From 9cd126243c245f8e02a41af50eb311aefbd63b82 Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Mon, 19 Jan 2026 09:23:29 -0800
Subject: [PATCH] Make ProxyClass default for all Tailscale proxies

- Set `default: true` on ProxyClass so all Services/Ingresses use it
- Remove explicit proxy-class annotation from databases service
- Fixes CRI-O short image name issue globally for Tailscale resources

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 argocd/manifests/databases/service-tailscale.yaml   | 1 -
 argocd/manifests/tailscale-operator/proxyclass.yaml | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/argocd/manifests/databases/service-tailscale.yaml b/argocd/manifests/databases/service-tailscale.yaml
index 8e3d1d0..ab69280 100644
--- a/argocd/manifests/databases/service-tailscale.yaml
+++ b/argocd/manifests/databases/service-tailscale.yaml
@@ -8,7 +8,6 @@ metadata:
   namespace: databases
   annotations:
     tailscale.com/hostname: "k8s-pg"
-    tailscale.com/proxy-class: "default"
 spec:
   type: LoadBalancer
   loadBalancerClass: tailscale
diff --git a/argocd/manifests/tailscale-operator/proxyclass.yaml b/argocd/manifests/tailscale-operator/proxyclass.yaml
index 9b88262..2704872 100644
--- a/argocd/manifests/tailscale-operator/proxyclass.yaml
+++ b/argocd/manifests/tailscale-operator/proxyclass.yaml
@@ -2,15 +2,15 @@
 # CRI-O cannot resolve short image names, so we must use fully-qualified references.
 # This ProxyClass sets the tailscale container images to use docker.io prefix.
 #
-# Apply this after operator.yaml. Services should reference this via:
-#   annotations:
-#     tailscale.com/proxy-class: "default"
+# With `default: true`, this ProxyClass is automatically applied to all
+# Services/Ingresses that don't explicitly specify a different proxy-class.
 ---
 apiVersion: tailscale.com/v1alpha1
 kind: ProxyClass
 metadata:
   name: default
 spec:
+  default: true
   statefulSet:
     pod:
       tailscaleContainer: