Usage of /usr/bin/tofu-controller:
      --allow-break-the-glass                     Allow break the glass mode.
      --allow-cross-namespace-refs                Enable following cross-namespace references. Overrides --no-cross-namespace-refs
      --ca-cert-validity-duration duration        The duration that the CA/mTLS certificates should be valid for. Default is 1 week. (default 168h0m0s)
      --cert-rotation-check-frequency duration    The interval that the mTLS certificate rotator should check the certificate validity. (default 30m0s)
      --cluster-domain string                     The cluster domain used by the cluster. (default "cluster.local")
      --concurrent int                            The number of concurrent terraform reconciles. (default 4)
      --enable-leader-election                    Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --events-addr string                        The address of the events receiver.
      --graceful-shutdown-timeout duration        The duration to wait for active reconciliations to complete during shutdown before forcing termination (0 to disable). (default 4m0s)
      --health-addr string                        The address the health endpoint binds to. (default ":9440")
      --http-retry int                            The maximum number of retries when failing to fetch artifacts over HTTP. (default 9)
      --kube-api-burst int                        The maximum burst queries-per-second of requests sent to the Kubernetes API. (default 300)
      --kube-api-qps float32                      The maximum queries-per-second of requests sent to the Kubernetes API. (default 50)
      --leader-election-lease-duration duration   Interval at which non-leader candidates will wait to force acquire leadership (duration string). (default 35s)
      --leader-election-release-on-cancel         Defines if the leader should step down voluntarily on controller manager shutdown. (default true)
      --leader-election-renew-deadline duration   Duration that the leading controller manager will retry refreshing leadership before giving up (duration string). (default 30s)
      --leader-election-retry-period duration     Duration the LeaderElector clients should wait between tries of actions (duration string). (default 5s)
      --log-encoding string                       Log encoding format. Can be 'json' or 'console'. (default "json")
      --log-level string                          Log verbosity level. Can be one of 'trace', 'debug', 'info', 'error'. (default "info")
      --metrics-addr string                       The address the metric endpoint binds to. (default ":8080")
      --no-cross-namespace-refs                   When set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace.
      --quota-retry-delay duration                Base delay for retrying when runner quota is exhausted (default 5s)
      --quota-retry-enabled                       Enable quota-aware retry when runner pod creation is rejected due to resource quota exhaustion.
      --quota-retry-jitter-factor float           Jitter factor applied to quota retry delay (e.g. 0.4 means up to 40% added to the base delay). (default 0.4)
      --requeue-dependency duration               The interval at which failing dependencies are reevaluated. (default 30s)
      --runner-creation-timeout duration          Timeout for creating a runner pod. (default 2m0s)
      --runner-grpc-max-message-size int          The maximum message size for gRPC connections in MiB. (default 4)
      --runner-grpc-port int                      The port which will be exposed on the runner pod for gRPC connections. (default 30000)
      --runner-rpc-timeout duration               Maximum duration for the batch of runner RPCs that set up Terraform (upload, backend config, init, workspace select). Bounds the reconcile so a runner pod that dies mid-RPC surfaces as an error and requeues instead of hanging forever. (default 30m0s)
      --runner-unreachable-timeout duration       Cancel a runner RPC once the connection to a runner that was reachable has not been ready for this long, so a runner pod that dies mid-plan or mid-apply surfaces as an error and requeues instead of hanging forever. Healthy long-running plans and applies keep the connection ready and are not affected, and waiting for a runner that is still starting is not counted. Set to 0 to disable, which also turns off the keepalive pings that notice a runner whose node vanished without closing the connection. (default 5m0s)
      --use-pod-subdomain-resolution              Allow to use pod hostname/subdomain DNS resolution instead of IP based
      --use-priority-queue                        Enable the priority queue feature. (default true)
      --watch-all-namespaces                      Watch for custom resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)