{"record":{"id":"b4a1af899b4861b4","repo":"kubernetes/kops","slug":"failed-to-open-tpm-w","errorCode":null,"errorMessage":"failed to open TPM: %w","messagePattern":"failed to open TPM: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go","lineNumber":73,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting instance from metadata: %w\", err)\n\t}\n\n\treturn &tpmAuthenticator{\n\t\tprojectID: projectID,\n\t\tzone:      zone,\n\t\tinstance:  instance,\n\t}, nil\n}\n\nfunc (a *tpmAuthenticator) CreateToken(body []byte) (string, error) {\n\trequestHash := sha256.Sum256(body)\n\n\ttpmStart := time.Now()\n\n\ttpmDevice, err := openTPM()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to open TPM: %w\", err)\n\t}\n\tdefer tpmDevice.Close()\n\n\tkey, err := client.GceAttestationKeyRSA(tpmDevice)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get GCE RSA attestation key from TPM: %w\", err)\n\t}\n\tdefer key.Close()\n\n\tklog.V(2).Infof(\"attestation key is %v\", debugToPEM(key.PublicKey()))\n\n\tklog.Infof(\"TPM initialization took %v\", time.Since(tpmStart))\n\n\tdata := gcetpm.AuthTokenData{\n\t\tGCPProjectID: a.projectID,\n\t\tZone:         a.zone,\n\t\tInstance:     a.instance,\n\t\tTimestamp:    time.Now().Unix(),","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go#L55-L91","documentation":"Wraps openTPM failure inside CreateToken: the TPM device (typically /dev/tpm0) could not be opened, so the node cannot produce an attestation-based bootstrap token. Usually means no vTPM on the instance or device permission problems.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:73 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable Shielded VM / vTPM on the instance","Check /dev/tpm0 permissions for the running user","Verify the process runs on the target GCE node"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}