Usage of /usr/bin/admission-controller:
      --add-dir-header                          If true, adds the file directory to the header of the log messages
      --address string                          The address to expose Prometheus metrics. (default ":8944")
      --alsologtostderr                         log to standard error as well as files (no effect when -logtostderr=true)
      --alsologtostderrthreshold severity       logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)
      --client-ca-file string                   Path to CA PEM file. (default "/etc/tls-certs/caCert.pem")
      --feature-gates mapStringBool             A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                                AllAlpha=true|false (ALPHA - default=false)
                                                AllBeta=true|false (BETA - default=false)
                                                CPUStartupBoost=true|false (ALPHA - default=false)
                                                InPlace=true|false (ALPHA - default=false)
                                                PerVPAConfig=true|false (ALPHA - default=false)
      --ignored-vpa-object-namespaces string    A comma-separated list of namespaces to ignore when searching for VPA objects. Leave empty to avoid ignoring any namespaces. These namespaces will not be cleaned by the garbage collector.
      --kube-api-burst float                    QPS burst limit when making requests to Kubernetes apiserver (default 100)
      --kube-api-qps float                      QPS limit when making requests to Kubernetes apiserver (default 50)
      --kubeconfig string                       Path to a kubeconfig. Only required if out-of-cluster.
      --legacy-stderr-threshold-behavior        If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true)
      --log-backtrace-at traceLocation          when logging hits line file:N, emit a stack trace (default :0)
      --log-dir string                          If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log-file string                         If non-empty, use this log file (no effect when -logtostderr=true)
      --log-file-max-size uint                  Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                             log to standard error instead of files (default true)
      --max-allowed-cpu-boost quantity          Maximum amount of CPU that will be applied for a container with boost.
      --min-tls-version string                  The minimum TLS version to accept. Must be set to either tls1_2 or tls1_3. (default "tls1_2")
      --one-output                              If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --port int                                The port to listen on. (default 8000)
      --profiling                               Enable the debug/pprof endpoint
      --register-by-url                         If set to true, admission webhook will be registered by URL (webhookAddress:webhookPort) instead of by service name
      --register-webhook                        If set to true, admission webhook object will be created on start up to register with the API server. (default true)
      --reload-cert                             If set to true, reload leaf and CA certificates when changed.
      --skip-headers                            If true, avoid header prefixes in the log messages
      --skip-log-headers                        If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --status-lease-name string                The name of the Lease object used to publish the admission controller status. Must match the updater's --admission-controller-status-lease-name flag. (default "vpa-admission-controller")
      --status-lease-namespace string           The namespace of the Lease object used to publish the admission controller status. Defaults to the value of the NAMESPACE environment variable, or kube-system if that is also unset. Must match the updater's --admission-controller-status-lease-namespace flag.
      --status-lease-update-interval duration   How often the admission controller status Lease is renewed. This is also the timeout for each renewal attempt. Must be well below the updater's --admission-controller-status-lease-timeout flag, otherwise the updater will consider the admission controller unhealthy and stop evicting pods. (default 10s)
      --stderrthreshold severity                set the log level threshold for writing to standard error (default: info)
      --tls-cert-file string                    Path to server certificate PEM file. (default "/etc/tls-certs/serverCert.pem")
      --tls-ciphers string                      A comma-separated or colon-separated list of ciphers to accept. Only works when min-tls-version is set to tls1_2.
      --tls-private-key string                  Path to server certificate key PEM file. (default "/etc/tls-certs/serverKey.pem")
  -v, --v Level                                 set the log level verbosity (default: 4) (default 4)
      --vmodule moduleSpec                      comma-separated list of pattern=N settings for file-filtered logging
      --vpa-object-namespace string             Specifies the namespace to search for VPA objects. Leave empty to include all namespaces. If provided, the garbage collector will only clean this namespace.
      --webhook-address string                  Address under which webhook is registered. Used when --register-by-url is set to true.
      --webhook-failure-policy-fail             If set to true, will configure the admission webhook failurePolicy to "Fail". Use with caution.
      --webhook-labels string                   Comma separated list of labels to add to the webhook object. Format: key1:value1,key2:value2
      --webhook-port string                     Port under which webhook is registered. Used when --register-by-url is set to true.
      --webhook-service string                  Kubernetes service under which webhook is registered. Used when --register-by-url is set to false. (default "vpa-webhook")
      --webhook-timeout-seconds int             Timeout in seconds that the API server should wait for this webhook to respond before failing. (default 30)