I'm trying to see why the metrics service has a type of NodePort.
https://github.com/aws-controllers-k8s/code-generator/blame/v0.47.2/templates/config/controller/service.yaml.tpl#L14
This is quite an unusual default; and we found that this resulted in ACK metrics being available to anything in our VPC (thankfully the security group to the outside world was denying it)