Description of problem:

in an environment that was working according to a known configuration before.

After a clean install of lastest version dated to Dec 11th 2020, the configuration that was working in an earlier version (4.8.4), is not working any more.

I keep getting the following error, even though everything have been working well in 4.8.4:
11-Dec-2020 16:21:03.843 client 192.168.6.254#20434: request has invalid signature: TSIG rndc-key: tsig verify failure (BADSIG)

The rndc-key is updated everywhere, i have verified it multiple times.

Version-Release number of selected component (if applicable):

IPA = 4.8.7
CentOS Linux release = 8.2.2004

How reproducible:
Tested on three servers, 100%

Steps to Reproduce:
1.Update the file /etc/named/ipa-options-ext.conf:

/ User customization for BIND named
*
* This file is included in /etc/named.conf and is not modified during IPA
* upgrades.
*
* It must only contain "options" settings. Any other setting must be
* configured in /etc/named/ipa-ext.conf.
*
* Examples:
* allow-recursion { trusted_network; };
* allow-query-cache { trusted_network; };
/

allow-recursion { trusted_network; };
allow-query-cache { trusted_network; };

1. Update the file /etc/named/ipa-ext.conf:

/ User customization for BIND named
*
* This file is included in /etc/named.conf and is not modified during IPA
* upgrades.
*
* "options" settings must be configured in /etc/named/ipa-options-ext.conf.
*
* Example: ACL for recursion access:
*
* acl "trusted_network" {
* localnets;
* localhost;
* 234.234.234.0/24;
* 2001::co:ffee:babe:1/48;
* };
/

acl "trusted_network" {
localnets;
localhost;
127.0.0.0/24;
::1/64;
192.168.2.0/24;
192.168.3.0/24;
192.168.3.0/24;
192.168.6.0/24;
};

1. Add /etc/rndc.key to the /etc/named.conf:

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/rndc.key";

1. Update the BIND update policy on the GUI for all reverse and forward zones with:
   grant "rndc-key" zonesub ANY;

2. Update the DHCP server with dynamic updates and the rndc.key from the IPA server as follows:
   /etc/rndc.key
   key "rndc-key" {
   algorithm hmac-sha256;
   secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";

Actual results:

5-Jan-2021 17:34:22.843 client 192.168.6.254#20827: request has invalid signature: TSIG rndc-key: tsig verify failure (BADSIG)

Expected results:

DHCP assigned DNS is being automatically registered on the IPA server after authenticated against the rndc secret and verified to register in its own zones.

Additional info:

Same setup had been tested and was working on 4.8.4, why is the include "/etc/rndc.key"; is broken in the new /etc/named.conf?