fix(etcd): add timeout range validation and apk error handling

Add final robustness improvements:

**Helm template validation**

1. **certWaitTimeout range check**: Added validation that timeout is between
   10 and 3600 seconds. Prevents invalid values like 0, negative numbers, or
   excessive timeouts that would waste resources. Complements runtime validation
   by failing fast at template render time.

**Runtime error handling**

2. **Check apk add success**: Added explicit error handling for openssl
   installation. If apk fails (network issues, mirror unavailable, package
   missing), Job now fails immediately with clear error message instead of
   cryptic "openssl: command not found" later in execution.

These changes improve user experience by providing early validation and clear
error messages when configuration is incorrect or runtime dependencies fail.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

packages/extra/etcd/templates/datastore.yaml

@@ -1,6 +1,9 @@
 {{- if not (kindIs "float64" .Values.certWaitTimeout) }}
   {{- fail "certWaitTimeout must be a number" }}
 {{- end }}
+{{- if or (lt (.Values.certWaitTimeout | int) 10) (gt (.Values.certWaitTimeout | int) 3600) }}
+  {{- fail "certWaitTimeout must be between 10 and 3600 seconds" }}
+{{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -92,7 +95,10 @@ spec:
 
           # Install required utilities
           # openssl: for certificate validation (checkend, pubkey extraction)
-          apk add --no-cache openssl
+          if ! apk add --no-cache openssl; then
+            echo "ERROR: Failed to install openssl. Check network connectivity and Alpine package repository availability."
+            exit 1
+          fi
 
           # Get namespace from ServiceAccount
           NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)