OS Manuals

/usr/bin/helm-controller

The GitOps Toolkit Helm reconciler, for declarative Helming

From flux-helm-controller-fips 1.7.1-r0 (enterprise-packages), captured 2026-11-08 by running helm-controller --help (exit 0). permalink

Usage of /usr/bin/helm-controller:
      --authorized-artifact-server-spiffe-id stringArray   SPIFFE ID of an artifact server authorized to serve artifacts. Can be repeated.
      --authorized-event-server-spiffe-id stringArray      SPIFFE ID of an event server authorized to receive events. Can be repeated.
      --concurrent int                                     The number of concurrent HelmRelease reconciles. (default 4)
      --default-kubeconfig-service-account string          Default service account used for kubeconfig.
      --default-service-account string                     Default service account used for impersonation.
      --enable-leader-election                             Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --events-addr string                                 The address of the events receiver.
      --feature-gates mapStringBool                        A comma separated list of key=value pairs defining the state of experimental features.
      --graceful-shutdown-timeout duration                 The duration given to the reconciler to finish before forcibly stopping. (default 10m0s)
      --health-addr string                                 The address the health endpoint binds to. (default ":9440")
      --http-retry int                                     The maximum number of retries when failing to fetch artifacts over HTTP. (default 9)
      --http-timeout duration                              The timeout for HTTP requests when fetching artifacts. (default 1m0s)
      --insecure-kubeconfig-exec                           Allow use of the user.exec section in kubeconfigs provided for remote apply.
      --insecure-kubeconfig-tls                            Allow that kubeconfigs provided for remote apply can disable TLS verification.
      --interval-jitter-percentage uint8                   Percentage of jitter to apply to interval durations. A value of 10 will apply a jitter of +/-10% to the interval duration. It cannot be negative, and must be less than 100. (default 5)
      --kube-api-burst int                                 The maximum burst queries-per-second of requests sent to the Kubernetes API. (default 300)
      --kube-api-qps float32                               The maximum queries-per-second of requests sent to the Kubernetes API. (default 50)
      --leader-election-lease-duration duration            Interval at which non-leader candidates will wait to force acquire leadership (duration string). (default 35s)
      --leader-election-release-on-cancel                  Defines if the leader should step down voluntarily on controller manager shutdown. (default true)
      --leader-election-renew-deadline duration            Duration that the leading controller manager will retry refreshing leadership before giving up (duration string). (default 30s)
      --leader-election-retry-period duration              Duration the LeaderElector clients should wait between tries of actions (duration string). (default 5s)
      --log-encoding string                                Log encoding format. Can be 'json' or 'console'. (default "json")
      --log-level string                                   Log verbosity level. Can be one of 'trace', 'debug', 'info', 'error'. (default "info")
      --max-retry-delay duration                           The maximum amount of time for which an object being reconciled will have to wait before a retry. (default 15m0s)
      --metrics-addr string                                The address the metric endpoint binds to. (default ":8080")
      --min-retry-delay duration                           The minimum amount of time for which an object being reconciled will have to wait before a retry. (default 750ms)
      --no-cross-namespace-refs                            When set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace.
      --oom-watch-current-memory-path string               The path to the cgroup current memory usage file. Requires feature gate 'OOMWatch' to be enabled. If not set, the path will be automatically detected.
      --oom-watch-interval duration                        The interval at which the OOM watcher will check for memory usage. Requires feature gate 'OOMWatch' to be enabled. (default 500ms)
      --oom-watch-max-memory-path string                   The path to the cgroup memory limit file. Requires feature gate 'OOMWatch' to be enabled. If not set, the path will be automatically detected.
      --oom-watch-memory-threshold uint8                   The memory threshold in percentage at which the OOM watcher will trigger a graceful shutdown. Requires feature gate 'OOMWatch' to be enabled. (default 95)
      --override-manager stringArray                       List of field managers to override during drift detection.
      --requeue-dependency duration                        The interval at which failing dependencies are reevaluated. (default 30s)
      --snapshot-digest-algo string                        The algorithm to use to calculate the digest of Helm release storage snapshots. (default "sha256")
      --spiffe-broker-endpoint string                      The gRPC URL of the SPIFFE Broker endpoint.
      --spiffe-broker-id stringArray                       SPIFFE ID of the SPIFFE Broker endpoint. Can be repeated.
      --token-cache-max-duration duration                  The maximum duration a token is cached. (default 1h0m0s)
      --token-cache-max-size int                           The maximum size of the cache in number of tokens. (default 100)
      --watch-all-namespaces                               Watch for resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)
      --watch-configs-label-selector string                Watch for ConfigMaps and Secrets with matching labels. (default "reconcile.fluxcd.io/watch=Enabled")
      --watch-label-selector string                        Watch for resources with matching labels e.g. 'sharding.fluxcd.io/shard=shard1'.
Options (41)
OptionDescriptionSource
--authorized-artifact-server-spiffe-id stringArraySPIFFE ID of an artifact server authorized to serve artifacts.help
--authorized-event-server-spiffe-id stringArraySPIFFE ID of an event server authorized to receive events.help
--concurrent intThe number of concurrent HelmRelease reconciles.help
--default-kubeconfig-service-account stringDefault service account used for kubeconfig.help
--default-service-account stringDefault service account used for impersonation.help
--enable-leader-electionEnable leader election for controller manager.help
--events-addr stringThe address of the events receiver.help
--feature-gates mapStringBoolA comma separated list of key=value pairs defining the state of experimental features.help
--graceful-shutdown-timeout durationThe duration given to the reconciler to finish before forcibly stopping.help
--health-addr stringThe address the health endpoint binds to.help
--http-retry intThe maximum number of retries when failing to fetch artifacts over HTTP.help
--http-timeout durationThe timeout for HTTP requests when fetching artifacts.help
--insecure-kubeconfig-execAllow use of the user.exec section in kubeconfigs provided for remote apply.help
--insecure-kubeconfig-tlsAllow that kubeconfigs provided for remote apply can disable TLS verification.help
--interval-jitter-percentage uint8Percentage of jitter to apply to interval durations.help
--kube-api-burst intThe maximum burst queries-per-second of requests sent to the Kubernetes API.help
--kube-api-qps float32The maximum queries-per-second of requests sent to the Kubernetes API.help
--leader-election-lease-duration durationInterval at which non-leader candidates will wait to force acquire leadership (duration string).help
--leader-election-release-on-cancelDefines if the leader should step down voluntarily on controller manager shutdown.help
--leader-election-renew-deadline durationDuration that the leading controller manager will retry refreshing leadership before giving up (duration string).help
--leader-election-retry-period durationDuration the LeaderElector clients should wait between tries of actions (duration string).help
--log-encoding stringLog encoding format.help
--log-level stringLog verbosity level.help
--max-retry-delay durationThe maximum amount of time for which an object being reconciled will have to wait before a retry.help
--metrics-addr stringThe address the metric endpoint binds to.help
--min-retry-delay durationThe minimum amount of time for which an object being reconciled will have to wait before a retry.help
--no-cross-namespace-refsWhen set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace.help
--oom-watch-current-memory-path stringThe path to the cgroup current memory usage file.help
--oom-watch-interval durationThe interval at which the OOM watcher will check for memory usage.help
--oom-watch-max-memory-path stringThe path to the cgroup memory limit file.help
--oom-watch-memory-threshold uint8The memory threshold in percentage at which the OOM watcher will trigger a graceful shutdown.help
--override-manager stringArrayList of field managers to override during drift detection.help
--requeue-dependency durationThe interval at which failing dependencies are reevaluated.help
--snapshot-digest-algo stringThe algorithm to use to calculate the digest of Helm release storage snapshots.help
--spiffe-broker-endpoint stringThe gRPC URL of the SPIFFE Broker endpoint.help
--spiffe-broker-id stringArraySPIFFE ID of the SPIFFE Broker endpoint.help
--token-cache-max-duration durationThe maximum duration a token is cached.help
--token-cache-max-size intThe maximum size of the cache in number of tokens.help
--watch-all-namespacesWatch for resources in all namespaces, if set to false it will only watch the runtime namespace.help
--watch-configs-label-selector stringWatch for ConfigMaps and Secrets with matching labels.help
--watch-label-selector stringWatch for resources with matching labels e.g. 'sharding.fluxcd.io/shard=shard1'.help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.