{"record":{"id":"e4247e6bd6ec6928","repo":"kubernetes/kops","slug":"tpm2-opentpm-q-w","errorCode":null,"errorMessage":"tpm2.OpenTPM(%q): %w","messagePattern":"tpm2\\.OpenTPM\\(%q\\): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpm_other.go","lineNumber":33,"sourceCode":"See the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\npackage gcetpmsigner\n\nimport (\n\t\"fmt\"\n\t\"io\"\n\n\t\"github.com/google/go-tpm/legacy/tpm2\"\n)\n\nvar tpmPath = \"/dev/tpm0\"\n\nfunc openTPM() (io.ReadWriteCloser, error) {\n\trw, err := tpm2.OpenTPM(tpmPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"tpm2.OpenTPM(%q): %w\", tpmPath, err)\n\t}\n\treturn rw, nil\n}\n","sourceCodeStart":15,"sourceCodeEnd":37,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpm_other.go#L15-L37","documentation":"Wraps tpm2.OpenTPM failure in the non-linux-cgo openTPM implementation, which opens the TPM device at the fixed path /dev/tpm0. Fires when the device node does not exist, is not a TPM, or permission is denied — most commonly on hosts without a TPM or without the GCE Shielded VM vTPM enabled.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpm_other.go:33 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable the vTPM (Shielded VM) on the GCE instance","Verify /dev/tpm0 exists and is accessible to the process","Check the wrapped error for permission vs not-found"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}