Usage of /usr/bin/cluster-api-azure-controller:
      --add_dir_header                            If true, adds the file directory to the header of the log messages
      --alsologtostderr                           log to standard error as well as files (no effect when -logtostderr=true)
      --api-call-timeout duration                 The maximum duration CAPZ will wait for each Azure API request before it is considered long running and performed async (e.g. 10s) (default 2s)
      --azurecluster-concurrency int              Number of AzureClusters to process simultaneously (default 10)
      --azuremachine-concurrency int              Number of AzureMachines to process simultaneously (default 10)
      --azuremachinepool-concurrency int          Number of AzureMachinePools to process simultaneously (default 10)
      --azuremachinepoolmachine-concurrency int   Number of AzureMachinePoolMachines to process simultaneously (default 10)
      --bootstrap-config-gvk string               (Deprecated) Provide fully qualified GVK string to override default kubeadm config watch source, in the form of Kind.version.group (default: KubeadmConfig.v1beta1.bootstrap.cluster.x-k8s.io)
      --debouncing-timer duration                 The minimum interval the controller should wait after a successful reconciliation of a particular object before reconciling it again (default 10s)
      --diagnostics-address string                The address the diagnostics endpoint binds to. Per default metrics are served via https and withauthentication/authorization. To serve via http and without authentication/authorization set --insecure-diagnostics. If --insecure-diagnostics is not set the diagnostics endpoint also serves pprof endpoints and an endpoint to change the log level. (default ":8443")
      --disable-controllers-or-webhooks strings   Comma-separated list of controllers or webhooks to disable. The list can contain the following values: DisableASOSecretController,DisableAzureJSONMachineController
      --enable-tracing                            Enable tracing to the opentelemetry-collector service in the same namespace.
      --feature-gates mapStringBool               A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                                  AKSResourceHealth=true|false (ALPHA - default=false)
                                                  APIServerILB=true|false (ALPHA - default=false)
                                                  AllAlpha=true|false (ALPHA - default=false)
                                                  AllBeta=true|false (BETA - default=false)
                                                  ClusterTopology=true|false (ALPHA - default=false)
                                                  EdgeZone=true|false (ALPHA - default=false)
                                                  InPlaceUpdates=true|false (ALPHA - default=false)
                                                  KubeadmBootstrapFormatIgnition=true|false (ALPHA - default=false)
                                                  MachinePool=true|false (BETA - default=true)
                                                  MachineSetPreflightChecks=true|false (BETA - default=true)
                                                  MachineTaintPropagation=true|false (ALPHA - default=false)
                                                  PriorityQueue=true|false (BETA - default=true)
                                                  ReconcilerRateLimiting=true|false (BETA - default=true)
                                                  RuntimeSDK=true|false (ALPHA - default=false)
      --health-addr string                        The address the health endpoint binds to. (default ":9440")
      --insecure-diagnostics                      Enable insecure diagnostics serving. For more details see the description of --diagnostics-address.
      --kubeconfig string                         Paths to a kubeconfig. Only required if out-of-cluster.
      --leader-elect                              Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
      --leader-elect-lease-duration duration      Interval at which non-leader candidates will wait to force acquire leadership (duration string) (default 15s)
      --leader-elect-renew-deadline duration      Duration that the leading controller manager will retry refreshing leadership before giving up (duration string) (default 10s)
      --leader-elect-retry-period duration        Duration the LeaderElector clients should wait between tries of actions (duration string) (default 2s)
      --leader-election-namespace string          Namespace that the controller performs leader election in. If unspecified, the controller will discover which namespace it is running in.
      --log_backtrace_at traceLocation            when logging hits line file:N, emit a stack trace (default :0)
      --log_dir string                            If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log_file string                           If non-empty, use this log file (no effect when -logtostderr=true)
      --log_file_max_size uint                    Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                               log to standard error instead of files (default true)
      --namespace string                          Namespace that the controller watches to reconcile cluster-api objects. If unspecified, the controller watches for cluster-api objects across all namespaces.
      --one_output                                If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --profiler-address string                   Bind address to expose the pprof profiler (e.g. localhost:6060)
      --reconcile-timeout duration                The maximum duration a reconcile loop can run (e.g. 10m) (default 1h30m0s)
      --reconciler-requeue duration               The duration to wait before retrying after a transient reconcile error occurs (e.g. 15s) (default 15s)
      --service-reconcile-timeout duration        The maximum duration each Azure service reconcile can run (e.g. 90m) (default 12s)
      --skip_headers                              If true, avoid header prefixes in the log messages
      --skip_log_headers                          If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --stderrthreshold severity                  logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2)
      --sync-period duration                      The minimum interval at which watched resources are reconciled (e.g. 15m) (default 10m0s)
      --tls-cipher-suites strings                 Comma-separated list of cipher suites for the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true). If omitted, the default Go cipher suites will be used.
                                                  Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                                  Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-min-version string                    The minimum TLS version in use by the webhook server and metrics server (the latter only if --insecure-diagnostics is not set to true).
                                                  Possible values are VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. (default "VersionTLS12")
  -v, --v Level                                   number for the log level verbosity
      --vmodule moduleSpec                        comma-separated list of pattern=N settings for file-filtered logging
      --watch-filter string                       Label value that the controller watches to reconcile cluster-api objects. Label key is always cluster.x-k8s.io/watch-filter. If unspecified, the controller watches for all cluster-api objects.
      --webhook-cert-dir string                   The webhook certificate directory, where the server should find the TLS certificate and key. (default "/tmp/k8s-webhook-server/serving-certs/")
      --webhook-port int                          The webhook server port the manager will listen on. (default 9443)