kubernetes/kops · error

failed to sign token data: %w

Error message

failed to sign token data: %w

What it means

CreateToken signs the marshalled token payload with the TPM key via tpmSign. If tpmKey.SignData fails, the error is wrapped as 'failed to sign token data'. This means the TPM refused or failed the signing operation even though the key was successfully loaded.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpmauthenticator.go:103

	klog.Infof("TPM initialization took %v", time.Since(tpmStart))

	data := gcetpm.AuthTokenData{
		GCPProjectID: a.projectID,
		Zone:         a.zone,
		Instance:     a.instance,
		Timestamp:    time.Now().Unix(),
		Audience:     gcetpm.AudienceNodeAuthentication,
		RequestHash:  requestHash[:],
	}

	payload, err := json.Marshal(&data)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token data: %w", err)
	}

	signature, err := tpmSign(key, payload)
	if err != nil {
		return "", fmt.Errorf("failed to sign token data: %w", err)
	}
	token := &gcetpm.AuthToken{
		Data:      payload,
		Signature: signature,
	}

	b, err := json.Marshal(token)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token: %w", err)
	}
	return gcetpm.GCETPMAuthenticationTokenPrefix + base64.StdEncoding.EncodeToString(b), nil
}

// tpmSign performs a TPM signature with the tpmKey, and sanity checks the result.
func tpmSign(tpmKey *client.Key, payload []byte) ([]byte, error) {
	beforeSign := time.Now()
	signature, err := tpmKey.SignData(payload)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the token creation — TPM transient failures are often temporary
2. Check for TPM lockout state and reset if locked (tpm2_getcap / vendor tools)
3. Reduce concurrent TPM access on the node (single signer path)
4. Check dmesg/journal for tpm_crb or tpm_tis I/O errors indicating hardware/driver problems
5. Replace the instance if the TPM hardware is persistently failing

Example fix

null

// pre-check TPM responsiveness
opened, err := tpm2.OpenTPM("/dev/tpmrm0")
if err != nil { return fmt.Errorf("TPM not responding: %w", err) }
opened.Close()

token, err := authenticator.CreateToken(ctx, request)
if err != nil && strings.Contains(err.Error(), "failed to sign token data") {
    // retry with backoff; TPM transient failures are common
    time.Sleep(backoff)
    return authenticator.CreateToken(ctx, request)
}

When it happens

Trigger: tpmSign(key, payload) -> client.Key.SignData(payload) returns an error: transient TPM communication failure, session/handle exhaustion, or a key usage/policy restriction.

Common situations: TPM busy or wedged under concurrent access by multiple node components; TPM lockout after failed auth attempts; payload/padding scheme mismatch; device I/O timeouts.

Related errors

• failed to sign data with TPM: %w
• failed to get GCE RSA attestation key from TPM: %w
• incorrect Timestamp %v
• incorrect RequestHash
• gcpProjectID is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5a92d22681fdc16c. Report an issue: GitHub.