Usage of rollout-operator:
  -kubernetes.api-url string
    	The Kubernetes server API URL. If not specified, it will be auto-detected when running within a Kubernetes cluster.
  -kubernetes.client-burst int
    	Maximum burst (token bucket capacity) for the per-API-group rate limiter (see -kubernetes.client-qps). Must be at least 1 when rate limiting is enabled, since each request consumes one token. It does not need to be greater than or equal to the QPS: a smaller burst simply allows less bursting. (default 10)
  -kubernetes.client-qps float
    	Maximum QPS to the Kubernetes API server, enforced per API group: each API group (e.g. core/v1, apps/v1, policy/v1) gets its own token bucket with this QPS. Set to 0 to disable client-side rate limiting. (default 5)
  -kubernetes.client-timeout duration
    	HTTP client timeout. This applies to requests issued to both the Kubernetes API and Kubernetes resource endpoints. It does not apply to HTTP requests issued directly to pod endpoints (e.g. prepare-downscale): those are governed by -pods.client-timeout. (default 5m0s)
  -kubernetes.cluster-domain string
    	The Kubernetes cluster domain. (default "cluster.local.")
  -kubernetes.config-file string
    	The Kubernetes config file path. If not specified, it will be auto-detected when running within a Kubernetes cluster.
  -kubernetes.namespace string
    	The Kubernetes namespace for which this operator is running.
  -kubernetes.pod-name string
    	Name of this pod, used to select the elected leader for webhook traffic. Defaults to POD_NAME or the hostname.
  -leader-election.enabled
    	Enable Lease leader election. Requires Lease access and pod patch permissions, and a webhook Service selecting the leader label.
  -leader-election.lease-duration duration
    	Duration that non-leaders wait before attempting to acquire an unrenewed leader election Lease. (default 15s)
  -leader-election.lease-name string
    	Name of the Lease used to ensure only one rollout-operator is active in the namespace. (default "rollout-operator")
  -leader-election.renew-deadline duration
    	Duration that the leader retries refreshing its Lease before giving up leadership. (default 10s)
  -leader-election.retry-period duration
    	Interval between attempts to acquire or renew the leader election Lease. (default 2s)
  -log.format string
    	The log format. Supported values: logfmt, json. Defaults to logfmt. (default "logfmt")
  -log.level string
    	The log level. Supported values: debug, info, warn, error. (default "debug")
  -pods.client-timeout duration
    	HTTP client timeout for requests issued directly to pod endpoints (e.g. prepare-downscale). These calls do not go through the Kubernetes API, so they are not subject to -kubernetes.client-timeout nor the client-side rate limiter. (default 5s)
  -reconcile.interval duration
    	The minimum interval of reconciliation. (default 5s)
  -replica-templates.watch-enabled
    	Watch ReplicaTemplates for desired replica changes. Requires the CRD and namespace list/watch permissions.
  -server-tls.cert-file string
    	Path to the TLS certificate file if not using the self-signed certificate.
  -server-tls.enabled
    	Enable TLS server for webhook connections.
  -server-tls.key-file string
    	Path to the TLS private key file if not using the self-signed certificate.
  -server-tls.port int
    	Port to use for exposing TLS server for webhook connections (if enabled). (default 8443)
  -server-tls.request-timeout duration
    	Time budget to handle a single TLS server (admission webhook) request: used as the server read and write timeouts, and (at 90%) as the deadline imposed on the request context passed to the webhook handler. Should be smaller than the apiserver's webhook timeout so the rollout-operator responds before the apiserver gives up. (default 10s)
  -server-tls.self-signed-cert.dns-name string
    	DNS name to use for the self-signed certificate (if enabled). If left empty, then 'rollout-operator.<namespace>.svc' will be used.
  -server-tls.self-signed-cert.enabled
    	Generate a self-signed certificate for the TLS server. (default true)
  -server-tls.self-signed-cert.expiration value
    	Expiration time for the self-signed certificate in Prometheus duration format (Go format plus support for days, weeks and years as 1d/1w/1y).
  -server-tls.self-signed-cert.org string
    	Organization name to use for the self-signed certificate (if enabled). (default "Grafana Labs")
  -server-tls.self-signed-cert.secret-name string
    	Secret name to store the self-signed certificate (if enabled). (default "rollout-operator-self-signed-certificate")
  -server.cluster-validation.http.enabled
    	When enabled, cluster label validation is executed: configured cluster validation label is compared with the cluster validation label received through the requests.
  -server.cluster-validation.http.excluded-paths value
    	Comma-separated list of url paths that are excluded from the cluster validation check.
  -server.cluster-validation.http.excluded-user-agents value
    	Comma-separated list of user agents that are excluded from the cluster validation check.
  -server.cluster-validation.http.soft-validation
    	When enabled, soft cluster label validation is executed. Can be enabled only together with server.cluster-validation.http.enabled
  -server.port int
    	Port to use for exposing instrumentation, readiness probe, and status UI endpoints. (default 8001)
  -use-zone-tracker
    	Use the zone tracker to prevent simultaneous downscales in different zones
  -webhooks.update-ca-bundle
    	Update the CA bundle in the properly labeled webhook configurations with the self-signed certificate (-server-tls.self-signed-cert.enabled should be enabled). (default true)
  -zone-tracker.config-map-name string
    	The name of the ConfigMap to use for the zone tracker (default "rollout-operator-zone-tracker")
  -zpdb.pod-ready-annotation-patch-timeout duration
    	Deprecated: accepted for compatibility and has no effect. (default 5s)