/usr/bin/controller

{"level":"info","ts":"2026-11-08T02:45:42Z","msg":"version","GitVersion":"v3.4.0","GitCommit":"3f1e9707ac4ce65504d72b425e82be5245b38e0e","BuildDate":"2026-06-03T20:24:43+0000"}
Usage of :
      --alb-gateway-max-concurrent-reconciles int                   Maximum number of concurrently running reconcile loops for alb gateway (default 3)
      --allowed-certificate-authority-arns strings                  Specify an optional list of CA ARNs to filter on in cert discovery
      --aws-api-endpoints stringToString                            Custom AWS endpoint configuration, format: serviceID1=URL1,serviceID2=URL2 (default [])
      --aws-api-throttle serviceOperationsThrottleConfig            throttle settings for AWS APIs, format: serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst (default Elastic Load Balancing v2:^RegisterTargets|^DeregisterTargets=4:20,Elastic Load Balancing v2:^Describe.*=50:200,Elastic Load Balancing v2:^Modify.*=3:20,WAF Regional:^AssociateWebACL|DisassociateWebACL=0.5:1,WAF Regional:^GetWebACLForResource|ListResourcesForWebACL=1:1,WAFV2:^AssociateWebACL|DisassociateWebACL=0.5:1,WAFV2:^GetWebACLForResource|ListResourcesForWebACL=1:1)
      --aws-max-retries int                                         Maximum retries for AWS APIs (default 10)
      --aws-region string                                           AWS Region for the kubernetes cluster
      --aws-vpc-id string                                           AWS VpcID for the LoadBalancer resources
      --aws-vpc-tag-key string                                      [DEPRECATED] Previously used to select a single tag from --aws-vpc-tags. All tags are now always used for VPC lookup. This flag will be removed in a future release. (default "Name")
      --aws-vpc-tags stringToString                                 AWS VPC tags List,format: tagkey1=tagvalue1,tagkey2=tagvalue2 (default [])
      --backend-security-group string                               Backend security group id to use for the ingress rules on the worker node SG
      --cluster-name string                                         Kubernetes cluster name
      --default-load-balancer-scheme string                         Default scheme for ELBs (default "internal")
      --default-pca-arn string                                      Default PCA ARN to use for creating ACM certificates
      --default-ssl-policy string                                   Default SSL policy for load balancers listeners (default "ELBSecurityPolicy-2016-08")
      --default-tags stringToString                                 Default AWS Tags that will be applied to all AWS resources managed by this controller (default [])
      --default-target-type string                                  Default target type for Ingresses and Services - ip, instance (default "instance")
      --disable-ingress-class-annotation                            Disable new usage of kubernetes.io/ingress.class annotation
      --disable-ingress-group-name-annotation                       Disable new usage of alb.ingress.kubernetes.io/group.name annotation
      --disable-restricted-sg-rules                                 Disable the usage of restricted security group rules
      --enable-backend-security-group                               Enable sharing of security groups for backend traffic (default true)
      --enable-endpoint-slices                                      Enable EndpointSlices for IP targets instead of Endpoints (default true)
      --enable-leader-election                                      Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. (default true)
      --enable-manage-backend-security-group-rules                  Enable managing of backend security group rules by controller
      --enable-pod-readiness-gate-inject                            If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods (default true)
      --enable-shield                                               Enable Shield addon for ALB (default true)
      --enable-waf                                                  Enable WAF addon for ALB (default true)
      --enable-wafv2                                                Enable WAF V2 addon for ALB (default true)
      --external-managed-tags strings                               List of Tag keys on AWS resources that will be managed externally
      --feature-gates mapStringBool                                 A set of key=bool pairs enable/disable features (default EnableRGTAPI={false true},SubnetsClusterTagCheck={true true},NLBHealthCheckAdvancedConfig={true true},GatewayListenerSet={true true},ServiceTypeLoadBalancerOnly={false true},EndpointsFailOpen={true true},EnableServiceController={true true},NLBSecurityGroup={true true},ALBSingleSubnet={false true},SubnetDiscoveryByReachability={true true},NLBGatewayAPI={true true},EnableDefaultTagsLowPriority={false true},WeightedTargetGroups={true true},GlobalAcceleratorController={false true},EnableTCPUDPListener={false true},EnhancedDefaultBehavior={false true},ALBTargetControlAgent={false true},EnableCertificateManagement={false true},ListenerRulesTagging={true true},EnableIPTargetType={true true},LBCapacityReservation={true true},ALBGatewayAPI={true true},IngressPlanAnnotation={false true})
      --gateway-class-max-concurrent-reconciles int                 Maximum number of concurrently running reconcile loops for gateway class changes (default 3)
      --globalaccelerator-max-concurrent-reconciles int             Maximum number of concurrently running reconcile loops for globalAccelerator (default 1)
      --globalaccelerator-max-exponential-backoff-delay duration    Maximum duration of exponential backoff for globalAccelerator reconcile failures (default 16m40s)
      --health-probe-bind-addr string                               The address the health probes binds to. (default ":61779")
      --ingress-class string                                        Name of the ingress class this controller satisfies (default "alb")
      --ingress-max-concurrent-reconciles int                       Maximum number of concurrently running reconcile loops for ingress (default 3)
      --kube-ca-pem-filepath string                                 Location of Kubernetes CA file on disk.
      --kubeconfig string                                           Path to the kubeconfig file containing authorization and API server information.
      --lb-stabilization-monitor-interval duration                  Duration of interval to monitor the load balancer state for stabilization (default 2m0s)
      --leader-election-id string                                   Name of the leader election ID to use for this controller (default "aws-load-balancer-controller-leader")
      --leader-election-namespace string                            Name of the leader election ID to use for this controller
      --load-balancer-class string                                  Name of the load balancer class reconciled by this controller (default "service.k8s.aws/nlb")
      --log-level string                                            Set the controller log level - info(default), debug (default "info")
      --max-targets-per-target-group int                            Maximum number of targets that can be added to an ELB instance. Use this to prevent TargetGroup quotas being exceeded from blocking reconciliation.
      --metrics-bind-addr string                                    The address the metric endpoint binds to. (default ":8080")
      --nlb-gateway-max-concurrent-reconciles int                   Maximum number of concurrently running reconcile loops for nlb gateway (default 3)
      --quic-environment-variable-name string                       The environment variable to find the generated QUIC Server ID. (default "AWS_LBC_QUIC_SERVER_ID")
      --service-max-concurrent-reconciles int                       Maximum number of concurrently running reconcile loops for service (default 3)
      --service-target-eni-security-group-tags stringToString       AWS Tags, in addition to cluster tags, for finding the target ENI security group to which to add inbound rules from NLBs (default [])
      --sync-period duration                                        Period at which the controller forces the repopulation of its local object stores. (default 10h0m0s)
      --targetgroupbinding-max-concurrent-reconciles int            Maximum number of concurrently running reconcile loops for targetGroupBinding (default 3)
      --targetgroupbinding-max-exponential-backoff-delay duration   Maximum duration of exponential backoff for targetGroupBinding reconcile failures (default 16m40s)
      --targetgroupbinding-requeue-duration duration                Duration after which TargetGroupBinding will be requeued for reconciliation when it's waiting for AWS resources to update. (default 15s)
      --tolerate-non-existent-backend-action                        Tolerate rules that specify a non-existent backend action (default true)
      --tolerate-non-existent-backend-service                       Tolerate rules that specify a non-existent backend service (default true)
      --watch-namespace string                                      Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched.
      --webhook-bind-port int                                       The TCP port the Webhook server binds to. (default 9443)
      --webhook-cert-dir string                                     WebhookCertDir is the directory that contains the webhook server key and certificate.
      --webhook-cert-file string                                    WebhookCertName is the webhook server certificate name.
      --webhook-key-file string                                     WebhookKeyName is the webhook server key name.