cmd/k8s-operator: fix Service reconcile triggers for default ProxyClass (#18983)

The e2e ingress test was very occasionally flaky. On looking at operator
logs from one failure, you can see the default ProxyClass was not ready
before the first reconcile loop for the exposed Service. The ProxyClass
became ready soon after, but no additional reconciles were triggered for
the exposed Service because we only triggered reconciles for Services
that explicitly named their ProxyClass.

This change adds additional list API calls for when it's the default
ProxyClass that's been updated in order to catch Services that use it by
default. It also adds indexes for the fields we need to search on to
ensure the list is efficient.

Fixes tailscale/corp#37533

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>

cmd/k8s-operator/e2e/setup.go

@@ -56,6 +56,7 @@ import (
 	"tailscale.com/internal/client/tailscale"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/store/mem"
+	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/tsnet"
 )
@@ -438,7 +439,7 @@ func runTests(m *testing.M) (int, error) {
 		return 0, fmt.Errorf("failed to install %q via helm: %w", relName, err)
 	}
 
-	if err := applyDefaultProxyClass(ctx, kubeClient); err != nil {
+	if err := applyDefaultProxyClass(ctx, logger, kubeClient); err != nil {
 		return 0, fmt.Errorf("failed to apply default ProxyClass: %w", err)
 	}
 
@@ -537,7 +538,7 @@ func tagForRepo(dir string) (string, error) {
 	return tag, nil
 }
 
-func applyDefaultProxyClass(ctx context.Context, cl client.Client) error {
+func applyDefaultProxyClass(ctx context.Context, logger *zap.SugaredLogger, cl client.Client) error {
 	pc := &tsapi.ProxyClass{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: tsapi.SchemeGroupVersion.String(),
@@ -565,6 +566,24 @@ func applyDefaultProxyClass(ctx context.Context, cl client.Client) error {
 		return fmt.Errorf("failed to apply default ProxyClass: %w", err)
 	}
 
+	// Wait for the ProxyClass to be marked ready.
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+	for {
+		if err := cl.Get(ctx, client.ObjectKeyFromObject(pc), pc); err != nil {
+			return fmt.Errorf("failed to get default ProxyClass: %w", err)
+		}
+		if tsoperator.ProxyClassIsReady(pc) {
+			break
+		}
+		logger.Info("waiting for default ProxyClass to be ready...")
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("timeout waiting for default ProxyClass to be ready")
+		case <-time.After(time.Second):
+		}
+	}
+
 	return nil
 }