{"record":{"id":"e8334ff3098289b5","repo":"kubernetes/kops","slug":"failed-to-get-gce-rsa-attestation-key-from-tpm-w","errorCode":null,"errorMessage":"failed to get GCE RSA attestation key from TPM: %w","messagePattern":"failed to get GCE RSA attestation key from TPM: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go","lineNumber":79,"sourceCode":"\t\tzone:      zone,\n\t\tinstance:  instance,\n\t}, nil\n}\n\nfunc (a *tpmAuthenticator) CreateToken(body []byte) (string, error) {\n\trequestHash := sha256.Sum256(body)\n\n\ttpmStart := time.Now()\n\n\ttpmDevice, err := openTPM()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to open TPM: %w\", err)\n\t}\n\tdefer tpmDevice.Close()\n\n\tkey, err := client.GceAttestationKeyRSA(tpmDevice)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get GCE RSA attestation key from TPM: %w\", err)\n\t}\n\tdefer key.Close()\n\n\tklog.V(2).Infof(\"attestation key is %v\", debugToPEM(key.PublicKey()))\n\n\tklog.Infof(\"TPM initialization took %v\", time.Since(tpmStart))\n\n\tdata := gcetpm.AuthTokenData{\n\t\tGCPProjectID: a.projectID,\n\t\tZone:         a.zone,\n\t\tInstance:     a.instance,\n\t\tTimestamp:    time.Now().Unix(),\n\t\tAudience:     gcetpm.AudienceNodeAuthentication,\n\t\tRequestHash:  requestHash[:],\n\t}\n\n\tpayload, err := json.Marshal(&data)\n\tif err != nil {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go#L61-L97","documentation":"CreateToken opens the node's local TPM 2.0 device and fetches the GCE RSA attestation key (EK/AIK-backed) via go-attestation's client.GceAttestationKeyRSA. If the TPM cannot provide that key (device open succeeded but key creation/loading failed), the error is wrapped with this message and CreateToken returns no token. It means node authentication via TPM attestation cannot proceed.","triggerScenarios":"client.GceAttestationKeyRSA(tpmDevice) returns an error: TPM lacks the GCE attestation key hierarchy, the key cannot be created/loaded, or the underlying tpm2/attestation call fails (I/O error on /dev/tpmrm0, unsupported TPM, permission denied on the device).","commonSituations":"Running on a GCE VM without a vTPM enabled (shielded VM / 'enableIntegrityMonitoring' off); /dev/tpmrm0 not accessible to the process (container without --device or device cgroup rules); non-GCE environment or emulated testing where the GCE-specific attestation key is absent; go-attestation version incompatibility with the guest environment.","solutions":["Enable Shielded VM with vTPM on the instance (or recreate the instance with shielded-secure-boot/vTPM options on)","Ensure the process can access /dev/tpmrm0 (run privileged, add device mapping in container, check udev/permissions)","Verify the machine actually has a TPM 2.0 device: ls /dev/tpm*","Pin/upgrade github.com/google/go-attestation to a version compatible with your OS/GCE guest environment","Test key availability with go-attestation tools (e.g. tpm-tools or attest client) to isolate the failing layer"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"// before creating tokens\nif _, err := os.Stat(\"/dev/tpmrm0\"); err != nil {\n    return fmt.Errorf(\"TPM device unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"token, err := authenticator.CreateToken(ctx, request)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get GCE RSA attestation key\") {\n        // fall back to non-TPM auth or surface actionable setup error\n    }\n    return err\n}","preventionTips":["Provision GCE nodes with Shielded VM / vTPM enabled","Mount /dev/tpmrm0 into containers with correct permissions","Pin go-attestation versions in go.mod and test on your node image","Health-check TPM availability at node startup before needing tokens"],"tags":["gcp","tpm","gce","node-authentication"],"backgroundTag":"tpm-attestation-key-unavailable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}