--- title: Manager Flags description: Every fleet-management-operator manager CLI flag, its default, and whether the Helm chart sets it. --- # Manager Flags The `manager` binary accepts the flags listed below. They are also surfaced through the Helm chart's `controllers.*` and `fleetManagement.*` value blocks where applicable. Defaults are conservative: every controller other than `pipeline` is opt-in. | Flag | Type | Default | Set by chart? | Description | Source | | --- | --- | --- | --- | --- | --- | | `--controller-discovery-max-concurrent` | int | `1` | yes (L114) | Max concurrent reconciles for CollectorDiscovery. Keep at 1: concurrency > 1 triggers multiple ListCollectors calls per poll cycle without benefit. | [cmd/main.go:183](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L183) | | `--controller-pipeline-discovery-max-concurrent` | int | `1` | yes (L115) | Max concurrent reconciles for PipelineDiscovery. Keep at 1: concurrency > 1 triggers multiple ListPipelines calls per poll cycle without benefit. | [cmd/main.go:186](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L186) | | `--controller-policy-max-concurrent` | int | `4` | yes (L110) | Max concurrent reconciles for RemoteAttributePolicy. Safe to increase: reconciles are pure K8s cache reads with no external API calls. Pipeline and Collector must stay at 1 because they share the Fleet API rate budget. | [cmd/main.go:176](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L176) | | `--controller-sync-max-concurrent` | int | `4` | yes (L111) | Max concurrent reconciles for ExternalAttributeSync. Safe to increase: Fetch calls are per-source and do not share external state across reconciles. | [cmd/main.go:180](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L180) | | `--controller-sync-target-burst` | int | `4` | yes (L113) | Bucket size for the per-target ExternalAttributeSync limiter. Ignored when --controller-sync-target-rate=0. Default 4 (matching --controller-sync-max-concurrent so a single concurrency generation always passes through immediately). | [cmd/main.go:195](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L195) | | `--controller-sync-target-rate` | float64 | `0` | yes (L112) | Per-target rate limit (tokens/sec) applied before each ExternalAttributeSync Source.Fetch call. Two syncs against the same upstream (HTTP host or SQL secret) share a token bucket so MaxConcurrentReconciles cannot stampede a customer-owned source. Zero (default) disables per-target limiting. Set 1 for one fetch/sec/upstream — typically plenty given that sync schedules run every minute or longer. | [cmd/main.go:189](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L189) | | `--enable-collector-controller` | bool | `false` | yes (L99) | Enable the Collector reconciler and webhook (manages collector remote attributes). | [cmd/main.go:131](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L131) | | `--enable-collector-discovery-controller` | bool | `false` | yes (L102) | Enable the CollectorDiscovery reconciler and webhook (auto-mirrors Fleet Management collectors as Collector CRs). | [cmd/main.go:137](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L137) | | `--enable-external-sync-controller` | bool | `false` | yes (L101) | Enable the ExternalAttributeSync reconciler and webhook (HTTP/SQL-backed scheduled attribute pulls). | [cmd/main.go:135](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L135) | | `--enable-http2` | bool | `false` | yes (L122) | If set, HTTP/2 will be enabled for the metrics and webhook servers | [cmd/main.go:127](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L127) | | `--enable-pipeline-controller` | bool | `true` | yes (L98) | Enable the Pipeline reconciler and webhook. | [cmd/main.go:129](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L129) | | `--enable-pipeline-discovery-controller` | bool | `false` | yes (L103) | Enable the PipelineDiscovery controller (polls Fleet Management ListPipelines and creates Pipeline CRs). | [cmd/main.go:139](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L139) | | `--enable-policy-controller` | bool | `false` | yes (L100) | Enable the RemoteAttributePolicy reconciler and webhook (bulk attribute assignment by selector). | [cmd/main.go:133](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L133) | | `--enable-tenant-policy-enforcement` | bool | `false` | yes (L104) | Enable TenantPolicy CRD validation and enforcement. When set, validating webhooks for Pipeline, RemoteAttributePolicy, ExternalAttributeSync, and CollectorDiscovery require that K8s subjects matched by a TenantPolicy include at least one of the policy's required matchers in the CR's matcher set. Default false; existing installs see no behavior change until this flag is set. | [cmd/main.go:141](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L141) | | `--enforce-cross-namespace-discovery-authz` | bool | `false` | yes (L105) | Enforce that the user creating a PipelineDiscovery or CollectorDiscovery with a spec.targetNamespace different from the CR's own namespace is itself authorized to create Pipelines / Collectors in that target namespace, via a SubjectAccessReview at admission time. Closes the cross-namespace confused-deputy escalation where the operator's cluster-wide ServiceAccount would otherwise be borrowed to write CRs into any namespace. Default false (default-allow) so existing installs see no behavior change until set. | [cmd/main.go:147](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L147) | | `--external-source-secret-label-selector` | string | — | yes (L106) | Optional Kubernetes label selector (e.g. fleetmanagement.grafana.com/external-source=true) that scopes the operator's Secret informer cache. When set, the operator only watches and can read Secrets carrying matching labels, shrinking the blast radius of its cluster-wide secret read and ensuring ExternalAttributeSync can only use Secrets an admin has explicitly labelled. Empty (default) watches all Secrets (back-compat); existing installs must label their external-source Secrets before setting this. | [cmd/main.go:160](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L160) | | `--fleet-api-burst` | int | `50` | yes (L109) | Fleet Management API rate-limiter burst size. Absorbs startup and post-restart request spikes without changing the sustained RPS ceiling. burst=1 causes livelock at scale: request #(rps*30+1) in a restart wave waits 30s and hits the HTTP timeout, indistinguishable from API outage. | [cmd/main.go:171](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L171) | | `--fleet-api-rps` | float64 | `3` | yes (L108) | Fleet Management API sustained rate limit in requests per second. Match this to your Fleet Management server-side api: rate setting. The standard stack default is 3; large or custom deployments may be higher. | [cmd/main.go:167](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L167) | | `--health-probe-bind-address` | string | `:8081` | yes (L95) | The address the probe endpoint binds to. | [cmd/main.go:112](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L112) | | `--leader-elect` | bool | `false` | conditional (L90) | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. | [cmd/main.go:113](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L113) | | `--leader-election-lease-duration` | duration | `15 * time.Second` | conditional (L91) | Duration non-leader candidates will wait before forcing leader acquisition. | [cmd/main.go:203](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L203) | | `--leader-election-renew-deadline` | duration | `10 * time.Second` | conditional (L92) | Duration the acting leader will retry refreshing leadership before giving up. | [cmd/main.go:205](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L205) | | `--leader-election-retry-period` | duration | `2 * time.Second` | conditional (L93) | Duration leader-election clients wait between action attempts. | [cmd/main.go:207](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L207) | | `--metrics-bind-address` | string | `0` | conditional (L117, L119) | The address the metrics endpoint binds to. Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service. | [cmd/main.go:110](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L110) | | `--metrics-secure` | bool | `true` | yes (L121) | If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead. | [cmd/main.go:116](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L116) | | `--pipeline-name-scope` | string | `none` | yes (L107) | Default Fleet pipeline name scope: "none" (use spec.name verbatim, the default) or "namespace" (prefix the Fleet name with "." so pipelines in different namespaces cannot collide). A per-Pipeline fleetmanagement.grafana.com/name-scope annotation overrides this. Enabling "namespace" auto-migrates existing pipelines (delete-and-recreate); see docs/runbooks/pipeline-name-scope-migration.md. | [cmd/main.go:154](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L154) | | `--webhook-cert-key` | string | `tls.key` | conditional (L130) | The name of the webhook key file. | [cmd/main.go:121](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L121) | | `--webhook-cert-name` | string | `tls.crt` | conditional (L129) | The name of the webhook certificate file. | [cmd/main.go:120](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L120) | | `--webhook-cert-path` | string | — | conditional (L124, L126) | The directory that contains the webhook certificate. | [cmd/main.go:119](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L119) | | `--webhook-port` | int | `9443` | yes (L97) | The port that the webhook server listens on. | [cmd/main.go:118](https://github.com/rknightion/fleet-management-operator/blob/main/cmd/main.go#L118) | ## Chart coverage The "Set by chart?" column reflects whether the rendered deployment passes the flag to the manager binary today. - **yes** — the flag is unconditionally rendered into the deployment `args:` list. - **conditional** — the flag is only rendered under a Helm `if` guard (typical for cert / leader-election / metrics-secure flags). Whether you see it on a given install depends on values. - **no** — the flag is never set by the chart. Either the default is the intended value for chart users (and the flag is reserved for `make run` workflows or out-of-tree integrations), or the chart is missing coverage. `no` rows are worth checking against new feature flags.