fix(conjur): add InstallTimeout to helm chart installation and pin server image version (#6658)

Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>
Signed-off-by: Alexander Chernov <alexander@chernov.it>

e2e/framework/addon/chart.go

@@ -39,6 +39,8 @@ type HelmChart struct {
 	Vars         []StringTuple
 	Values       []string
 	Args         []string
+	// InstallTimeout overrides `helm install --timeout` (empty = default).
+	InstallTimeout string
 
 	config *Config
 }
@@ -60,6 +62,10 @@ func (c *HelmChart) Setup(cfg *Config) error {
 	return nil
 }
 
+// defaultInstallTimeout is the `helm install --wait` timeout used when a chart
+// does not set InstallTimeout.
+const defaultInstallTimeout = "600s"
+
 // Install adds the chart repo and installs the helm chart.
 func (c *HelmChart) Install() error {
 	args := []string{
@@ -77,11 +83,16 @@ func (c *HelmChart) Install() error {
 		return err
 	}
 
+	timeout := c.InstallTimeout
+	if timeout == "" {
+		timeout = defaultInstallTimeout
+	}
+
 	args = []string{"install", c.ReleaseName, c.Chart,
 		"--dependency-update",
 		"--debug",
 		"--wait",
-		"--timeout", "600s",
+		"--timeout", timeout,
 		"-o", "yaml",
 		"--namespace", c.Namespace,
 	}

e2e/framework/addon/conjur.go

@@ -147,6 +147,8 @@ func NewConjur() *Conjur {
 			Chart:       fmt.Sprintf("%s/conjur-oss", repo),
 			// Pinned to the current latest conjur-oss chart release. Bump alongside conjurReleaseVersion.
 			ChartVersion: "2.1.1",
+			// Cap the wait so a crashlooping server fails fast (see image.tag).
+			InstallTimeout: "300s",
 			Repo: ChartRepo{
 				Name: repo,
 				URL:  "https://cyberark.github.io/helm-charts",
@@ -154,6 +156,9 @@ func NewConjur() *Conjur {
 			Values: []string{filepath.Join(AssetDir(), "conjur.values.yaml")},
 			Args: []string{
 				"--create-namespace",
+				// Pin the server image; the chart default `latest` is frozen at
+				// 1.24.0, which rejects the authn-cert authenticators.
+				"--set", "image.tag=" + conjurServerImageTag,
 				"--set", "ssl.caCert=" + base64.StdEncoding.EncodeToString(rootPem),
 				"--set", "ssl.caKey=" + base64.StdEncoding.EncodeToString(rootKeyPEM),
 				"--set", "ssl.cert=" + base64.StdEncoding.EncodeToString(serverPem),
@@ -349,6 +354,12 @@ func (l *Conjur) initConjur() error {
 // authenticator-service binary. Bump this when a newer release is needed.
 const conjurReleaseVersion = "v1.27.0"
 
+// conjurServerImageTag pins the cyberark/conjur server image. The chart default
+// `latest` is frozen at 1.24.0, which predates the authn-cert authenticator
+// type, so it must be a version that supports it (kept in step with
+// conjurReleaseVersion).
+const conjurServerImageTag = "1.27.0"
+
 // authenticatorServiceInitScript downloads the authenticator-service binary matching the
 // node's architecture from the pinned cyberark/conjur GitHub release (see
 // conjurReleaseVersion), and writes its minimal config file, into a shared emptyDir volume