Admin credentials not working anymore after 1.12 upgrade

[jonkerj]

I upgraded my homelab to 1.12-rc.1, and discovered the admin credentials in my client side talosconfig were rejected after the upgrade:

$ talosctl time --context <the one that broke after the upgrade>
error fetching time: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: remote error: tls: bad certificate"

I managed to fix it by creating a fresh crt/key-pair and updating the config. As I wondered if it was just luck (expiration just when I upgrade it), I took a look at .contexts.<cluster>.crt, it should be valid for some time:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:c5:8b:be:73:8d:56:76:5f:34:1a:ac:38:27:77:48
        Signature Algorithm: ED25519
        Issuer: O = talos
        Validity
            Not Before: Apr  7 11:33:26 2021 GMT
            Not After : Apr  5 11:33:26 2031 GMT
        Subject: O =
        Subject Public Key Info:
            Public Key Algorithm: ED25519
                ED25519 Public-Key:
                pub:
                    c0:ae:f1:33:e7:cc:70:53:53:e2:d4:ca:61:b8:1c:
                    40:a5:e4:8f:5a:d0:42:20:7f:3e:e6:24:57:a1:e4:
                    fb:dd
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                48:3B:DA:56:AC:ED:50:85:1A:12:0A:6B:64:46:BB:8F:20:5D:F3:42
            X509v3 Subject Alternative Name:
                IP Address:127.0.0.1
    Signature Algorithm: ED25519
    Signature Value:
        32:d7:02:6e:c7:96:7e:9b:e4:e9:0f:0a:aa:4c:02:78:3b:93:
        a3:97:21:c1:66:97:60:ad:0a:08:4d:49:9b:25:87:9a:bb:7d:
        35:7a:98:ca:33:ce:94:24:a8:8e:2b:2d:6a:7a:ba:9c:41:0c:
        4a:4c:ac:fb:13:a3:8c:b0:40:04

I suspect newer Talos reject older algo's, etc, but I could not find anything about it in the release notes so far. Did I miss something?

[smira]

How did you get this talosconfig? It is missing the role, but Talos shouldn't create one without a role (?).

[jonkerj]

I believe it was created (in 2021) as a part of talosctl gen config, which resulted in the machine config files and talosconfig

[smira]

Ah, okay... this might be a mix of several bugs, when the talosconfig lifetime was set to be 10 years, and before the role (RBAC) support was introduced.

Talos now enforces RBAC (that was the change in v1.12) for better security and reducing configuration complexity.

[jonkerj]

yeah, this was probably before RBAC was even a thing