kubernetes/kops · error

failed to get shield instance identity: %w

Error message

failed to get shield instance identity: %w

What it means

getTPMSigningKey failed calling the Compute API GetShieldedInstanceIdentity for the instance — this error wraps the underlying Google API error, so it covers auth failures, 404s, and API errors. The signing key lives in the Shielded VM identity, which only exists for shielded instances.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmverifier/tpmverifier.go:213

	}

	challengeEndpoint := instance.NetworkInterfaces[0].NetworkIP + ":" + strconv.Itoa(wellknownports.NodeupChallenge)

	result := &bootstrap.VerifyResult{
		NodeName:          instance.Name,
		InstanceGroupName: instanceGroupName,
		CAPIMachine:       capiMachine,
		CertificateNames:  sans,
		ChallengeEndpoint: challengeEndpoint,
	}

	return result, nil
}

func (v *tpmVerifier) getTPMSigningKey(ctx context.Context, data *gcetpm.AuthTokenData) (*rsa.PublicKey, error) {
	response, err := v.computeClient.Instances.GetShieldedInstanceIdentity(data.GCPProjectID, data.Zone, data.Instance).Context(ctx).Do()
	if err != nil {
		return nil, fmt.Errorf("failed to get shield instance identity: %w", err)
	}

	if response.SigningKey == nil {
		return nil, fmt.Errorf("instance doesn't have a signing key in ShieldedVmIdentity")
	}

	block, _ := pem.Decode([]byte(response.SigningKey.EkPub))
	if block == nil {
		return nil, fmt.Errorf("failed parsing PEM block from EkPub %q", response.SigningKey.EkPub)
	}
	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed parsing EK public key: %w", err)
	}
	rsaPub, ok := pub.(*rsa.PublicKey)
	if !ok {
		return nil, fmt.Errorf("EK public key is %T, expected *rsa.PublickKey", pub)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Enable Shielded VM (vTPM + integrity monitoring) on the node instance/MIG template
2. Verify the token's project/zone/instance match a real instance and retry if the API error was transient
3. Check the verifier's GCP credentials/permissions for the Shielded Instance Identity API
4. Ensure the instance is in the same zone the token claims

Example fix

// before (node created without shielded options)
// gcloud compute instances create node --no-shielded-secure-boot ...
// after
gcloud compute instances create node --shielded-vtpm --shielded-integrity-monitoring ...

inst, _ := computeClient.Instances.Get(proj, zone, name).Context(ctx).Do()
if inst.ShieldedInstanceConfig == nil || !inst.ShieldedInstanceConfig.EnableVtpm {
    return errors.New("instance must have Shielded VM (vTPM) enabled to use TPM auth")
}

resp, err := computeClient.Instances.GetShieldedInstanceIdentity(proj, zone, name).Context(ctx).Do()
if err != nil {
    if gerr, ok := err.(*googleapi.Error); ok && (gerr.Code == 429 || gerr.Code >= 500) {
        return retryWithBackoff() // transient
    }
    return fmt.Errorf("failed to get shield instance identity: %w", err)
}

When it happens

Trigger: Instances.GetShieldedInstanceIdentity(project, zone, instance) returns an error: instance not found, shielded instance config disabled (API returns no identity), quota/permission issues, or network failure to the compute API.

Common situations: Node VM created without Shielded VM (vTPM/integrity monitoring) enabled; wrong zone/project in the token data; compute API service account lacking compute.instances.getShieldedInstanceIdentity permission; transient API outages.

Related errors

• instance doesn't have a signing key in ShieldedVmIdentity
• error fetching GCE instance: %w
• error fetching GCE instance group template %q: %v
• error fetching GCE managed instance group %q: %v
• error getting ForwardingRule %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d3a55c54d8884c9b. Report an issue: GitHub.