Manager Flags¶
The manager binary accepts the flags listed below. They are also surfaced through the Helm chart's controllers.* and fleetManagement.* value blocks where applicable. Defaults are conservative: every controller other than pipeline is opt-in.
| Flag | Type | Default | Set by chart? | Description | Source | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
--controller-discovery-max-concurrent | int | 1 | yes (L114) | Max concurrent reconciles for CollectorDiscovery. Keep at 1: concurrency > 1 triggers multiple ListCollectors calls per poll cycle without benefit. | cmd/main.go:183 | ||||||||||||||||||||||||
--controller-pipeline-discovery-max-concurrent | int | 1 | yes (L115) | Max concurrent reconciles for PipelineDiscovery. Keep at 1: concurrency > 1 triggers multiple ListPipelines calls per poll cycle without benefit. | cmd/main.go:186 | ||||||||||||||||||||||||
--controller-policy-max-concurrent | int | 4 | yes (L110) | Max concurrent reconciles for RemoteAttributePolicy. Safe to increase: reconciles are pure K8s cache reads with no external API calls. Pipeline and Collector must stay at 1 because they share the Fleet API rate budget. | cmd/main.go:176 | ||||||||||||||||||||||||
--controller-sync-max-concurrent | int | 4 | yes (L111) | Max concurrent reconciles for ExternalAttributeSync. Safe to increase: Fetch calls are per-source and do not share external state across reconciles. | cmd/main.go:180 | ||||||||||||||||||||||||
--controller-sync-target-burst | int | 4 | yes (L113) | Bucket size for the per-target ExternalAttributeSync limiter. Ignored when --controller-sync-target-rate=0. Default 4 (matching --controller-sync-max-concurrent so a single concurrency generation always passes through immediately). | cmd/main.go:195 | ||||||||||||||||||||||||
--controller-sync-target-rate | float64 | 0 | yes (L112) | Per-target rate limit (tokens/sec) applied before each ExternalAttributeSync Source.Fetch call. Two syncs against the same upstream (HTTP host or SQL secret) share a token bucket so MaxConcurrentReconciles cannot stampede a customer-owned source. Zero (default) disables per-target limiting. Set 1 for one fetch/sec/upstream — typically plenty given that sync schedules run every minute or longer. | cmd/main.go:189 | ||||||||||||||||||||||||
--enable-collector-controller | bool | false | yes (L99) | Enable the Collector reconciler and webhook (manages collector remote attributes). | cmd/main.go:131 | ||||||||||||||||||||||||
--enable-collector-discovery-controller | bool | false | yes (L102) | Enable the CollectorDiscovery reconciler and webhook (auto-mirrors Fleet Management collectors as Collector CRs). | cmd/main.go:137 | ||||||||||||||||||||||||
--enable-external-sync-controller | bool | false | yes (L101) | Enable the ExternalAttributeSync reconciler and webhook (HTTP/SQL-backed scheduled attribute pulls). | cmd/main.go:135 | ||||||||||||||||||||||||
--enable-http2 | bool | false | yes (L122) | If set, HTTP/2 will be enabled for the metrics and webhook servers | cmd/main.go:127 | ||||||||||||||||||||||||
--enable-pipeline-controller | bool | true | yes (L98) | Enable the Pipeline reconciler and webhook. | cmd/main.go:129 | ||||||||||||||||||||||||
--enable-pipeline-discovery-controller | bool | false | yes (L103) | Enable the PipelineDiscovery controller (polls Fleet Management ListPipelines and creates Pipeline CRs). | cmd/main.go:139 | ||||||||||||||||||||||||
--enable-policy-controller | bool | false | yes (L100) | Enable the RemoteAttributePolicy reconciler and webhook (bulk attribute assignment by selector). | cmd/main.go:133 | ||||||||||||||||||||||||
--enable-tenant-policy-enforcement | bool | false | yes (L104) | Enable TenantPolicy CRD validation and enforcement. When set, validating webhooks for Pipeline, RemoteAttributePolicy, ExternalAttributeSync, and CollectorDiscovery require that K8s subjects matched by a TenantPolicy include at least one of the policy's required matchers in the CR's matcher set. Default false; existing installs see no behavior change until this flag is set. | cmd/main.go:141 | ||||||||||||||||||||||||
--enforce-cross-namespace-discovery-authz | bool | false | yes (L105) | Enforce that the user creating a PipelineDiscovery or CollectorDiscovery with a spec.targetNamespace different from the CR's own namespace is itself authorized to create Pipelines / Collectors in that target namespace, via a SubjectAccessReview at admission time. Closes the cross-namespace confused-deputy escalation where the operator's cluster-wide ServiceAccount would otherwise be borrowed to write CRs into any namespace. Default false (default-allow) so existing installs see no behavior change until set. | cmd/main.go:147 | ||||||||||||||||||||||||
--external-source-secret-label-selector | string | — | yes (L106) | Optional Kubernetes label selector (e.g. fleetmanagement.grafana.com/external-source=true) that scopes the operator's Secret informer cache. When set, the operator only watches and can read Secrets carrying matching labels, shrinking the blast radius of its cluster-wide secret read and ensuring ExternalAttributeSync can only use Secrets an admin has explicitly labelled. Empty (default) watches all Secrets (back-compat); existing installs must label their external-source Secrets before setting this. | cmd/main.go:160 | ||||||||||||||||||||||||
--fleet-api-burst | int | 50 | yes (L109) | Fleet Management API rate-limiter burst size. Absorbs startup and post-restart request spikes without changing the sustained RPS ceiling. burst=1 causes livelock at scale: request #(rps*30+1) in a restart wave waits 30s and hits the HTTP timeout, indistinguishable from API outage. | cmd/main.go:171 | ||||||||||||||||||||||||
--fleet-api-rps | float64 | 3 | yes (L108) | Fleet Management API sustained rate limit in requests per second. Match this to your Fleet Management server-side api: rate setting. The standard stack default is 3; large or custom deployments may be higher. | cmd/main.go:167 | ||||||||||||||||||||||||
--health-probe-bind-address | string | :8081 | yes (L95) | The address the probe endpoint binds to. | cmd/main.go:112 | ||||||||||||||||||||||||
--leader-elect | bool | false | conditional (L90) | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. | cmd/main.go:113 | ||||||||||||||||||||||||
--leader-election-lease-duration | duration | 15 * time.Second | conditional (L91) | Duration non-leader candidates will wait before forcing leader acquisition. | cmd/main.go:203 | ||||||||||||||||||||||||
--leader-election-renew-deadline | duration | 10 * time.Second | conditional (L92) | Duration the acting leader will retry refreshing leadership before giving up. | cmd/main.go:205 | ||||||||||||||||||||||||
--leader-election-retry-period | duration | 2 * time.Second | conditional (L93) | Duration leader-election clients wait between action attempts. | cmd/main.go:207 | ||||||||||||||||||||||||
--metrics-bind-address | string | 0 | conditional (L117, L119) | The address the metrics endpoint binds to. Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service. | cmd/main.go:110 | ||||||||||||||||||||||||
--metrics-secure | bool | true | yes (L121) | If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead. | cmd/main.go:116 | ||||||||||||||||||||||||
--pipeline-name-scope | string | none | yes (L107) | Default Fleet pipeline name scope: "none" (use spec.name verbatim, the default) or "namespace" (prefix the Fleet name with "| cmd/main.go:154 | --webhook-cert-keystring | tls.keyconditional (L130) | The name of the webhook key file. | cmd/main.go:121 | --webhook-cert-namestring | tls.crtconditional (L129) | The name of the webhook certificate file. | cmd/main.go:120 | --webhook-cert-pathstring | — | conditional (L124, L126) | The directory that contains the webhook certificate. | cmd/main.go:119 | --webhook-portint | 9443yes (L97) | The port that the webhook server listens on. | cmd/main.go:118 | Chart coverage¶The "Set by chart?" column reflects whether the rendered deployment passes the flag to the manager binary today.
|