{"record":{"id":"b39218acdcf42fb9","repo":"kubernetes/kops","slug":"ek-public-key-is-t-expected-rsa-publickkey","errorCode":null,"errorMessage":"EK public key is %T, expected *rsa.PublickKey","messagePattern":"EK public key is %T, expected \\*rsa\\.PublickKey","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":230,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n\t}\n\n\tif response.SigningKey == nil {\n\t\treturn nil, fmt.Errorf(\"instance doesn't have a signing key in ShieldedVmIdentity\")\n\t}\n\n\tblock, _ := pem.Decode([]byte(response.SigningKey.EkPub))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing PEM block from EkPub %q\", response.SigningKey.EkPub)\n\t}\n\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing EK public key: %w\", err)\n\t}\n\trsaPub, ok := pub.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublickKey\", pub)\n\t}\n\treturn rsaPub, nil\n}\n\n// GetInstanceCertificateAlternateNames returns the instance hostname and addresses that should go into certificates.\n// The first value is the node name and any additional values are IP addresses.\nfunc GetInstanceCertificateAlternateNames(instance *compute.Instance) ([]string, error) {\n\tvar sans []string\n\n\tfor _, iface := range instance.NetworkInterfaces {\n\t\tif iface.NetworkIP != \"\" {\n\t\t\tsans = append(sans, iface.NetworkIP)\n\t\t}\n\t\tif iface.Ipv6Address != \"\" {\n\t\t\tsans = append(sans, iface.Ipv6Address)\n\t\t}\n\t\t// We only use data for the first interface, and only the first IP\n\t\tif len(sans) > 0 {","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L212-L248","documentation":"The EkPub parsed successfully but is not an RSA public key (e.g. ECDSA), while verifySignature expects *rsa.PublicKey. The verifier rejects keys of any other type. Note the message contains a typo: \"PublickKey\".","triggerScenarios":"type assertion pub.(*rsa.PublicKey) fails because the Shielded VM identity's EK key is of a non-RSA type.","commonSituations":"GCE changing or configuring EK key algorithms; instance generating an EC-based EK; future API/SDK behavior changes.","solutions":["Confirm the instance's vTPM EK algorithm is RSA (2048) and recreate it if not","Check GCE/SDK updates that might alter the key type and update the verifier to support additional key types","Upgrade kops so the verifier matches current GCE behavior"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"pub, err := x509.ParsePKIXPublicKey(block.Bytes)\nif err != nil { return err }\nif _, ok := pub.(*rsa.PublicKey); !ok {\n    return fmt.Errorf(\"instance EK key is %T; verifier requires RSA\", pub)\n}","typeGuard":"func isRSAPublicKey(pub crypto.PublicKey) (*rsa.PublicKey, bool) {\n    rsaPub, ok := pub.(*rsa.PublicKey)\n    return rsaPub, ok\n}","tryCatchPattern":"rsaPub, ok := pub.(*rsa.PublicKey)\nif !ok {\n    return nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublicKey\", pub)\n}","preventionTips":["Provision nodes with RSA (2048) vTPM EK","Extend the verifier to support additional key types if GCE offers them","Keep kops upgraded to track GCE identity changes"],"tags":["gce","tpm","rsa","key-type"],"backgroundTag":"public-key-type-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}