I need some help to understand what is the proper way to secure the communication channel between the API Server and the Metrics Server in a production k8s cluster.

There is a setting inside the APIService manifest: https://github.com/kubernetes-sigs/metrics-server/blob/master/manifests/base/apiservice.yaml#L12 insecureSkipTLSVerify: true which is the default. If I deploy the manifests from the Metrics Server as-is from GitHub – the Metrics Server ends up with a self-signed certificate that the APIService does not verify (because of insecureSkipTLSVerify: true).

How do people secure this in production clusters? I suppose I need to generate a certificate for the Metrics Server and sign it with the APIServer’s CA. The generated certificate should then be passed to the Metrics Server by --tls-cert-file and --tls-private-key-file. Is this correct?

Do I have to set the caBundle on the APIService then? In what format?
Is there a better way to achieve this, i.e. by using the cert manager operator?