{"level":"info","ts":"2026-11-08T02:45:42Z","msg":"version","GitVersion":"v3.4.0","GitCommit":"3f1e9707ac4ce65504d72b425e82be5245b38e0e","BuildDate":"2026-06-03T20:24:43+0000"} Usage of : --alb-gateway-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for alb gateway (default 3) --allowed-certificate-authority-arns strings Specify an optional list of CA ARNs to filter on in cert discovery --aws-api-endpoints stringToString Custom AWS endpoint configuration, format: serviceID1=URL1,serviceID2=URL2 (default []) --aws-api-throttle serviceOperationsThrottleConfig throttle settings for AWS APIs, format: serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst (default Elastic Load Balancing v2:^RegisterTargets|^DeregisterTargets=4:20,Elastic Load Balancing v2:^Describe.*=50:200,Elastic Load Balancing v2:^Modify.*=3:20,WAF Regional:^AssociateWebACL|DisassociateWebACL=0.5:1,WAF Regional:^GetWebACLForResource|ListResourcesForWebACL=1:1,WAFV2:^AssociateWebACL|DisassociateWebACL=0.5:1,WAFV2:^GetWebACLForResource|ListResourcesForWebACL=1:1) --aws-max-retries int Maximum retries for AWS APIs (default 10) --aws-region string AWS Region for the kubernetes cluster --aws-vpc-id string AWS VpcID for the LoadBalancer resources --aws-vpc-tag-key string [DEPRECATED] Previously used to select a single tag from --aws-vpc-tags. All tags are now always used for VPC lookup. This flag will be removed in a future release. (default "Name") --aws-vpc-tags stringToString AWS VPC tags List,format: tagkey1=tagvalue1,tagkey2=tagvalue2 (default []) --backend-security-group string Backend security group id to use for the ingress rules on the worker node SG --cluster-name string Kubernetes cluster name --default-load-balancer-scheme string Default scheme for ELBs (default "internal") --default-pca-arn string Default PCA ARN to use for creating ACM certificates --default-ssl-policy string Default SSL policy for load balancers listeners (default "ELBSecurityPolicy-2016-08") --default-tags stringToString Default AWS Tags that will be applied to all AWS resources managed by this controller (default []) --default-target-type string Default target type for Ingresses and Services - ip, instance (default "instance") --disable-ingress-class-annotation Disable new usage of kubernetes.io/ingress.class annotation --disable-ingress-group-name-annotation Disable new usage of alb.ingress.kubernetes.io/group.name annotation --disable-restricted-sg-rules Disable the usage of restricted security group rules --enable-backend-security-group Enable sharing of security groups for backend traffic (default true) --enable-endpoint-slices Enable EndpointSlices for IP targets instead of Endpoints (default true) --enable-leader-election Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. (default true) --enable-manage-backend-security-group-rules Enable managing of backend security group rules by controller --enable-pod-readiness-gate-inject If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods (default true) --enable-shield Enable Shield addon for ALB (default true) --enable-waf Enable WAF addon for ALB (default true) --enable-wafv2 Enable WAF V2 addon for ALB (default true) --external-managed-tags strings List of Tag keys on AWS resources that will be managed externally --feature-gates mapStringBool A set of key=bool pairs enable/disable features (default EnableRGTAPI={false true},SubnetsClusterTagCheck={true true},NLBHealthCheckAdvancedConfig={true true},GatewayListenerSet={true true},ServiceTypeLoadBalancerOnly={false true},EndpointsFailOpen={true true},EnableServiceController={true true},NLBSecurityGroup={true true},ALBSingleSubnet={false true},SubnetDiscoveryByReachability={true true},NLBGatewayAPI={true true},EnableDefaultTagsLowPriority={false true},WeightedTargetGroups={true true},GlobalAcceleratorController={false true},EnableTCPUDPListener={false true},EnhancedDefaultBehavior={false true},ALBTargetControlAgent={false true},EnableCertificateManagement={false true},ListenerRulesTagging={true true},EnableIPTargetType={true true},LBCapacityReservation={true true},ALBGatewayAPI={true true},IngressPlanAnnotation={false true}) --gateway-class-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for gateway class changes (default 3) --globalaccelerator-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for globalAccelerator (default 1) --globalaccelerator-max-exponential-backoff-delay duration Maximum duration of exponential backoff for globalAccelerator reconcile failures (default 16m40s) --health-probe-bind-addr string The address the health probes binds to. (default ":61779") --ingress-class string Name of the ingress class this controller satisfies (default "alb") --ingress-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for ingress (default 3) --kube-ca-pem-filepath string Location of Kubernetes CA file on disk. --kubeconfig string Path to the kubeconfig file containing authorization and API server information. --lb-stabilization-monitor-interval duration Duration of interval to monitor the load balancer state for stabilization (default 2m0s) --leader-election-id string Name of the leader election ID to use for this controller (default "aws-load-balancer-controller-leader") --leader-election-namespace string Name of the leader election ID to use for this controller --load-balancer-class string Name of the load balancer class reconciled by this controller (default "service.k8s.aws/nlb") --log-level string Set the controller log level - info(default), debug (default "info") --max-targets-per-target-group int Maximum number of targets that can be added to an ELB instance. Use this to prevent TargetGroup quotas being exceeded from blocking reconciliation. --metrics-bind-addr string The address the metric endpoint binds to. (default ":8080") --nlb-gateway-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for nlb gateway (default 3) --quic-environment-variable-name string The environment variable to find the generated QUIC Server ID. (default "AWS_LBC_QUIC_SERVER_ID") --service-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for service (default 3) --service-target-eni-security-group-tags stringToString AWS Tags, in addition to cluster tags, for finding the target ENI security group to which to add inbound rules from NLBs (default []) --sync-period duration Period at which the controller forces the repopulation of its local object stores. (default 10h0m0s) --targetgroupbinding-max-concurrent-reconciles int Maximum number of concurrently running reconcile loops for targetGroupBinding (default 3) --targetgroupbinding-max-exponential-backoff-delay duration Maximum duration of exponential backoff for targetGroupBinding reconcile failures (default 16m40s) --targetgroupbinding-requeue-duration duration Duration after which TargetGroupBinding will be requeued for reconciliation when it's waiting for AWS resources to update. (default 15s) --tolerate-non-existent-backend-action Tolerate rules that specify a non-existent backend action (default true) --tolerate-non-existent-backend-service Tolerate rules that specify a non-existent backend service (default true) --watch-namespace string Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. --webhook-bind-port int The TCP port the Webhook server binds to. (default 9443) --webhook-cert-dir string WebhookCertDir is the directory that contains the webhook server key and certificate. --webhook-cert-file string WebhookCertName is the webhook server certificate name. --webhook-key-file string WebhookKeyName is the webhook server key name.