{"record":{"id":"83aea3dc12b1204b","repo":"kubernetes/kops","slug":"instance-doesn-t-have-a-signing-key-in-shieldedvmi","errorCode":null,"errorMessage":"instance doesn't have a signing key in ShieldedVmIdentity","messagePattern":"instance doesn't have a signing key in ShieldedVmIdentity","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":217,"sourceCode":"\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          instance.Name,\n\t\tInstanceGroupName: instanceGroupName,\n\t\tCAPIMachine:       capiMachine,\n\t\tCertificateNames:  sans,\n\t\tChallengeEndpoint: challengeEndpoint,\n\t}\n\n\treturn result, nil\n}\n\nfunc (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {\n\tresponse, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n\t}\n\n\tif response.SigningKey == nil {\n\t\treturn nil, fmt.Errorf(\"instance doesn't have a signing key in ShieldedVmIdentity\")\n\t}\n\n\tblock, _ := pem.Decode([]byte(response.SigningKey.EkPub))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing PEM block from EkPub %q\", response.SigningKey.EkPub)\n\t}\n\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing EK public key: %w\", err)\n\t}\n\trsaPub, ok := pub.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublickKey\", pub)\n\t}\n\treturn rsaPub, nil\n}\n\n// GetInstanceCertificateAlternateNames returns the instance hostname and addresses that should go into certificates.","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L199-L235","documentation":"The Shielded VM identity response contained no SigningKey. GCE returns the identity structure but without a signing key when the instance is not genuinely shielded or the identity is incomplete, so the verifier cannot obtain the TPM public key to check the token signature.","triggerScenarios":"GetShieldedInstanceIdentity succeeds but response.SigningKey == nil — e.g. instance created with shielded VM options disabled, or GCE hasn't populated the identity yet for a brand-new VM.","commonSituations":"Node template missing vTPM/shielded settings; very recently created instance queried before identity publication; custom images without shielded VM support.","solutions":["Enable Shielded VM (vTPM) on the instance or its instance template/MIG","Wait briefly and retry if the instance was just created","Recreate the node from a shielded-VM-enabled image/template","Verify with gcloud compute instances describe --format='*(shieldedInstanceConfig)' that shielded options are on"],"exampleFix":"// before\nshieldedInstanceConfig:\n  enableVtpm: false\n// after\nshieldedInstanceConfig:\n  enableVtpm: true\n  enableIntegrityMonitoring: true","handlingStrategy":"validation","validationCode":"resp, err := computeClient.Instances.GetShieldedInstanceIdentity(proj, zone, name).Context(ctx).Do()\nif err != nil { return err }\nif resp.SigningKey == nil || resp.SigningKey.EkPub == \"\" {\n    return errors.New(\"instance has no Shielded VM signing key; enable vTPM or wait for identity publication\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure shieldedInstanceConfig.enableVtpm: true in instance templates","Allow a short delay after VM creation before requesting its identity","Use kops defaults which enable shielded VM on GCE","Recreate nodes whose identity comes back empty"],"tags":["gce","shielded-vm","tpm","signing-key"],"backgroundTag":"shielded-identity-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}