{"record":{"id":"d3a55c54d8884c9b","repo":"kubernetes/kops","slug":"failed-to-get-shield-instance-identity-w","errorCode":null,"errorMessage":"failed to get shield instance identity: %w","messagePattern":"failed to get shield instance identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go","lineNumber":213,"sourceCode":"\t}\n\n\tchallengeEndpoint := instance.NetworkInterfaces[0].NetworkIP + \":\" + strconv.Itoa(wellknownports.NodeupChallenge)\n\n\tresult := &bootstrap.VerifyResult{\n\t\tNodeName:          instance.Name,\n\t\tInstanceGroupName: instanceGroupName,\n\t\tCAPIMachine:       capiMachine,\n\t\tCertificateNames:  sans,\n\t\tChallengeEndpoint: challengeEndpoint,\n\t}\n\n\treturn result, nil\n}\n\nfunc (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {\n\tresponse, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n\t}\n\n\tif response.SigningKey == nil {\n\t\treturn nil, fmt.Errorf(\"instance doesn't have a signing key in ShieldedVmIdentity\")\n\t}\n\n\tblock, _ := pem.Decode([]byte(response.SigningKey.EkPub))\n\tif block == nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing PEM block from EkPub %q\", response.SigningKey.EkPub)\n\t}\n\tpub, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed parsing EK public key: %w\", err)\n\t}\n\trsaPub, ok := pub.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"EK public key is %T, expected *rsa.PublickKey\", pub)\n\t}","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go#L195-L231","documentation":"getTPMSigningKey failed calling the Compute API GetShieldedInstanceIdentity for the instance — this error wraps the underlying Google API error, so it covers auth failures, 404s, and API errors. The signing key lives in the Shielded VM identity, which only exists for shielded instances.","triggerScenarios":"Instances.GetShieldedInstanceIdentity(project, zone, instance) returns an error: instance not found, shielded instance config disabled (API returns no identity), quota/permission issues, or network failure to the compute API.","commonSituations":"Node VM created without Shielded VM (vTPM/integrity monitoring) enabled; wrong zone/project in the token data; compute API service account lacking compute.instances.getShieldedInstanceIdentity permission; transient API outages.","solutions":["Enable Shielded VM (vTPM + integrity monitoring) on the node instance/MIG template","Verify the token's project/zone/instance match a real instance and retry if the API error was transient","Check the verifier's GCP credentials/permissions for the Shielded Instance Identity API","Ensure the instance is in the same zone the token claims"],"exampleFix":"// before (node created without shielded options)\n// gcloud compute instances create node --no-shielded-secure-boot ...\n// after\ngcloud compute instances create node --shielded-vtpm --shielded-integrity-monitoring ...","handlingStrategy":"retry","validationCode":"inst, _ := computeClient.Instances.Get(proj, zone, name).Context(ctx).Do()\nif inst.ShieldedInstanceConfig == nil || !inst.ShieldedInstanceConfig.EnableVtpm {\n    return errors.New(\"instance must have Shielded VM (vTPM) enabled to use TPM auth\")\n}","typeGuard":null,"tryCatchPattern":"resp, err := computeClient.Instances.GetShieldedInstanceIdentity(proj, zone, name).Context(ctx).Do()\nif err != nil {\n    if gerr, ok := err.(*googleapi.Error); ok && (gerr.Code == 429 || gerr.Code >= 500) {\n        return retryWithBackoff() // transient\n    }\n    return fmt.Errorf(\"failed to get shield instance identity: %w\", err)\n}","preventionTips":["Enable vTPM and integrity monitoring in every node instance template","Grant the verifier's service account compute.instances.getShieldedInstanceIdentity","Retry transient compute API errors with exponential backoff","Verify token project/zone/instance values before calling the API"],"tags":["gce","shielded-vm","tpm","api-error"],"backgroundTag":"shielded-identity-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}