Metrics API (metrics.k8s.io) wasn't registered, so kubectl top failed with
'Metrics API not available'. kube-state-metrics from kube-prometheus-stack
doesn't provide it. Uses --kubelet-insecure-tls since kubeadm kubelets serve
self-signed certs (no serverTLSBootstrap), and scrapes kubelets by
InternalIP.
