/usr/bin/kubeadm-control-plane-controller

Usage of /usr/bin/kubeadm-control-plane-controller:
      --clustercache-client-burst int                        Maximum number of queries that should be allowed in one burst from the cluster cache clients to the Kubernetes API server of workload clusters. (default 30)
      --clustercache-client-qps float32                      Maximum queries per second from the cluster cache clients to the Kubernetes API server of workload clusters. (default 20)
      --clustercache-concurrency int                         Number of clusters to process simultaneously (default 100)
      --contention-profiling                                 Enable block profiling
      --diagnostics-address string                           The address the diagnostics endpoint binds to. Per default metrics are served via https and withauthentication/authorization. To serve via http and without authentication/authorization set --insecure-diagnostics. If --insecure-diagnostics is not set the diagnostics endpoint also serves pprof endpoints and an endpoint to change the log level. (default ":8443")
      --etcd-call-timeout-duration duration                  Duration that the etcd client waits at most for read and write operations to etcd. (default 15s)
      --etcd-client-log-level string                         Logging level for etcd client. Possible values are: debug, info, warn, error, dpanic, panic, fatal. (default "info")
      --etcd-dial-timeout-duration duration                  Duration that the etcd client waits at most to establish a connection with etcd (default 10s)
      --feature-gates mapStringBool                          A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                                             AllAlpha=true|false (ALPHA - default=false)
                                                             AllBeta=true|false (BETA - default=false)
                                                             ClusterResourceSet=true|false (BETA - default=true)
                                                             ClusterTopology=true|false (ALPHA - default=false)
                                                             KubeadmBootstrapFormatIgnition=true|false (ALPHA - default=false)
                                                             MachinePool=true|false (BETA - default=true)
                                                             MachineSetPreflightChecks=true|false (BETA - default=true)
                                                             MachineWaitForVolumeDetachConsiderVolumeAttachments=true|false (BETA - default=true)
                                                             RuntimeSDK=true|false (ALPHA - default=false)
      --health-addr string                                   The address the health endpoint binds to. (default ":9440")
      --insecure-diagnostics                                 Enable insecure diagnostics serving. For more details see the description of --diagnostics-address.
      --kube-api-burst int                                   Maximum number of queries that should be allowed in one burst from the controller client to the Kubernetes API server. (default 30)
      --kube-api-qps float32                                 Maximum queries per second from the controller client to the Kubernetes API server. (default 20)
      --kubeadmcontrolplane-concurrency int                  Number of kubeadm control planes to process simultaneously (default 10)
      --kubeconfig string                                    Paths to a kubeconfig. Only required if out-of-cluster.
      --leader-elect                                         Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --leader-elect-lease-duration duration                 Interval at which non-leader candidates will wait to force acquire leadership (duration string) (default 1m0s)
      --leader-elect-renew-deadline duration                 Duration that the leading controller manager will retry refreshing leadership before giving up (duration string) (default 40s)
      --leader-elect-retry-period duration                   Duration the LeaderElector clients should wait between tries of actions (duration string) (default 5s)
      --log-flush-frequency duration                         Maximum number of seconds between log flushes (default 5s)
      --log-json-info-buffer-size quantity                   [Alpha] In JSON format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-json-split-stream                                [Alpha] In JSON format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-info-buffer-size quantity                   [Alpha] In text format with split output streams, the info messages can be buffered for a while to increase performance. The default value of zero bytes disables buffering. The size can be specified as number of bytes (512), multiples of 1000 (1K), multiples of 1024 (2Ki), or powers of those (3M, 4G, 5Mi, 6Gi). Enable the LoggingAlphaOptions feature gate to use this.
      --log-text-split-stream                                [Alpha] In text format, write error messages to stderr and info messages to stdout. The default is to write a single stream to stdout. Enable the LoggingAlphaOptions feature gate to use this.
      --logging-format string                                Sets the log format. Permitted formats: "json" (gated by LoggingBetaOptions), "text". (default "text")
      --namespace string                                     Namespace that the controller watches to reconcile cluster-api objects. If unspecified, the controller watches for cluster-api objects across all namespaces.
      --profiler-address string                              Bind address to expose the pprof profiler (e.g. localhost:6060)
      --remote-conditions-grace-period APIServerPodHealthy   Grace period after which remote conditions (e.g. APIServerPodHealthy) are set to `Unknown`, the grace period starts from the last successful health probe to the workload cluster (default 5m0s)
      --sync-period duration                                 The minimum interval at which watched resources are reconciled (e.g. 15m) (default 10m0s)
      --tls-cipher-suites strings                            Comma-separated list of cipher suites for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). If omitted, the default Go cipher suites will be used.
                                                             Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                             Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-min-version string                               The minimum TLS version in use by the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true).
                                                             Possible values are VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. (default "VersionTLS12")
  -v, --v Level                                              number for the log level verbosity (default 0)
      --vmodule pattern=N,...                                comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)
      --watch-filter string                                  Label value that the controller watches to reconcile cluster-api objects. Label key is always cluster.x-k8s.io/watch-filter. If unspecified, the controller watches for all cluster-api objects.
      --webhook-cert-dir string                              Webhook cert dir. (default "/tmp/k8s-webhook-server/serving-certs/")
      --webhook-cert-name string                             Webhook cert name. (default "tls.crt")
      --webhook-key-name string                              Webhook key name. (default "tls.key")
      --webhook-port int                                     Webhook Server port (default 9443)
pflag: help requested