Arguably self signed certs eliminates possible state funded middle man attacks making it more secure

As a technology, properly-implemented self-signed certs are totally fine. The problem is that k8s does not have the features necessary to use self-signed certs securely. Instead, it expects you to create your own CA (or CAs: you can use separate ones for different kinds of communication if you want extra bulkheads) and then to share out your private CA's cert to all the k8s components. This achieves your goal of cutting out MITM attacks via unscrupulous commercial CAs while also making it possible to trust families of certs for a given purpose, rather than having to whitelist every single consumer's private key.

This is great. If a state funded threat is in your network in the position to place a certificate on a server do you think your self signed certificate will protect you?

Think of it as a cost and effort threshold. Prevents the dragnet / fishing methods from eavesdropping. It's trivial to force $Company to let you in with letter. The effort to break encryption is not trivial. You have to be doing something wrong to get specific attention.

I mean if you use cert pinning with a public CA you get the same results, aka you can easily spot MITM. I am generally not a big fan of private CAs.

Self signed certs are absolutely secure and more secure than non-self signed assuming you are using proper key management.

Now, whether or not that works for your users...

I think he's implying a whitelisted set of self signed certs, not "trust any cert".

I think more likely he's implying using a private certificate authority.

Unfortunately, Kubernetes does not support that mode of operation.

You can create your own CA cert and put it in the root store on each instance. This can be incorporated into the provisioning and deployment pipeline for creating the nodes.

Definitely! That is how you are supposed to do it! That is a private CA, not self-signed certs, though.