Usage of kubelet-csr-approver:
  -allowed-dns-names int
    	number of DNS SAN names allowed in a certificate request. defaults to 1 (default 1)
  -bypass-dns-resolution
    	set this parameter to true to bypass DNS resolution checks
  -bypass-hostname-check
    	set this parameter to true to ignore mismatching DNS name and hostname
  -health-probe-bind-address string
    	address the probe endpoint binds to. (default ":8081")
  -ignore-non-system-node
    	set this parameter to true to ignore CSR for subjects different than system:node
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -leader-election
    	set this parameter to true to enable leader election
  -level int
    	level ranges from -5 (Fatal) to 10 (Verbose)
  -max-expiration-sec int
    	maximum seconds a CSR can request a cerficate for. defaults to 367 days (default 31708800)
  -metrics-bind-address string
    	address the metric endpoint binds to. (default ":8080")
  -provider-ip-prefixes string
    	provider-specified, comma separated ip prefixes that CSR IP addresses shall fall into.
    				left unspecified, all IPv4/v6 are allowed. example prefix definition:
    				192.168.0.0/16,fc00/7 (default "0.0.0.0/0,::/0")
  -provider-regex string
    	provider-specified regex to validate CSR SAN names against. accepts everything unless specified (default ".*")
  -skip-deny-step
    	set this parameter to skip denying non-compliant csr