knife bootstrap failed with ssh_agent_signing enabled in config.rb

Description

When ssh_agent_signing is enabled in config.rb, knife bootstrap will result in authentication error. However, turning off ssh_agent_signing and using a RSA private key in client_key work totally fine.

Chef Version

14.14.25 as well as 15.4.45

Platform Version

Debian 10.1 Buster

Replication Case

Enable ssh_agent_signing in config.rb as following, and run a validatorless bootstrap for some node.

client_key        "#{ENV['HOME']}/.chef/my-public-key.pem"
ssh_agent_signing true

Client Output

$ knife bootstrap 172.18.248.35 -N chef-test-1 -U root -r 'recipe[chef-client]' -V
Connecting to 172.18.248.35
The authenticity of host '172.18.248.35 ()' can't be established.
fingerprint is SHA256:hHtoY5Qa0mo+0W+6BBPH+OAgOJ+M0Xw/19GwCwr2eIE.

Are you sure you want to continue connecting
? (Y/N) y
Connecting to 172.18.248.35
Creating new client for chef-test-1
Creating new node for chef-test-1
ERROR: Mixlib::Authentication::AuthenticationError: Unable to sign request with ssh-agent. Make sure your key is loaded with ssh-add: Net::SSH::Authentication::AgentError agent could not sign data with requested identity)

Bug Trace

This bugs happens in Chef::Knife::Bootstrap::ClientBuilder. When bootstrapping a new node, a new client key is created and assigned to its rest API object.

https://github.com/chef/chef/blob/566c08e697b1aef312def2150a59c8c651edb982/lib/chef/knife/bootstrap/client_builder.rb#L196-L198

Since the client key is newly generated with private part, this ServerAPI object should not use SSH agent to sign its request. However there is no way to tell ServerAPI not to enable SSH agent signing during initialization. It always accepts the configured value.

https://github.com/chef/chef/blob/566c08e697b1aef312def2150a59c8c651edb982/lib/chef/server_api.rb#L32-L41

Start in lib/chef/knife/bootstrap/client_builder.rb around the newly generated client key, then read lib/chef/server_api.rb to understand how ssh_agent_signing is initialized. Reproduce the validatorless knife bootstrap with ssh_agent_signing enabled and verify that the newly created client request no longer tries to use the SSH agent.