Add configurable HTTP timeout for artifact fetching

[vocarista]

Summary

This PR introduces a configurable timeout for HTTP requests used in artifact fetching to prevent indefinite blocking when the upstream source becomes unresponsive.

Problem

Currently, the retryable HTTP client does not set a timeout, allowing requests to block indefinitely if the underlying TCP connection remains open without a response.

Since retries are only triggered after a request fails, indefinitely blocking requests prevent retries from being invoked, leading to worker starvation and stalled reconciliations.

Root Cause

NewRetryableHTTPClient configures retry behavior but does not set HTTPClient.Timeout, leaving request duration unbounded.

Solution

This PR:

• Introduces a configurable HTTP timeout
• Sets HTTPClient.Timeout on the retryable client
• Adds a CLI flag (--http-timeout) with a default of 30s

Impact

This ensures that stalled HTTP requests eventually fail, allowing retries and reconciliation loops to continue instead of blocking indefinitely.

Notes

• Timeout applies per request attempt; total retry duration is still governed by retry configuration
• Users may need to tune timeout values based on network conditions and artifact size

Fixes #1463

[stefanprodan]

LGTM

Thanks @vocarista

[stefanprodan]

Can you please open a PR in the website repo and add the new flag here: https://github.com/fluxcd/website/blob/main/content/en/flux/components/helm/options.md

[vocarista]

Sure, I'll do that.

[vocarista]

I've opened a PR that adds this flag on fluxcd/website:
fluxcd/website#2527

[matheuscscp]

LGTM

[vocarista]

Hi @stefanprodan, @matheuscscp , Please consider backporting this PR to 1.5.x.
We run automated resiliency test suites against live clusters with SLA-bound completion windows. When source-controller becomes unavailable mid-reconciliation, the current behavior blocks helm-controller workers indefinitely (~15 min observed), stalling all subsequent test cases in the queue and causing cascading SLA violations.
With this change and --http-timeout=30s (default), the worst-case block reduces to ~4.5 min (30s × retries), after which the reconciliation fails fast and cluster self-healing can proceed. This makes failure modes predictable and bounded, which is a requirement for our resiliency testing infrastructure.
Given that this is a bug fix with a safe default and no breaking surface, we'd appreciate consideration for v1.5.5.

[fluxcdbot]

Successfully created backport PR for release/v1.5.x:

• [release/v1.5.x] Add configurable HTTP timeout for artifact fetching #1497