Usage of /usr/bin/kyverno:
  -add_dir_header
    	If true, adds the file directory to the header of the log messages
  -admissionReports
    	Enable or disable admission reports. (default true)
  -allowHTTPInNamespacedPolicies value
    	Set the flag to 'true', to enable HTTP calls in namespaced policies. This should only be set when combined with restrictive network policies.
  -allowInsecureRegistry
    	Whether to allow insecure connections to registries. Don't use this for anything but testing.
  -allowedResults string
    	Comma separated list of result types for which creating reports is desired. (pass,fail,error,warn,skip) (default "pass,fail,error,warn,skip")
  -alsologtostderr
    	log to standard error as well as files (no effect when -logtostderr=true)
  -autoDeleteWebhooks
    	Set this flag to 'true' to enable autodeletion of webhook configurations using finalizers (requires extra permissions).
  -autoMemLimitEnabled
    	Enable automatic GOMEMLIMIT configuration based on container or system memory. (default true)
  -autoMemLimitRatio float
    	The ratio of reserved GOMEMLIMIT memory to the detected maximum container or system memory. Must be greater than 0 and less than or equal to 1. (default 0.9)
  -autoUpdateWebhooks
    	Set this flag to 'false' to disable auto-configuration of the webhook. (default true)
  -backgroundServiceAccountName string
    	Background controller service account name.
  -caSecretName string
    	Name of the secret containing CA.
  -cleanupServerHost string
    	Host used by the cleanup server. If not set, it will default to [::] for IPv6 or 0.0.0.0 for IPv4.
  -cleanupServerPort int
    	kyverno cleanup server port, defaults to '9443'. (default 9443)
  -clientRateLimitBurst int
    	Configure the maximum burst for throttle. Uses the client default if zero. (default 200)
  -clientRateLimitQPS float
    	Configure the maximum QPS to the Kubernetes API server from Kyverno. Uses the client default if zero. (default 100)
  -controllerRuntimeMetricsAddress string
    	Bind address for controller-runtime metrics server. It will be defaulted to ":8080" if unspecified. Set this to "0" to disable the metrics server.
  -crdWatcher
    	Enable watching of custom resources to invalidate discovery cache on changes.
  -disableLogColor
    	Disable colored output in logs.
  -disableMetrics
    	Set this flag to 'true' to disable metrics.
  -dumpPatches value
    	Set the flag to 'true', to dump mutate patches.
  -dumpPayload
    	Set this flag to activate/deactivate debug mode.
  -enableConfigMapCaching
    	Enable config maps caching. (default true)
  -enableDeferredLoading value
    	enable deferred loading of context variables
  -enablePolicyException
    	Enable PolicyException feature.
  -enableReporting string
    	Comma separated list to enable reporting for different rule types. (validate,mutate,mutateExisting,generate,imageVerify) (default "validate,mutate,mutateExisting,generate,imageVerify")
  -enableTracing
    	Set this flag to 'true', to enable tracing.
  -enableTuf
    	enable tuf for private sigstore deployments
  -eventsRateLimitBurst int
    	Configure the maximum burst for throttle for events. Uses the client default if zero. (default 2000)
  -eventsRateLimitQPS float
    	Configure the maximum QPS to the Kubernetes API server from Kyverno for events. Uses the client default if zero. (default 1000)
  -exceptionNamespace string
    	Configure the namespace to accept PolicyExceptions. If it is set to '*', exceptions are allowed in all namespaces.
  -forceFailurePolicyIgnore value
    	Set the flag to 'true', to force set Failure Policy to 'ignore'.
  -generateMutatingAdmissionPolicy value
    	Set the flag to 'true', to generate mutating admission policies.
  -generateValidatingAdmissionPolicy value
    	Set the flag to 'false', to disable the generation of ValidatingAdmissionPolicies.
  -imagePullSecrets string
    	Secret resource names for image registry access credentials.
  -imageVerifyCacheEnabled
    	Enable a TTL cache for verified images. (default true)
  -imageVerifyCacheMaxSize int
    	Maximum number of keys that can be stored in the TTL cache. Keys are a combination of policy elements along with the image reference. Default is 1000. 0 sets the value to default. (default 1000)
  -imageVerifyCacheTTLDuration duration
    	Maximum TTL value for a cache expressed as duration. Default is 60m. 0 sets the value to default. (default 1h0m0s)
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -leaderElectionRetryPeriod duration
    	Configure leader election retry period. (default 2s)
  -log_backtrace_at value
    	when logging hits line file:N, emit a stack trace
  -log_dir string
    	If non-empty, write log files in this directory (no effect when -logtostderr=true)
  -log_file string
    	If non-empty, use this log file (no effect when -logtostderr=true)
  -log_file_max_size uint
    	Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
  -loggingFormat string
    	This determines the output format of the logger. (default "text")
  -loggingtsFormat string
    	This determines the timestamp format of the logger. (default "default")
  -logtostderr
    	log to standard error instead of files (default true)
  -maxAPICallResponseLength int
    	Configure the value of maximum allowed GET response size from API Calls (default 10000000)
  -maxAdmissionReports int
    	Maximum number of admission reports before we stop creating new ones (default 10000)
  -maxAuditCapacity int
    	Maximum capacity of the audit policy task queue (default 1000)
  -maxAuditWorkers int
    	Maximum number of workers for audit policy processing (default 8)
  -maxQueuedEvents int
    	Maximum events to be queued. (default 1000)
  -metricsHost string
    	Expose prometheus metrics at the given host. If not set, it will default to [::] for IPv6 or 0.0.0.0 for IPv4.
  -metricsPort int
    	Expose prometheus metrics at the given port, default to 8000. (default 8000)
  -omitEvents string
    	Set this flag to a comma sperated list of PolicyViolation, PolicyApplied, PolicyError, PolicySkipped to disable events, e.g. --omitEvents=PolicyApplied,PolicyViolation
  -one_output
    	If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
  -otelCollector string
    	Set this flag to the OpenTelemetry Collector Service Address. Kyverno will try to connect to this on the metrics port. (default "opentelemetrycollector.kyverno.svc.cluster.local")
  -otelConfig string
    	Set this flag to 'grpc', to enable exporting metrics to an Opentelemetry Collector. The default collector is set to "prometheus" (default "prometheus")
  -profile
    	Set this flag to 'true', to enable profiling.
  -profileAddress string
    	Profiling server address, defaults to ''.
  -profilePort string
    	Profiling server port, defaults to '6060'. (default "6060")
  -protectManagedResources value
    	Set the flag to 'true', to enable managed resources protection.
  -registryCredentialHelpers string
    	Credential helpers to enable (default,google,amazon,azure,github). No helpers are added when this flag is empty.
  -renewBefore duration
    	The certificate renewal time before expiration (default 360h0m0s)
  -reportsServiceAccountName string
    	Reports controller service account name.
  -resyncPeriod duration
    	Configure the resync period for informer factory (default 15m0s)
  -serverIP string
    	IP address where Kyverno controller runs. Only required if out-of-cluster.
  -servicePort int
    	Port used by the Kyverno Service resource and for webhook configurations. (default 443)
  -skip_headers
    	If true, avoid header prefixes in the log messages
  -skip_log_headers
    	If true, avoid headers when opening log files (no effect when -logtostderr=true)
  -stderrthreshold value
    	logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2)
  -tlsKeyAlgorithm string
    	Key algorithm for self-signed TLS certificates (RSA, ECDSA, Ed25519) (default "RSA")
  -tlsSecretName string
    	Name of the secret containing TLS pair.
  -tracingAddress string
    	Tracing receiver address, defaults to ''.
  -tracingCreds string
    	Set this flag to the CA secret containing the certificate which is used by our Opentelemetry Tracing Client. If empty string is set, means an insecure connection will be used
  -tracingPort string
    	Tracing receiver port, defaults to '4317'. (default "4317")
  -transportCreds string
    	Set this flag to the CA secret containing the certificate which is used by our Opentelemetry Metrics Client. If empty string is set, means an insecure connection will be used
  -tufMirror string
    	Alternate TUF mirror for sigstore. If left blank, public sigstore one is used for cosign verification. (default "https://tuf-repo-cdn.sigstore.dev")
  -tufRoot string
    	Path to alternate TUF root.json for sigstore (url or env). If left blank, public sigstore one is used for cosign verification.
  -tufRootRaw string
    	The raw body of alternate TUF root.json for sigstore. If left blank, public sigstore one is used for cosign verification.
  -v value
    	number for the log level verbosity
  -vmodule value
    	comma-separated list of pattern=N settings for file-filtered logging
  -webhookRegistrationTimeout duration
    	Timeout for webhook registration, e.g., 30s, 1m, 5m. (default 2m0s)
  -webhookServerHost string
    	Host used by the webhook server. If not set, it will default to [::] for IPv6 or 0.0.0.0 for IPv4.
  -webhookServerPort int
    	Port used by the webhook server. (default 9443)
  -webhookTimeout int
    	Timeout for webhook configurations (number of seconds, integer). (default 10)