Usage of AI Gateway Controller:
  -caBundleName string
    	The name of the CA bundle file. (default "ca.crt")
  -cacheSyncTimeout duration
    	Maximum time to wait for k8s caches to sync (default 2m0s)
  -enableLeaderElection
    	Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. (default true)
  -endpointPrefixes string
    	Comma-separated key-value pairs for endpoint prefixes. Format: openai:/,cohere:/cohere,anthropic:/anthropic,typesafe:/typesafe.
  -envoyGatewayNamespace string
    	The namespace where Envoy Gateway is deployed. (default "envoy-gateway-system")
  -extProcEnableRedaction
    	Enable redaction of sensitive information in debug logs for the external processor.
  -extProcExtraEnvVars string
    	Semicolon-separated key=value pairs for extra environment variables in extProc container. Format: OTEL_SERVICE_NAME=ai-gateway;OTEL_TRACES_EXPORTER=otlp
  -extProcImage string
    	The image for the external processor (default "docker.io/envoyproxy/ai-gateway-extproc:latest")
  -extProcImagePullPolicy string
    	The image pull policy for the external processor. One of 'Always', 'Never', 'IfNotPresent' (default "IfNotPresent")
  -extProcImagePullSecrets string
    	Semicolon-separated list of image pull secret names for extProc container. Format: my-registry-secret;another-secret
  -extProcLogFormat string
    	The log output format for the external processor. One of 'text' or 'json'. (default "text")
  -extProcLogLevel string
    	The log level for the external processor. One of 'debug', 'info', 'warn', or 'error'. (default "info")
  -extProcMaxRecvMsgSize int
    	Maximum message size in bytes that the gRPC server can receive for extProc. Default is 512MB. (default 536870912)
  -logFormat string
    	The log output format for the controller manager. One of 'text' or 'json'. (default "text")
  -logLevel string
    	The log level for the controller manager. One of 'debug', 'info', 'warn', or 'error'. (default "info")
  -logRequestHeaderAttributes value
    	Comma-separated key-value pairs for mapping HTTP request headers to access log attributes. Format: agent-session-id:session.id,x-tenant-id:tenant.id. Default: agent-session-id:session.id (when unset). Set to empty to disable.
  -maxRecvMsgSize int
    	Maximum message size in bytes that the gRPC extension server can receive. Default is 4MB. (default 4194304)
  -mcpFallbackSessionEncryptionIterations int
    	Number of iterations used in the fallback PBKDF2 key derivation for MCP session encryption. (default 100000)
  -mcpFallbackSessionEncryptionSeed string
    	Optional fallback seed used for MCP session key rotation. Prefer the MCP_FALLBACK_SESSION_ENCRYPTION_SEED environment variable to keep it out of the process command line.
  -mcpSessionEncryptionIterations int
    	Number of iterations to use for PBKDF2 key derivation for MCP session encryption. (default 100000)
  -mcpSessionEncryptionSeed string
    	Seed used to derive the MCP session encryption key. This should be changed and set to a secure value. Prefer the MCP_SESSION_ENCRYPTION_SEED environment variable to keep it out of the process command line. (default "default-insecure-seed")
  -metricsRequestHeaderAttributes value
    	Comma-separated key-value pairs for mapping HTTP request headers to Otel metric attributes. Format: x-tenant-id:tenant.id,x-tenant-id:tenant.id.
  -port string
    	gRPC port for the extension server (default ":1063")
  -quotaRateLimitFailureModeDeny
    	If true, the rate limit filter will deny requests when the rate limit service is unavailable.
  -quotaRateLimitServiceAddr string
    	Host (or host:port) for the AI Gateway quota rate limit service. If no port is specified, 8081 is used. (default "envoy-ai-gateway-ratelimit.envoy-gateway-system")
  -quotaRateLimitTimeout int
    	Timeout in seconds for the quota rate limit service. (default 5)
  -requestHeaderAttributes value
    	Comma-separated key-value pairs for mapping HTTP request headers to Otel attributes shared across metrics, spans, and access logs. Format: x-tenant-id:tenant.id.
  -rootPrefix string
    	The root prefix for all supported endpoints. Default is "/" (default "/")
  -spanRequestHeaderAttributes value
    	Comma-separated key-value pairs for mapping HTTP request headers to otel span attributes. Format: agent-session-id:session.id,x-tenant-id:tenant.id. Default: agent-session-id:session.id (when unset). Set to empty to disable.
  -tlsCertDir string
    	The directory containing the TLS certificate and key for the webhook server. (default "/certs")
  -tlsCertName string
    	The name of the TLS certificate file. (default "tls.crt")
  -tlsKeyName string
    	The name of the TLS key file. (default "tls.key")
  -watchNamespaces string
    	Comma-separated list of namespaces to watch. If not set, the controller watches all namespaces.
  -webhookPort int
    	The port for the mutating webhook server. (default 9443)