VC-36593: Tests: Make sure --venafi-cloud can be used along with --client-id

[maelvls]

Ref: VC-36593

While preparing for https://venafi.atlassian.net/browse/VC-36353, I found that I was using go run . --client-id redacted without --venafi-cloud.

Olu and I worried that it might be a combination of flags that is no longer possible due to the changes introduced in https://venafi.atlassian.net/browse/VC-36043.

To prevent any future breakage, this PR adds a unit test that enforces that it is possible to use --client-id along with --venafi-cloud, since this combination is used in the Helm chart.

[wallrj]

Thanks @maelvls

I ran the test locally with a modification so that I could see what log messages are produced by this combination.

diff --git a/pkg/agent/config_test.go b/pkg/agent/config_test.go
index 71d8802..e3e64a7 100644
--- a/pkg/agent/config_test.go
+++ b/pkg/agent/config_test.go
@@ -259,8 +259,9 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
        })

        t.Run("venafi-cloud-keypair-auth: it is possible to use --client-id with --venafi-cloud", func(t *testing.T) {
+               l, b := recordLogs()
                privKeyPath := withFile(t, fakePrivKeyPEM)
-               got, cl, err := ValidateAndCombineConfig(discardLogs(),
+               got, cl, err := ValidateAndCombineConfig(l,
                        withConfig(testutil.Undent(`
                                server: "http://localhost:8080"
                                period: 1h
@@ -273,6 +274,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
                require.NoError(t, err)
                assert.Equal(t, VenafiCloudKeypair, got.AuthMode)
                assert.IsType(t, &client.VenafiCloudClient{}, cl)
+               t.Log(b.String())
        })

        t.Run("jetstack-secure-oauth-auth: fail if organization_id or cluster_id is missing and --venafi-cloud not enabled", func(t *testing.T) {

$ go test ./pkg/agent/... -run "Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth: it is possible to use --client-id with --venafi-cloud" -v --count 1
=== RUN   Test_ValidateAndCombineConfig
=== RUN   Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth:_it_is_possible_to_use_--client-id_with_--venafi-cloud
    config_test.go:277: Using the Venafi Cloud Key Pair Service Account auth mode since --client-id and --private-key-path were specified.
        Using period from config 1h0m0s
        Loading upload_path from "venafi-cloud" configuration.

--- PASS: Test_ValidateAndCombineConfig (0.00s)
    --- PASS: Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth:_it_is_possible_to_use_--client-id_with_--venafi-cloud (0.00s)
=== RUN   Test_ValidateAndCombineConfig_VenafiCloudKeyPair
--- PASS: Test_ValidateAndCombineConfig_VenafiCloudKeyPair (0.00s)
=== RUN   Test_ValidateAndCombineConfig_VenafiConnection
    envtest.go:51: Waiting for envtest to exit
--- PASS: Test_ValidateAndCombineConfig_VenafiConnection (6.60s)
PASS
ok      github.com/jetstack/preflight/pkg/agent 6.627s

1. I can't remember the circumstances where client-id is and is not required? Is it only required when using private key based Venafi Cloud service accounts? And not required when using OIDC service accounts?
2. I didn't understand why these tests require a Kubernetes API server via envtest?

$ go test ./pkg/agent/... -run "Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth: it is possible to use --client-id with --venafi-cloud" -v --count 1
=== RUN   Test_ValidateAndCombineConfig
=== RUN   Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth:_it_is_possible_to_use_--client-id_with_--venafi-cloud
    config_test.go:277: Using the Venafi Cloud Key Pair Service Account auth mode since --client-id and --private-key-path were specified.
        Using period from config 1h0m0s
        Loading upload_path from "venafi-cloud" configuration.

--- PASS: Test_ValidateAndCombineConfig (0.00s)
    --- PASS: Test_ValidateAndCombineConfig/venafi-cloud-keypair-auth:_it_is_possible_to_use_--client-id_with_--venafi-cloud (0.00s)
=== RUN   Test_ValidateAndCombineConfig_VenafiCloudKeyPair
--- PASS: Test_ValidateAndCombineConfig_VenafiCloudKeyPair (0.00s)
=== RUN   Test_ValidateAndCombineConfig_VenafiConnection
    config_test.go:631: KUBEBUILDER_ASSETS isn't set. You can run this test using `make test`.
        But if you prefer not to use `make`, run these two commands first:
            make _bin/tools/{kube-apiserver,etcd}
            export KUBEBUILDER_ASSETS=$PWD/_bin/tools
--- FAIL: Test_ValidateAndCombineConfig_VenafiConnection (0.00s)
FAIL
FAIL    github.com/jetstack/preflight/pkg/agent 0.024s
FAIL

/approve
/lgtm