cluster: migrate registry from host container to in-cluster deployment (knative#3856)

* cluster: migrate registry from host container to in-cluster deployment

Migrates func cluster create to an in-cluster registry (Deployment +
Service + Contour Ingress + local-registry-hosting), matching hack/cluster.sh
(knative#3718). Host trust uses registry.localtest.me; containerd mirrors hostPort
:5000.

Also:
- Typed k8s objects for registry manifests (sigs.k8s.io/yaml)
- Wait for registry HTTP readiness on 127.0.0.1:5000/v2/
- Delete help + empty-list cleanup (fold #63 CLI path; no host-container teardown)
- Promote sigs.k8s.io/yaml to a direct require

Rebased onto current main (resolves merge conflict).

Functions#43 / knative#3856

* cluster: fix go.mod tidy after rebase; drop host HTTP registry wait

C1: restore main's dependency floor (knative#3978); only intentional go.mod delta
is promoting sigs.k8s.io/yaml to a direct require (typed registry manifests).

S1: remove waitForRegistryHTTP on 127.0.0.1:5000 — Kind does not map host
port 5000 (hostPort is node-local for containerd). Rely on kubectl wait
--for=condition=Available like hack/cluster.sh.

Functions#43 / knative#3856

Author: lkingland

cmd/cluster.go

@@ -198,8 +198,14 @@ SYNOPSIS
 	             [--skip-registry-config]
 
 DESCRIPTION
-	Deletes a local development cluster and its associated registry
-	container. If no name is given, the default cluster "func" is deleted.
+	Deletes a local development cluster. The in-cluster registry is removed
+	with the Kind cluster; host registry trust is reverted only when this is
+	the last func-managed cluster. If no name is given, the default cluster
+	"func" is deleted.
+
+	When no func-managed clusters are tracked, delete still runs the cleanup
+	path (no error) so host registry trust can be cleared. A name that does
+	not match any tracked cluster is an error when others exist.
 
 	When multiple func-managed clusters exist, specify which one by name.
 	Use '{{rootCmdUse}} cluster list' to see existing clusters.
@@ -252,7 +258,7 @@ func runClusterDelete(cmd *cobra.Command, args []string) error {
 	// If clusters are tracked and a non-matching name was given, refuse with
 	// a clear message — otherwise hand off to Delete, which handles both
 	// "delete the matched cluster" and "nothing tracked" (idempotent cleanup
-	// of shared resources Delete already owns when List() is empty).
+	// of host registry trust when List() is empty).
 	clusters := cluster.List()
 	if len(clusters) > 0 {
 		matched := false

go.mod

@@ -76,6 +76,7 @@ require (
 	knative.dev/pkg v0.0.0-20260727151759-521cb33b33dd
 	knative.dev/serving v0.50.0
 	sigs.k8s.io/controller-runtime v0.23.3
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -325,5 +326,4 @@ require (
 	sigs.k8s.io/kustomize/kyaml v0.21.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 )

pkg/cluster/delete.go

@@ -8,16 +8,16 @@ import (
 	"path/filepath"
 )
 
-// Delete removes a single func-managed dev cluster. The shared registry
-// container and the host's insecure-registries entry are removed only when
-// the *last* func-managed cluster is being torn down — other surviving
-// clusters keep using the shared registry.
+// Delete removes a func-managed dev cluster. The in-cluster registry is
+// destroyed automatically with the Kind cluster. Host-side trust config
+// (insecure-registries) is only reverted when this is the last func cluster,
+// since other surviving clusters share the same host entry.
 //
 // Delete is safe when nothing is tracked (empty List / no kubeconfig): it
-// still runs the empty-list shared-resource teardown and returns nil
-// (idempotent, rm -f style). kind-delete failures are only warned when a
-// kubeconfig was present — otherwise every empty-system delete would print
-// a scary "failed to delete cluster" for a cluster that never existed.
+// still runs empty-list host-trust teardown and returns nil (idempotent,
+// rm -f style). kind-delete failures are only warned when a kubeconfig was
+// present — otherwise every empty-system delete would print a scary
+// "failed to delete cluster" for a cluster that never existed.
 func Delete(ctx context.Context, cfg ClusterConfig, out io.Writer) error {
 	// Set KUBECONFIG for child processes; restore the caller's value on return.
 	defer setKubeconfig(cfg.Kubeconfig())()
@@ -40,16 +40,12 @@ func Delete(ctx context.Context, cfg ClusterConfig, out io.Writer) error {
 	// below reflects the post-delete state.
 	_ = os.RemoveAll(filepath.Dir(cfg.Kubeconfig()))
 
-	remaining := List()
-	if len(remaining) == 0 {
-		status(out, "Last func cluster removed; tearing down shared registry")
-		teardownRegistry(ctx, cfg, out)
-		if !cfg.SkipRegistryConfig {
-			revertHostRegistry(out)
-		}
-	} else {
-		fmt.Fprintf(out, "Registry left running; shared with %d other func-managed cluster(s): %v\n",
-			len(remaining), remaining)
+	if remaining := List(); len(remaining) > 0 {
+		fmt.Fprintf(out, "Other func-managed cluster(s) still running: %v; leaving host registry config in place.\n",
+			remaining)
+	} else if !cfg.SkipRegistryConfig {
+		status(out, "Last func cluster removed; reverting host registry trust")
+		revertHostRegistry(out)
 	}
 
 	fmt.Fprintf(out, "%s  Downloaded container images are not automatically removed.\n", red("NOTE:"))

pkg/cluster/kubernetes.go

@@ -16,7 +16,7 @@ const kindConfigTemplate = `kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: kindest/node:%[1]s
+    image: kindest/node:%s
     extraPortMappings:
     - containerPort: 80
       hostPort: 80
@@ -29,14 +29,14 @@ nodes:
       listenAddress: "127.0.0.1"
 containerdConfigPatches:
 - |-
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."localhost:%[2]d"]
-    endpoint = ["http://%[3]s:%[4]d"]
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.default.svc.cluster.local:%[4]d"]
-    endpoint = ["http://%[3]s:%[4]d"]
+  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.localtest.me"]
+    endpoint = ["http://localhost:5000"]
+  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.default.svc.cluster.local:5000"]
+    endpoint = ["http://localhost:5000"]
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors."ghcr.io"]
-    endpoint = ["http://%[3]s:%[4]d"]
+    endpoint = ["http://localhost:5000"]
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors."quay.io"]
-    endpoint = ["http://%[3]s:%[4]d"]
+    endpoint = ["http://localhost:5000"]
 `
 
 const metalLBPoolTemplate = `apiVersion: metallb.io/v1beta1
@@ -59,8 +59,7 @@ func installKubernetes(ctx context.Context, cfg ClusterConfig, out io.Writer) er
 	start := time.Now()
 	status(out, "Allocating")
 
-	kindConfig := fmt.Sprintf(kindConfigTemplate,
-		kindNodeVersion, registryHostPort, registryContainerName, registryContainerPort)
+	kindConfig := fmt.Sprintf(kindConfigTemplate, kindNodeVersion)
 
 	err := run(ctx, out, kindConfig,
 		cfg.kind(), "create", "cluster",