Usage of /usr/bin/metallb-controller:
  -cert-dir string
    	The directory where certs are stored (default "/tmp/k8s-webhook-server/serving-certs")
  -cert-service-name string
    	The service name used to generate the TLS cert's hostname (default "metallb-webhook-service")
  -deployment string
    	name of the MetalLB controller Deployment
  -disable-cert-rotation
    	disable automatic generation and rotation of webhook TLS certificates/keys
  -health-probe-port int
    	Port for health probe endpoint (default 17472)
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -lb-class string
    	load balancer class. When enabled, metallb will handle only services whose spec.loadBalancerClass matches the given lb class
  -log-level string
    	log level. must be one of: [all, debug, info, warn, error, none] (default "info")
  -metrics-cert-dir string
    	Directory containing tls.crt and tls.key for metrics TLS. If empty, auto-generated self-signed cert is used.
  -ml-secret-name string
    	name of the memberlist secret to create
  -namespace string
    	config / memberlist secret namespace
  -pod-name string
    	name of this MetalLB controller pod
  -port int
    	HTTPS listening port for Prometheus metrics (default 9120)
  -pprof-bind-address string
    	Bind address for pprof endpoint (e.g. 127.0.0.1:6060). Empty disables pprof.
  -tls-cipher-suites string
    	Comma-separated list of TLS cipher suites. Only applies to TLS 1.2. If empty, uses Go defaults.
  -tls-curve-preferences string
    	Comma-separated list of numeric CurveID values (see https://pkg.go.dev/crypto/tls#CurveID). If empty, uses Go defaults.
  -tls-min-version string
    	Minimum TLS version (VersionTLS12 or VersionTLS13). If empty, defaults to VersionTLS13.
  -webhook-http2
    	enables http2 for the webhook endpoint
  -webhook-mode string
    	webhook mode: can be enabled, disabled or only webhook if we want the controller to act as webhook endpoint only (default "enabled")
  -webhook-secret string
    	webhook secret: the name of webhook secret, default is metallb-webhook-cert (default "metallb-webhook-cert")