{"record":{"id":"15a65e343fa2e05a","repo":"kubernetes/kops","slug":"failed-parsing-ek-public-key-w","errorCode":null,"errorMessage":"failed parsing EK public key: %w","messagePattern":"failed parsing EK public key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":226,"sourceCode":"}\n\nfunc (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {\n\tresponse, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n\t}\n\n\tif response.SigningKey == nil {\n\t\treturn nil, fmt.Errorf(\"instance doesn't have a signing key in ShieldedVmIdentity\")\n\t}\n\n\tblock, _ := pem.Decode([]byte(response.SigningKey.EkPub))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing PEM block from EkPub %q\", response.SigningKey.EkPub)\n\t}\n\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing EK public key: %w\", err)\n\t}\n\trsaPub, ok := pub.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublickKey\", pub)\n\t}\n\treturn rsaPub, nil\n}\n\n// GetInstanceCertificateAlternateNames returns the instance hostname and addresses that should go into certificates.\n// The first value is the node name and any additional values are IP addresses.\nfunc GetInstanceCertificateAlternateNames(instance *compute.Instance) ([]string, error) {\n\tvar sans []string\n\n\tfor _, iface := range instance.NetworkInterfaces {\n\t\tif iface.NetworkIP != \"\" {\n\t\t\tsans = append(sans, iface.NetworkIP)\n\t\t}\n\t\tif iface.Ipv6Address != \"\" {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L208-L244","documentation":"Wraps rsa/x509 parsing failure of the endorsement (EK) public key in the GCE TPM verifier: the PEM-decoded signing key block could not be parsed into an RSA public key. Indicates the Shielded Instance Identity API returned an unexpected EkPub format.","triggerScenarios":"x509.ParsePKIXPublicKey(block.Bytes) returns an error after successful PEM decode — DER bytes inside the PEM don't form a valid SubjectPublicKeyInfo.","commonSituations":"Unexpected key encoding returned by the GCE identity API; corrupted/truncated response; custom signing key material injected by unusual instance configuration.","solutions":["Verify the instance's Shielded VM identity is healthy in GCP","Retry the verification in case of a malformed transient response","Report if the EkPub format is consistently unparseable (possible API change)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"pub, err := x509.ParsePKIXPublicKey(block.Bytes)\nif err != nil {\n    return fmt.Errorf(\"EkPub is not a valid SPKI public key: %w\", err) // surface before verification\n}","typeGuard":null,"tryCatchPattern":"if _, err := x509.ParsePKIXPublicKey(block.Bytes); err != nil {\n    log.Warn(\"bad EK key from GCE identity; refetching\")\n    resp, rerr := refetchIdentity(ctx)\n    if rerr != nil { return rerr }\n    // retry parse once, then fail\n}","preventionTips":["Refetch the identity before failing permanently — responses can be transiently corrupt","Keep the GCE API/SDK versions consistent between environments","Recreate nodes that persistently return unparseable key material"],"tags":["gce","x509","tpm","key-parsing"],"backgroundTag":"public-key-parse-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}