Currently the custom.metrics.k8s.io APIService uses
insecureSkipTLSVerify: true
According to https://godoc.org/k8s.io/kube-aggregator/pkg/apis/apiregistration/v1beta1 , this is "Strongly Discouraged" and we should perhaps make the autoscaler or the operator manage the APIService CABundle instead.