kubernetes/kops · error

failed parsing PEM block from EkPub %q

Error message

failed parsing PEM block from EkPub %q

What it means

The EkPub value from the Shielded VM identity could not be decoded as a PEM block, so the EK public key cannot be extracted. This indicates the key material returned by GCE is empty or in an unexpected encoding.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:222

		ChallengeEndpoint: challengeEndpoint,
	}

	return result, nil
}

func (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {
	response, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()
	if err != nil {
		return nil, fmt.Errorf("failed to get shield instance identity: %w", err)
	}

	if response.SigningKey == nil {
		return nil, fmt.Errorf("instance doesn't have a signing key in ShieldedVmIdentity")
	}

	block, _ := pem.Decode([]byte(response.SigningKey.EkPub))
	if block == nil {
		return nil, fmt.Errorf("failed parsing PEM block from EkPub %q", response.SigningKey.EkPub)
	}
	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed parsing EK public key: %w", err)
	}
	rsaPub, ok := pub.(*rsa.PublicKey)
	if !ok {
		return nil, fmt.Errorf("EK public key is %T, expected *rsa.PublickKey", pub)
	}
	return rsaPub, nil
}

// GetInstanceCertificateAlternateNames returns the instance hostname and addresses that should go into certificates.
// The first value is the node name and any additional values are IP addresses.
func GetInstanceCertificateAlternateNames(instance *compute.Instance) ([]string, error) {
	var sans []string

	for _, iface := range instance.NetworkInterfaces {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-query the Shielded Instance Identity and check SigningKey.EkPub is populated
2. Confirm the instance is a properly shielded VM; recreate it if the identity is corrupt
3. Check for anything intercepting/mutating the compute API response
4. Retry in case of a transient API response issue

resp, _ := computeClient.Instances.GetShieldedInstanceIdentity(proj, zone, name).Do()
if resp.SigningKey == nil || !strings.Contains(resp.SigningKey.EkPub, "-----BEGIN") {
    return errors.New("EkPub missing or not PEM-encoded; recreate the instance")
}

block, _ := pem.Decode([]byte(ekPub))
if block == nil {
    return fmt.Errorf("failed parsing PEM block from EkPub; raw=%q", ekPub) // log raw value for diagnosis
}

When it happens

Trigger: pem.Decode([]byte(response.SigningKey.EkPub)) returns a nil block — EkPub is empty string or non-PEM data from the identity response.

Common situations: Partial/empty Shielded VM identity for a misconfigured instance; GCE API returning truncated data; proxy or middleware mangling the response; unexpected key format after API version changes.

Related errors

• failed parsing EK public key: %w
• could not parse private key
• failed to get GCE RSA attestation key from TPM: %w
• failed to marshal token data: %w
• failed to marshal token: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b659630a1f85df07. Report an issue: GitHub.