kubernetes/kops · error

failed to open TPM: %w

Error message

failed to open TPM: %w

What it means

Wraps openTPM failure inside CreateToken: the TPM device (typically /dev/tpm0) could not be opened, so the node cannot produce an attestation-based bootstrap token. Usually means no vTPM on the instance or device permission problems.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:73

	if err != nil {
		return nil, fmt.Errorf("error getting instance from metadata: %w", err)
	}

	return &tpmAuthenticator{
		projectID: projectID,
		zone:      zone,
		instance:  instance,
	}, nil
}

func (a *tpmAuthenticator) CreateToken(body []byte) (string, error) {
	requestHash := sha256.Sum256(body)

	tpmStart := time.Now()

	tpmDevice, err := openTPM()
	if err != nil {
		return "", fmt.Errorf("failed to open TPM: %w", err)
	}
	defer tpmDevice.Close()

	key, err := client.GceAttestationKeyRSA(tpmDevice)
	if err != nil {
		return "", fmt.Errorf("failed to get GCE RSA attestation key from TPM: %w", err)
	}
	defer key.Close()

	klog.V(2).Infof("attestation key is %v", debugToPEM(key.PublicKey()))

	klog.Infof("TPM initialization took %v", time.Since(tpmStart))

	data := gcetpm.AuthTokenData{
		GCPProjectID: a.projectID,
		Zone:         a.zone,
		Instance:     a.instance,
		Timestamp:    time.Now().Unix(),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Enable Shielded VM / vTPM on the instance
2. Check /dev/tpm0 permissions for the running user
3. Verify the process runs on the target GCE node

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:73 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b4a1af899b4861b4. Report an issue: GitHub.