[clustertool] Set Kubernetes Registry discovery service to disabled (default)

[vbrik-ha]

Is your feature request related to a problem?

Kubernetes registry is deprecated as it is not compatible with Kubernetes 1.32 and later versions in the default configuration (https://www.talos.dev/v1.9/talos-guides/discovery/). Clustertool currently carries out a replace operation to enable the service via the patch files generated via clustertool init i.e. clusters/main/talos/patches/all.yaml), i.e

- op: replace
  path: /cluster/discovery/registries/kubernetes
  value:
    disabled: false

This now results in node watch API errors with the introduction and support of Kubernetes 1.32

Describe the solution you'd like

Update clustertool to remove the op replace yaml entries for enabling the Kubernetes registry discovery service or explicitly set the following;

- op: replace
  path: /cluster/discovery/registries/kubernetes
  value:
    disabled: true

By default, Talos will use the service registry (external and not dependent on etcd), while the kubernetes registry is disabled.

Describe alternatives you've considered

The issue is introduced in Kubernetes 1.32 due to the AuthorizeNodeWithSelectors feature gate stopping Talos Kubernetes registry from functioning correctly. There is an alternative to disable the feature gate on the API server but this is not recommended due to it disabling several other key security protections.

Additional context

Limited testing has been carried out directly modifying the clustertool generated machine files to disable the kubernetes Registry discovery service and leaving the external registry service enabled, applied to the cluster nodes to confirm the API errors are no longer received (following node reboot) and kubectl/talosctl cluster/node operations continue to run and return expected results.

I've read and agree with the following

• I've checked all open and closed issues and my request is not there.
• I've checked all open and closed pull requests and my request is not there.