I upgraded my RE450 to 21.02 and looks like making it work with Radius auth will not work using the official image. In 19.07 and older it was no problem to remove wpad-mini and install hostapd as /overlay had enough space.
When I run opkg info wpad-basic-wolfssl it shows 802.1x but I assume that is client side when setting up a repeater - as I don't need the supplicant, I only I need the hostapd.
I hope someone will be able to update link to explain that for at least some devices with 8MB storage, custom build might be required.
I hope I am not correct, and there is a way to get it going, as I really want to avoid having to build a custom image, and update it each time a security issue comes up.
Quick follow up question - I am thinking of using the Kernel download image - I assume that would have at least the ssh support - my current config uses 4 tagged vlans, one used for admin purposes to manage the AP - would the Kernel image preserve those network settings ?
If yes this would be my preferred solution as I can use opkg to add anything else required. Otherwise I think I have no other option but to use the Image Builder.
On a general note, I assume it is possible to mount the .bin file in Linux using loopback and look at the contents ? Qick google search shows an older discussion link and some more tech details here and here - please share if you have any additional info - thanks.
After doing some reading on the Image Builder it turns out to be the simplest solution to my problem - after installing the required dependencies, download and extract: link for RE450 v2
The output can be found in bin/targets/ath79/generic/openwrt-21.02.0-ath79-generic-tplink_re450-v2-squashfs-sysupgrade.bin - I run sha256sum and scp the file to /tmp on the AP. After comparing the hashes, finished off with sysupgrade -v /tmp/openwrt...-sysupgrade.bin
One thing to keep in mind - as noted in the documentation make sure you have about 2X size of the bin file free RAM on the AP.
In my case the RE450 is a wired access point ( ie don't need wpad-... ) and a lot of the above packages are not required - the created image left about 1M of free space, and after installing hostapd-wolfssl I have about 500KB. I did not include hostapd-wolfssl in the image, to allow me upgrading it in case any problems are found without having to create a new image.
The only functionality I am missing is Network -> Wireless -> Scan - since wolfssl lib is installed there is enough space to install wpad-wolfssl using opkg. Since I do all my scanning from an Android App this has not been an issue.
Thanks to everybody that worked on the newest release - job well done.