What causes "failed to sign data with TPM: %w" in kubernetes/kops?

Retry the operation; many TPM failures are transient

failed to sign data with TPM: %w

Error message

failed to sign data with TPM: %w

What it means

tpmSign wraps client.Key.SignData, which asks the TPM 2.0 device to sign the token payload using the GCE RSA attestation key. Failure here means the TPM returned an error during the signing operation — the low-level go-attestation/tpm2 call failed even though the key handle was obtained.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:122

	}
	token := &gcetpm.AuthToken{
		Data:      payload,
		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return gcetpm.GCETPMAuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

// tpmSign performs a TPM signature with the tpmKey, and sanity checks the result.
func tpmSign(tpmKey *client.Key, payload []byte) ([]byte, error) {
	beforeSign := time.Now()
	signature, err := tpmKey.SignData(payload)
	if err != nil {
		return nil, fmt.Errorf("failed to sign data with TPM: %w", err)
	}

	klog.Infof("TPM signing took %v", time.Since(beforeSign))

	return signature, nil
}

func debugToPEM(key crypto.PublicKey) string {
	var b bytes.Buffer
	pkData, err := x509.MarshalPKIXPublicKey(key)
	if err != nil {
		return fmt.Sprintf("{MarshalPKIXPublicKey failed: %v}", err)
	}
	if err := pem.Encode(&b, &pem.Block{Type: "PUBLIC KEY", Bytes: pkData}); err != nil {
		return fmt.Sprintf("{pem.Encode failed: %v}", err)
	}
	return b.String()
}

View on GitHub (pinned to 4c8573c808)

Solutions

Retry the operation; many TPM failures are transient
Check kernel logs (dmesg | grep -i tpm) for driver/hardware errors
Close leaked key/session handles to free TPM resources
Verify TPM is healthy (TPM self-test via go-attestation or tpm2 tools)
Recreate the GCE instance if the vTPM is persistently failing

Example fix

null

Defensive patterns

Strategy: retry

Validate before calling

// verify TPM is operational before signing workload
if err := runTPMSelfTest(); err != nil {
    return fmt.Errorf("TPM unhealthy: %w", err)
}

Try / catch

sig, err := tpmSign(key, payload)
if err != nil {
    if isTransientTPMError(err) { // e.g. timeouts, busy
        return retryWithBackoff(func() ([]byte, error) { return tpmSign(key, payload) })
    }
    return nil, err
}

Prevention

Avoid concurrent TPM session exhaustion by limiting parallel signers
Monitor kernel TPM driver logs
Close key handles promptly (defer key.Close())
Replace nodes with repeated hardware TPM faults

When it happens

Trigger: tpmKey.SignData(payload) errors: bad TPM parameter, out of memory/sessions in the TPM, transient device I/O error, or wrong key algorithm/padding configuration.

Common situations: Simultaneous TPM use by multiple daemons exhausting session slots; kernel tpm driver timeouts under load; TPM hierarchy or policy authorization failure; hardware TPM faults on aging nodes.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/165bfce3d9f56db4. Report an issue: GitHub.