Usage of /usr/bin/kustomize-controller:
      --authorized-artifact-server-spiffe-id stringArray   SPIFFE ID of an artifact server authorized to serve artifacts. Can be repeated.
      --authorized-event-server-spiffe-id stringArray      SPIFFE ID of an event server authorized to receive events. Can be repeated.
      --concurrent int                                     The number of concurrent kustomize reconciles. (default 4)
      --concurrent-ssa int                                 The number of concurrent server-side apply operations. (default 4)
      --custom-apply-stage-kinds string                    A comma-separated list of GroupKind (e.g., 'rbac.authorization.k8s.io/Role,some.group.io/SomeResource') resources to be applied in a custom stage during server-side apply running after CRDs and before all namespaced resources not in this list.
      --default-decryption-service-account string          Default service account used for decryption.
      --default-kubeconfig-service-account string          Default service account used for kubeconfig.
      --default-service-account string                     Default service account used for impersonation.
      --enable-leader-election                             Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --events-addr string                                 The address of the events receiver.
      --feature-gates mapStringBool                        A comma separated list of key=value pairs defining the state of experimental features.
      --health-addr string                                 The address the health endpoint binds to. (default ":9440")
      --http-retry int                                     The maximum number of retries when failing to fetch artifacts over HTTP. (default 9)
      --insecure-kubeconfig-exec                           Allow use of the user.exec section in kubeconfigs provided for remote apply.
      --insecure-kubeconfig-tls                            Allow that kubeconfigs provided for remote apply can disable TLS verification.
      --interval-jitter-percentage uint8                   Percentage of jitter to apply to interval durations. A value of 10 will apply a jitter of +/-10% to the interval duration. It cannot be negative, and must be less than 100. (default 5)
      --kube-api-burst int                                 The maximum burst queries-per-second of requests sent to the Kubernetes API. (default 300)
      --kube-api-qps float32                               The maximum queries-per-second of requests sent to the Kubernetes API. (default 50)
      --leader-election-lease-duration duration            Interval at which non-leader candidates will wait to force acquire leadership (duration string). (default 35s)
      --leader-election-release-on-cancel                  Defines if the leader should step down voluntarily on controller manager shutdown. (default true)
      --leader-election-renew-deadline duration            Duration that the leading controller manager will retry refreshing leadership before giving up (duration string). (default 30s)
      --leader-election-retry-period duration              Duration the LeaderElector clients should wait between tries of actions (duration string). (default 5s)
      --log-encoding string                                Log encoding format. Can be 'json' or 'console'. (default "json")
      --log-level string                                   Log verbosity level. Can be one of 'trace', 'debug', 'info', 'error'. (default "info")
      --max-retry-delay duration                           The maximum amount of time for which an object being reconciled will have to wait before a retry. (default 15m0s)
      --metrics-addr string                                The address the metric endpoint binds to. (default ":8080")
      --min-retry-delay duration                           The minimum amount of time for which an object being reconciled will have to wait before a retry. (default 750ms)
      --no-cross-namespace-refs                            When set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace.
      --no-remote-bases                                    Disallow remote bases usage in Kustomize overlays. When this flag is enabled, all resources must refer to local files included in the source artifact.
      --override-manager stringArray                       Field manager disallowed to perform changes on managed resources.
      --override-manager-before-dry-run stringArray        Field manager taken over before the server-side apply dry-run. Use only to recover objects that fail the dry-run due to stale managers.
      --requeue-dependency duration                        The interval at which failing dependencies are reevaluated. (default 30s)
      --sops-age-secret string                             The name of a Kubernetes secret in the RUNTIME_NAMESPACE containing a SOPS age decryption key for fallback usage.
      --sops-vault-configmap string                        The name of a ConfigMap in the RUNTIME_NAMESPACE configuring the OpenBao/Vault instances (address and login path) trusted for SOPS decryption. It acts as an allowlist of trusted Vault servers. When empty, SOPS decryption via Vault ServiceAccount-token authentication is disabled.
      --spiffe-broker-endpoint string                      The gRPC URL of the SPIFFE Broker endpoint.
      --spiffe-broker-id stringArray                       SPIFFE ID of the SPIFFE Broker endpoint. Can be repeated.
      --token-cache-max-duration duration                  The maximum duration a token is cached. (default 1h0m0s)
      --token-cache-max-size int                           The maximum size of the cache in number of tokens. (default 100)
      --watch-all-namespaces                               Watch for resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)
      --watch-configs-label-selector string                Watch for ConfigMaps and Secrets with matching labels. (default "reconcile.fluxcd.io/watch=Enabled")
      --watch-label-selector string                        Watch for resources with matching labels e.g. 'sharding.fluxcd.io/shard=shard1'.