Usage of /usr/bin/admission-controller:
      --add-dir-header                         If true, adds the file directory to the header of the log messages
      --address string                         The address to expose Prometheus metrics. (default ":8944")
      --alsologtostderr                        log to standard error as well as files (no effect when -logtostderr=true)
      --client-ca-file string                  Path to CA PEM file. (default "/etc/tls-certs/caCert.pem")
      --feature-gates mapStringBool            A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
                                               AllAlpha=true|false (ALPHA - default=false)
                                               AllBeta=true|false (BETA - default=false)
                                               PerVPAConfig=true|false (ALPHA - default=false)
      --ignored-vpa-object-namespaces string   A comma-separated list of namespaces to ignore when searching for VPA objects. Leave empty to avoid ignoring any namespaces. These namespaces will not be cleaned by the garbage collector.
      --kube-api-burst float                   QPS burst limit when making requests to Kubernetes apiserver (default 100)
      --kube-api-qps float                     QPS limit when making requests to Kubernetes apiserver (default 50)
      --kubeconfig string                      Path to a kubeconfig. Only required if out-of-cluster.
      --log-backtrace-at traceLocation         when logging hits line file:N, emit a stack trace (default :0)
      --log-dir string                         If non-empty, write log files in this directory (no effect when -logtostderr=true)
      --log-file string                        If non-empty, use this log file (no effect when -logtostderr=true)
      --log-file-max-size uint                 Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
      --logtostderr                            log to standard error instead of files (default true)
      --min-tls-version string                 The minimum TLS version to accept.  Must be set to either tls1_2 (default) or tls1_3. (default "tls1_2")
      --one-output                             If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
      --port int                               The port to listen on. (default 8000)
      --profiling                              Is debug/pprof endpoint enabled
      --register-by-url                        If set to true, admission webhook will be registered by URL (webhookAddress:webhookPort) instead of by service name
      --register-webhook                       If set to true, admission webhook object will be created on start up to register with the API server. (default true)
      --reload-cert                            If set to true, reload leaf and CA certificates when changed.
      --skip-headers                           If true, avoid header prefixes in the log messages
      --skip-log-headers                       If true, avoid headers when opening log files (no effect when -logtostderr=true)
      --stderrthreshold severity               set the log level threshold for writing to standard error (default: info)
      --tls-cert-file string                   Path to server certificate PEM file. (default "/etc/tls-certs/serverCert.pem")
      --tls-ciphers string                     A comma-separated or colon-separated list of ciphers to accept.  Only works when min-tls-version is set to tls1_2.
      --tls-private-key string                 Path to server certificate key PEM file. (default "/etc/tls-certs/serverKey.pem")
  -v, --v Level                                set the log level verbosity (default: 4) (default 4)
      --vmodule moduleSpec                     comma-separated list of pattern=N settings for file-filtered logging
      --vpa-object-namespace string            Specifies the namespace to search for VPA objects. Leave empty to include all namespaces. If provided, the garbage collector will only clean this namespace.
      --webhook-address string                 Address under which webhook is registered. Used when registerByURL is set to true.
      --webhook-failure-policy-fail            If set to true, will configure the admission webhook failurePolicy to "Fail". Use with caution.
      --webhook-labels string                  Comma separated list of labels to add to the webhook object. Format: key1:value1,key2:value2
      --webhook-port string                    Server Port for Webhook
      --webhook-service string                 Kubernetes service under which webhook is registered. Used when registerByURL is set to false. (default "vpa-webhook")
      --webhook-timeout-seconds int            Timeout in seconds that the API server should wait for this webhook to respond before failing. (default 30)