Usage of /usr/bin/manager:
  -additional-mutating-webhook-configs-to-rotate-certs string
    	comma-separated list of additional MutatingWebhookConfigurations for which manager should rotate certs
  -additional-validating-webhook-configs-to-rotate-certs string
    	comma-separated list of additional ValidatingWebhookConfigurations for which manager should rotate certs
  -admission-events-involved-namespace
    	emit admission events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Admission events from cluster-scoped resources will still follow the default behavior
  -alsologtostderr
    	log to standard error as well as files
  -api-cache-dir string
    	The directory where audit from api server cache are stored, defaults to /tmp/audit (default "/tmp/audit")
  -audit-channel string
    	(alpha) Channel name for exporting audit violation messages. Defaults to audit-channel (default "audit-channel")
  -audit-chunk-size int
    	(alpha) Kubernetes API chunking List results when retrieving cluster resources using discovery client. defaulted to 500 if unspecified (default 500)
  -audit-connection string
    	(alpha) Connection name for exporting audit violation messages. Defaults to audit-connection (default "audit-connection")
  -audit-events-involved-namespace
    	emit audit events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Audit events from cluster-scoped resources will still follow the default behavior
  -audit-from-cache
    	audit synced resources from internal cache, bypassing direct queries to Kubernetes API server
  -audit-interval int
    	interval to run audit in seconds. defaulted to 60 secs if unspecified, 0 to disable (default 60)
  -audit-match-kind-only
    	only use kinds specified in all constraints for auditing cluster resources. if kind is not specified in any of the constraints, it will audit all resources (same as setting this flag to false)
  -cert-dir string
    	The directory where certs are stored, defaults to /certs (default "/certs")
  -cert-service-name string
    	The service name used to generate the TLS cert's hostname. Defaults to gatekeeper-webhook-service (default "gatekeeper-webhook-service")
  -client-ca-name string
    	name of the certificate authority bundle to authenticate the Kubernetes API server requests against
  -client-cn-name string
    	expected CN name on the client certificate attached by apiserver in requests to the webhook (default "kube-apiserver")
  -constraint-violations-limit int
    	limit of number of violations per constraint. defaulted to 20 violations if unspecified (default 20)
  -debug-use-fake-pod
    	Use a fake pod name so the Gatekeeper executable can be run outside of Kubernetes
  -default-create-vap-binding-for-constraints
    	(beta) Create VAPBinding resource for constraint of the template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy Binding, true: create Validating Admission Policy Binding. (default true)
  -default-create-vap-for-templates
    	(beta) Create VAP resource for template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy unless generateVAP: true is set on constraint template explicitly, true: create Validating Admission Policy unless generateVAP: false is set on constraint template explicitly. (default true)
  -default-k8s-native-validation-failure-policy value
    	(beta) Failure policy to use when a K8sNativeValidation source omits failurePolicy. Allowed values are Fail or Ignore. (default Fail)
  -default-wait-for-vapb-generation int
    	(beta) Wait time in seconds before generating a ValidatingAdmissionPolicyBinding after a constraint CRD is created. (default 30)
  -disable-cert-rotation
    	disable automatic generation and rotation of webhook TLS certificates/keys
  -disable-enforcementaction-validation
    	disable validation of the enforcementAction and scopedEnforcementActions field of a constraint
  -disable-opa-builtin value
    	disable opa built-in function, this flag can be declared more than once.
  -emit-admission-events
    	(alpha) emit Kubernetes events for each admission violation
  -emit-audit-events
    	(alpha) emit Kubernetes events with detailed info for each violation from an audit
  -enable-external-data
    	Enable external data feature (default true)
  -enable-generator-resource-expansion
    	(beta) Enable the expansion of generator resources (default true)
  -enable-k8s-native-validation
    	enable the validating admission policy driver (default true)
  -enable-mutation
    	Deprecated. This used to enable the mutation feature, now it has no effect. Use --operation=mutation-webhook and --operation=mutation-status instead.
  -enable-pprof
    	enable pprof profiling
  -enable-referential-rules
    	Enable referential rules. This flag defaults to true. Set this value to false if you want to disallow referential constraints. Because referential constraints read objects other than the object-under-test, they may be subject to race conditions. Users concerned about this may want to disable referential rules (default true)
  -enable-remote-cluster
    	(alpha) Enable remote cluster mode where Gatekeeper operates against a target cluster specified via --kubeconfig while running in the local cluster. Mutually exclusive with --debug-use-fake-pod.
  -enable-tls-healthcheck
    	enable probing webhook API with certificate stored in certDir
  -enable-violation-export
    	(alpha) Enable exporting violations to external systems
  -exempt-namespace value
    	The specified namespace is allowed to set the admission.gatekeeper.sh/ignore label. To exempt multiple namespaces, this flag can be declared more than once.
  -exempt-namespace-prefix value
    	A namespace with the specified prefix is allowed to set the admission.gatekeeper.sh/ignore label. To exempt multiple prefixes, this flag can be declared more than once.
  -exempt-namespace-suffix value
    	A namespace with the specified suffix is allowed to set the admission.gatekeeper.sh/ignore label. To exempt multiple suffixes, this flag can be declared more than once.
  -external-data-provider-response-cache-ttl duration
    	TTL for the external data provider response cache. Specify the duration in 'h', 'm', or 's' for hours, minutes, or seconds respectively. Defaults to 3 minutes if unspecified. Setting the TTL to 0 disables the cache. (default 3m0s)
  -health-addr string
    	The address to which the health endpoint binds. (default ":9090")
  -host string
    	the host address the webhook server listens on. defaults to all addresses.
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -log-denies
    	log detailed info on each deny
  -log-file string
    	Log to file, if specified. Default is to log to stderr.
  -log-level string
    	Minimum log level. For example, DEBUG, INFO, WARNING, ERROR. Defaulted to INFO if unspecified. (default "INFO")
  -log-level-encoder lower
    	Encoder for the value of the log level field. Valid values: [lower, `capital`, `color`, `capitalcolor`], default: `lower` (default "lower")
  -log-level-key level
    	JSON key for the log level field, defaults to level (default "level")
  -log-mutations
    	Enable detailed logging of mutation events
  -log-stats-admission
    	(alpha) log stats for admission webhook
  -log-stats-audit
    	(alpha) log stats metrics for the audit run
  -log_backtrace_at value
    	when logging hits line file:N, emit a stack trace
  -log_dir string
    	If non-empty, write log files in this directory
  -log_link string
    	If non-empty, add symbolic links in this directory to the log files
  -logbuflevel int
    	Buffer log messages logged at this level or lower (-1 means don't buffer; 0 means buffer INFO only; ...). Has limited applicability on non-prod platforms.
  -logtostderr
    	log to standard error instead of files
  -max-serving-threads int
    	cap the number of threads handling non-trivial requests, -1 caps the number of threads to GOMAXPROCS. Defaults to -1. (default -1)
  -metrics-addr string
    	The address the metric endpoint binds to. (default "0")
  -metrics-backend prometheus
    	Backend used for metrics. e.g. prometheus, `stackdriver`. This flag can be declared more than once. Omitting will default to supporting `prometheus`.
  -mutating-webhook-configuration-name string
    	name of the MutatingWebhookConfiguration (default "gatekeeper-mutating-webhook-configuration")
  -mutation-annotations
    	Enable mutation annotations
  -operation value
    	The operation to be performed by this instance. e.g. audit, webhook. This flag can be declared more than once. Omitting will default to supporting all operations. (default [mutation-webhook status webhook audit generate mutation-controller mutation-status])
  -otlp-endpoint string
    	Opentelemetry exporter endpoint
  -otlp-metric-interval duration
    	interval to read metrics for opentelemetry exporter. defaulted to 10 secs if unspecified (default 10s)
  -port int
    	port for the server. defaulted to 443 if unspecified  (default 443)
  -pprof-port int
    	port for pprof profiling. defaulted to 6060 if unspecified (default 6060)
  -prometheus-port int
    	Prometheus port for metrics backend (default 8888)
  -readiness-retries int
    	The number of resource ingestion attempts allowed before the resource is disregarded.  A value of -1 will retry indefinitely.
  -shutdown-delay int
    	Time in seconds the controller runtime shutdown gets delayed after receiving a pod termination event. Prevents failing webhooks on pod shutdown. default: 10 (default 10)
  -stackdriver-metric-interval duration
    	interval to read metrics for stackdriver exporter. defaulted to 10 secs if unspecified (default 10s)
  -stackdriver-only-when-available
    	Only attempt to start the stackdriver exporter if credentials are available
  -stderrthreshold value
    	logs at or above this threshold go to stderr (default 2)
  -sync-vap-enforcement-scope
    	(beta) Synchronize ValidatingAdmissionPolicy enforcement scope with Gatekeeper's admission validation scope. When enabled, VAP resources inherit match criteria, conditions, and namespace exclusions from Gatekeeper's webhook configuration, Config resource and exempt namespace flags. This ensures consistent policy enforcement between Gatekeeper and VAP but triggers constraint template reconciliation on scope changes in Config resource or webhook configuration. This flag is deprecated and will be removed in Gatekeeper v3.24. (default true)
  -tls-min-version string
    	minimum version of TLS supported (default "1.3")
  -v value
    	log level for V logs
  -validating-webhook-configuration-name string
    	name of the ValidatingWebhookConfiguration (default "gatekeeper-validating-webhook-configuration")
  -vmodule value
    	comma-separated list of pattern=N settings for file-filtered logging