{"record":{"id":"b659630a1f85df07","repo":"kubernetes/kops","slug":"failed-parsing-pem-block-from-ekpub-q","errorCode":null,"errorMessage":"failed parsing PEM block from EkPub %q","messagePattern":"failed parsing PEM block from EkPub %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":222,"sourceCode":"\t\tChallengeEndpoint: challengeEndpoint,\n\t}\n\n\treturn result, nil\n}\n\nfunc (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {\n\tresponse, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n\t}\n\n\tif response.SigningKey == nil {\n\t\treturn nil, fmt.Errorf(\"instance doesn't have a signing key in ShieldedVmIdentity\")\n\t}\n\n\tblock, _ := pem.Decode([]byte(response.SigningKey.EkPub))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing PEM block from EkPub %q\", response.SigningKey.EkPub)\n\t}\n\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing EK public key: %w\", err)\n\t}\n\trsaPub, ok := pub.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublickKey\", pub)\n\t}\n\treturn rsaPub, nil\n}\n\n// GetInstanceCertificateAlternateNames returns the instance hostname and addresses that should go into certificates.\n// The first value is the node name and any additional values are IP addresses.\nfunc GetInstanceCertificateAlternateNames(instance *compute.Instance) ([]string, error) {\n\tvar sans []string\n\n\tfor _, iface := range instance.NetworkInterfaces {","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L204-L240","documentation":"The EkPub value from the Shielded VM identity could not be decoded as a PEM block, so the EK public key cannot be extracted. This indicates the key material returned by GCE is empty or in an unexpected encoding.","triggerScenarios":"pem.Decode([]byte(response.SigningKey.EkPub)) returns a nil block — EkPub is empty string or non-PEM data from the identity response.","commonSituations":"Partial/empty Shielded VM identity for a misconfigured instance; GCE API returning truncated data; proxy or middleware mangling the response; unexpected key format after API version changes.","solutions":["Re-query the Shielded Instance Identity and check SigningKey.EkPub is populated","Confirm the instance is a properly shielded VM; recreate it if the identity is corrupt","Check for anything intercepting/mutating the compute API response","Retry in case of a transient API response issue"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"resp, _ := computeClient.Instances.GetShieldedInstanceIdentity(proj, zone, name).Do()\nif resp.SigningKey == nil || !strings.Contains(resp.SigningKey.EkPub, \"-----BEGIN\") {\n    return errors.New(\"EkPub missing or not PEM-encoded; recreate the instance\")\n}","typeGuard":null,"tryCatchPattern":"block, _ := pem.Decode([]byte(ekPub))\nif block == nil {\n    return fmt.Errorf(\"failed parsing PEM block from EkPub; raw=%q\", ekPub) // log raw value for diagnosis\n}","preventionTips":["Check EkPub content directly with gcloud if parsing fails","Keep the google compute SDK current to match GCE response formats","Recreate instances whose identity fields are empty or malformed","Avoid proxies that could truncate the API response"],"tags":["gce","pem","tpm","key-parsing"],"backgroundTag":"pem-decode-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}