Metrics API (metrics.k8s.io) wasn't registered, so kubectl top failed with 'Metrics API not available'. kube-state-metrics from kube-prometheus-stack doesn't provide it. Uses --kubelet-insecure-tls since kubeadm kubelets serve self-signed certs (no serverTLSBootstrap), and scrapes kubelets by InternalIP.