Usage of /usr/bin/controller:
      --accept-deprecated-v1-data       Accept deprecated V1 data field. (default true)
      --additional-namespaces string    Comma-separated list of additional namespaces to be scanned.
      --all-namespaces                  Scan all namespaces or only the current namespace (default=true). (default true)
      --key-cutoff-time string          Create a new key if latest one is older than this cutoff time. RFC1123 format with numeric timezone expected.
      --key-order-priority string       Ordering of keys based on NotBefore certificate attribute or secret creation timestamp. (default "CertNotBefore")
      --key-prefix string               Prefix used to name keys. (default "sealed-secrets-key")
      --key-renew-period duration       New key generation period (automatic rotation deactivated if 0) (default 720h0m0s)
      --key-size int                    Size of encryption key. (default 4096)
      --key-ttl duration                Duration that certificate is valid for. (default 87600h0m0s)
      --kubeclient-burst int            Kubeclient Burst (default 10)
      --kubeclient-qps float32          Kubeclient QPS (negative value disables ratelimiting) (default 5)
      --label-selector string           Label selector which can be used to filter sealed secrets.
      --listen-addr string              HTTP serving address. (default ":8080")
      --listen-metrics-addr string      HTTP metrics serving address. (default ":8081")
      --log-format string               Log format (text|json). (default "text")
      --log-info-stdout                 if true the controller will log info to stdout and error/warn to stderr. (default true)
      --log-level string                Log level (INFO|ERROR). (default "INFO")
      --max-unseal-retries int          Max unseal retries. (default 5)
      --metrics-omit-secret-labels      When true, the sealed_secrets_controller_condition_info metric is not updated, so the metrics endpoint does not expose SealedSecret namespaces and names. Use this if :8081 is reachable by users who should not be able to enumerate SealedSecret inventory.
      --my-cn string                    Common name to be used as issuer/subject DN in generated certificate.
      --old-gc-behavior                 Revert to old GC behavior where the controller deletes secrets instead of delegating that to k8s itself.
      --privatekey-annotations string   Comma-separated list of additional annotations to be put on renewed sealing keys.
      --privatekey-labels string        Comma-separated list of additional labels to be put on renewed sealing keys.
      --rate-limit int                  Number of allowed sustained requests per second for the verify and rotate endpoints (default 2)
      --rate-limit-burst int            Number of requests allowed to exceed the rate limit per second for the verify and rotate endpoints (default 2)
      --read-timeout duration           HTTP request timeout. (default 2m0s)
      --skip-recreate                   if true the controller will skip listening for managed secret changes to recreate deleted secrets and restore modified ones. This helps on limited permission environments.
      --update-status                   if true, the controller will update the status sub-resource whenever it processes a sealed secret (stable; enabled by default since v0.17.0) (default true)
      --version                         Print version information and exit
      --watch-for-secrets               beta: If this is true, the controller will watch for key secrets. This is useful if you create the key secrets externally.
      --write-timeout duration          HTTP response timeout. (default 2m0s)