buffer-size quantity            [Alpha] In JSON format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-json-split-stream                         [Alpha] In JSON format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-info-buffer-size quantity            [Alpha] In text format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-split-stream                         [Alpha] In text format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --logging-format string                         Sets the log format. Permitted formats: "json" (gated by LoggingBetaOptions), "text". (default "text")
      --machine-concurrency int                       Number of machines to process simultaneously (default 100)
      --machinedeployment-concurrency int             Number of machine deployments to process simultaneously (default 50)
      --machinehealthcheck-concurrency int            Number of machine health checks to process simultaneously (default 50)
      --machinepool-concurrency int                   Number of machine pools to process simultaneously (default 50)
      --machineset-concurrency int                    Number of machine sets to process simultaneously (default 50)
      --machineset-preflight-checks strings           List of MachineSet preflight checks that should be run. Per default all of them are enabled.Set this flag to only enable a subset of them. The MachineSet preflight checks can be then also disabledon MachineSets via the 'machineset.cluster.x-k8s.io/skip-preflight-checks' annotation.Valid values are: All or a list of KubeadmVersionSkew, KubernetesVersionSkew, ControlPlaneIsStable, ControlPlaneVersionSkew (default [All])
      --namespace string                              Namespace that the controller watches to reconcile cluster-api objects. If unspecified, the controller watches for cluster-api objects across all namespaces.
      --profiler-address string                       Bind address to expose the pprof profiler (e.g. localhost:6060)
      --remote-conditions-grace-period NodeHealthy    Grace period after which remote conditions (e.g. NodeHealthy) are set to `Unknown`, the grace period starts from the last successful health probe to the workload cluster (default 5m0s)
      --remote-connection-grace-period False          Grace period after which the RemoteConnectionProbe condition on a Cluster goes to False, the grace period starts from the last successful health probe to the workload cluster (default 50s)
      --runtime-extension-client-cert-file string     Path of the PEM-encoded client certificate to be used when calling runtime extensions.
      --runtime-extension-client-key-file string      Path of the PEM-encoded client key to be used when calling runtime extensions.
      --skip-crd-migration-phases strings             List of CRD migration phases to skip. Valid values are: StorageVersionMigration, CleanupManagedFields.
      --sync-period duration                          The minimum interval at which watched resources are reconciled (e.g. 15m) (default 10m0s)
      --tls-cipher-suites strings                     Comma-separated list of cipher suites for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). If omitted, the default Go cipher suites will be used.
                                                      Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                      Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-curve-preferences int32Slice              Comma-separated list of numeric Go crypto/tls CurveID values, as the allowed key exchange mechanisms for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). The supported values depend on the Go version used. See https://pkg.go.dev/crypto/tls#CurveID for values supported for each Go version. The order of the list is ignored, and key exchange mechanisms are chosen by Go from this list using an internal preference order. If omitted, the default Go curves will be used. (default [])
      --tls-min-version string                        The minimum TLS version in use by the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true).
                                                      Possible values are VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. (default "VersionTLS12")
  -v, --v Level                                       number for the log level verbosity
      --vmodule pattern=N,...                         comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)
      --watch-filter string                           Label value that the controller watches to reconcile cluster-api objects. Label key is always cluster.x-k8s.io/watch-filter. If unspecified, the controller watches for all cluster-api objects.
      --webhook-cert-dir string                       Webhook cert dir. (default "/tmp/k8s-webhook-server/serving-certs/")
      --webhook-cert-name string                      Name of the file for webhook's server certificate; the file must be placed under webhook-cert-dir. (default "tls.crt")
      --webhook-key-name string                       Name of the file for webhook's server key; the file must be placed under webhook-cert-dir. (default "tls.key")
      --webhook-port int                              Webhook Server port (default 9443)