Spire agent should error if -insecureBootstrap and -trustBundleUrl are given

[mnp]

• Version:
  1.7.2
• Platform:
  Linux da497fc50492 5.10.124-linuxkit CLI authentication #1 SMP Thu Jun 30 08:19:10 UTC 2022 x86_64 GNU/Linux
• Subsystem:
  agent

Docs say only one of the three options can be set at once, but the agent will not error out with that message if you try.

Eg spire-agent run -config /hacked.conf -joinToken ... -insecureBootstrap -trustBundleUrl https://abc.xy:8081 will carry on trying to call the URL instead of bailing early.

This noob user was confused for a while before more RTFM and realized it's an invalid usage.

[evan2645]

Thanks for reporting this @mnp

Any chance you're up for sending a PR too?

[mnp]

Yeah, if I get a minute. Anyone else, feel free though.

[SilvaMatteus]

Hi guys,

I was looking at the issues to contribute again after some time not being able to do so.

There is a test in https://github.com/spiffe/spire/blob/main/cmd/spire-agent/cli/run/run_test.go#L744. However this test does not catch the right error. I forced the test case to fail by setting expectError: false:

--- FAIL: TestNewAgentConfig (0.00s)
    --- FAIL: TestNewAgentConfig/insecure_bootstrap_and_trust_bundle_url_cannot_both_be_set (0.00s)
        run_test.go:935:
            	Error Trace:	/home/matteus/spire/cmd/spire-agent/cli/run/run_test.go:935
            	Error:      	Received unexpected error:
            	            	only one of trust_bundle_url or trust_bundle_path can be specified, not both
            	Test:       	TestNewAgentConfig/insecure_bootstrap_and_trust_bundle_url_cannot_both_be_set
FAIL

It is actually failing because of "only one of trust_bundle_url or trust_bundle_path can be specified, not both".

I would use a function expectErrorContains to catch the right error, if you guys do not mind me tackling this issue.

[SilvaMatteus]

@evan2645, should we close this now that #4532 is merged?