/usr/bin/agent-sandbox-controller

Usage of /usr/bin/agent-sandbox-controller:
  -api-connections int
    	Number of independent HTTP/2 connections to the API server for non-watch traffic (writes, uncached reads, events, leader election). The kube-apiserver caps concurrent in-flight requests per HTTP/2 connection (SETTINGS_MAX_CONCURRENT_STREAMS; 100 by default, configurable server-side via --http2-max-streams-per-connection), so a single connection bounds effective concurrency at the advertised limit regardless of worker count or QPS settings. Values > 1 shard requests round-robin across that many dedicated connections, each dialed on first use (~N x per-connection limit ceiling). Default 1 preserves the existing single-connection client. (default 1)
  -cache-label-selectors
    	Scope the manager's Pod and Service informer caches to objects carrying the sandbox tracking label (agents.x-k8s.io/sandbox-name-hash). The controller only ever creates/looks up Pods and Services it labeled itself, so on shared or high-churn clusters this cuts informer list/watch volume, JSON decode CPU, and cache memory from O(cluster) to O(sandboxes). CAVEAT: externally pre-provisioned resources that rely on the agents.x-k8s.io/adoptable=true adoption path MUST also carry the tracking label (value = the owning sandbox's name hash) to remain visible to the controller when this flag is enabled.
  -cluster-domain string
    	Kubernetes cluster domain for service FQDN generation (default "cluster.local")
  -disable-claim-events
    	Disable Kubernetes Event emission from the SandboxClaim controller (its Eventf calls become no-ops), reducing API server writes during large claim bursts. Default false (events enabled).
  -disable-claim-observability-annotations
    	Skip persisting the SandboxClaim observability annotations (controller first-observed timestamp, trace context), removing one API write per claim. The values are still stamped on the in-memory object, so startup-latency metrics and trace propagation to the Sandbox keep working within the controller process. Costs the on-object debugging breadcrumbs and, after a controller restart, the startup-latency metric for claims first observed by the previous process. Default false (annotations persisted).
  -disable-sandbox-events
    	Disable Kubernetes Event emission from the Sandbox controller (its Eventf calls become no-ops), reducing API server writes during large warm-pool fills. Default false (events enabled).
  -enable-pprof
    	Enable CPU profiling endpoint (/debug/pprof/profile) on the metrics server.
  -enable-pprof-debug
    	Enable all pprof endpoints including sensitive ones (cmdline, symbol, heap, goroutine, etc). Implies --enable-pprof. WARNING: May expose sensitive information and comes with performance overhead.
  -enable-rest-client-metrics
    	Enable client-go REST client metrics (request latency, DNS resolution latency, request/response sizes, rate limiter latency, request retries). These metrics provide visibility into Kubernetes API client health. Set to false to disable if the additional histogram overhead is not acceptable. (default true)
  -enable-tracing
    	Enable OpenTelemetry tracing via OTLP.
  -enable-warm-pool-eviction
    	Mark pods created by a warm pool as ready-to-evict by default. (default true)
  -extensions
    	Enable extensions controllers.
  -health-probe-bind-address string
    	The address the probe endpoint binds to. (default ":8081")
  -kube-api-burst int
    	The maximum burst for client-side throttling of the Kubernetes API client. (default 10)
  -kube-api-qps float
    	Client-side QPS limit for the Kubernetes API client (default: -1, no client-side rate limiting) (default -1)
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -leader-elect
    	Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. (default true)
  -leader-election-namespace string
    	The namespace in which the leader election resource will be created.
  -metrics-bind-address string
    	The address the metric endpoint binds to. (default ":8080")
  -metrics-cert-dir string
    	Directory containing tls.crt and tls.key for the metrics server. Only used when --metrics-secure-serving is enabled.
  -metrics-secure-serving
    	Serve metrics over HTTPS instead of HTTP. When enabled without --metrics-cert-dir, a self-signed certificate is generated automatically. Conventional HTTPS metrics port is :8443.
  -pprof-block-profile-rate int
    	Block profile sampling rate for /debug/pprof/block when --enable-pprof-debug is set. <=0 disables; 1 samples all blocking events; >=2 sets the rate in nanoseconds (e.g. 1000000 ~= 1ms). (default 1000000)
  -pprof-mutex-profile-fraction int
    	Mutex contention sampling rate for /debug/pprof/mutex when --enable-pprof-debug is set. <=0 disables; 1 samples all events; N>1 samples ~1/N events (e.g. 10 ~= 1/10, 100 ~= 1/100). (default 10)
  -sandbox-claim-concurrent-workers int
    	Max concurrent reconciles for the SandboxClaim controller (default 50)
  -sandbox-claim-warm-candidate-grace-period duration
    	How long a newly created SandboxClaim waits for a warm pool candidate to report a Pod IP before falling back to cold creation. Must be a positive duration. (default 2s)
  -sandbox-concurrent-workers int
    	Max concurrent reconciles for the Sandbox controller (default 100)
  -sandbox-template-concurrent-workers int
    	Max concurrent reconciles for the SandboxTemplate controller (default 1)
  -sandbox-warm-pool-concurrent-workers int
    	Max concurrent reconciles for the SandboxWarmPool controller (default 1)
  -sandbox-warm-pool-max-batch-size int
    	Max batch size for parallel sandbox creation and deletion in SandboxWarmPool controller. Default is 300. Creates advance one observed batch per watch round-trip (the expectations gate waits for a batch's add events before issuing the next), so a large pool fills in about ceil(replicas/batchSize) round-trips; raising this trades round-trips for burst size and is safe at any value under the gate. (default 300)
  -sandbox-warm-pool-max-refill-rate float
    	Max rate (sandboxes/second, per pool) at which the SandboxWarmPool controller creates replacement sandboxes, pacing refill into a smooth stream instead of full-deficit bursts that flood the write path and compete with claim adoption. Composes with --sandbox-warm-pool-replenish-delay: the delay defers the start of refill, the rate shapes its flow. 0 (default) leaves refill unpaced (whole deficit per reconcile).
  -sandbox-warm-pool-readiness-grace-period duration
    	How long a warm pool sandbox may stay non-Ready, counted from when its pod is scheduled (or from creation if it has not been), before the SandboxWarmPool controller considers it stuck and replaces it (or holds it, if its pod is unschedulable or waiting on scheduling gates). Raise this for images with long initialization. Must be a positive duration. (default 5m0s)
  -sandbox-warm-pool-replenish-delay duration
    	How long the SandboxWarmPool controller defers creating replacement sandboxes after pool members drop out of the pool (e.g. a burst of SandboxClaims adopting warm sandboxes), so the burst gets API server priority. The hold re-arms while members keep dropping. 0 (default) replenishes immediately.
  -sandbox-warm-pool-unschedulable-recheck-interval duration
    	Requeue interval at which the SandboxWarmPool controller re-checks a pool holding unschedulable or scheduling-gated sandboxes past the readiness grace period. Must be a positive duration. (default 1m0s)
  -sandbox-write-behind-window duration
    	Coalescing window for the Sandbox controller's recoverable metadata-only writes. 0 disables coalescing.
  -separate-watch-connection
    	Give the manager's informer cache (list/watch streams) a dedicated HTTP/2 connection to the API server. Watch events arrive on existing long-lived streams, so this isolates their frames from TCP/connection-level queuing behind bursts of request traffic on a shared connection (HTTP/2 stream prioritization does not help in practice). The per-connection cap on concurrent request streams is addressed separately by --api-connections. Default false preserves the existing shared-connection behavior.
  -tls-cipher-suites string
    	Comma-separated list of cipher suites for the metrics server, using Go cipher-suite names (e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). If not set, the Go default applies. TLS 1.3 cipher suites are not configurable. A downstream operator can use this flag to inject the cluster TLS profile.
  -tls-min-version string
    	Minimum TLS version for the metrics server. Accepted values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. If not set, the Go default applies (TLS 1.2). A downstream operator can use this flag to inject the cluster TLS profile.
  -version
    	Print version information and exit.
  -zap-devel
    	Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
  -zap-encoder value
    	Zap log encoding (one of 'json' or 'console')
  -zap-log-level value
    	Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic' or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
  -zap-stacktrace-level value
    	Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
  -zap-time-encoding value
    	Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.