From dba1ae1461153350ef042da94dfa3941d6fc4021 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Sat, 25 Apr 2026 01:13:17 +0300 Subject: [PATCH] fix(etcd): add timeout range validation and apk error handling Add final robustness improvements: **Helm template validation** 1. **certWaitTimeout range check**: Added validation that timeout is between 10 and 3600 seconds. Prevents invalid values like 0, negative numbers, or excessive timeouts that would waste resources. Complements runtime validation by failing fast at template render time. **Runtime error handling** 2. **Check apk add success**: Added explicit error handling for openssl installation. If apk fails (network issues, mirror unavailable, package missing), Job now fails immediately with clear error message instead of cryptic "openssl: command not found" later in execution. These changes improve user experience by providing early validation and clear error messages when configuration is incorrect or runtime dependencies fail. Signed-off-by: IvanHunters --- packages/extra/etcd/templates/datastore.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/extra/etcd/templates/datastore.yaml b/packages/extra/etcd/templates/datastore.yaml index 49db47d4d..da37c9fa8 100644 --- a/packages/extra/etcd/templates/datastore.yaml +++ b/packages/extra/etcd/templates/datastore.yaml @@ -1,6 +1,9 @@ {{- if not (kindIs "float64" .Values.certWaitTimeout) }} {{- fail "certWaitTimeout must be a number" }} {{- end }} +{{- if or (lt (.Values.certWaitTimeout | int) 10) (gt (.Values.certWaitTimeout | int) 3600) }} + {{- fail "certWaitTimeout must be between 10 and 3600 seconds" }} +{{- end }} --- apiVersion: v1 kind: ServiceAccount @@ -92,7 +95,10 @@ spec: # Install required utilities # openssl: for certificate validation (checkend, pubkey extraction) - apk add --no-cache openssl + if ! apk add --no-cache openssl; then + echo "ERROR: Failed to install openssl. Check network connectivity and Alpine package repository availability." + exit 1 + fi # Get namespace from ServiceAccount NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)