kubernetes/kops · error

tpm2.OpenTPM(%q): %w

Error message

tpm2.OpenTPM(%q): %w

What it means

Wraps tpm2.OpenTPM failure in the non-linux-cgo openTPM implementation, which opens the TPM device at the fixed path /dev/tpm0. Fires when the device node does not exist, is not a TPM, or permission is denied — most commonly on hosts without a TPM or without the GCE Shielded VM vTPM enabled.

Source

Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpm_other.go:33

See the License for the specific language governing permissions and
limitations under the License.
*/

package gcetpmsigner

import (
	"fmt"
	"io"

	"github.com/google/go-tpm/legacy/tpm2"
)

var tpmPath = "/dev/tpm0"

func openTPM() (io.ReadWriteCloser, error) {
	rw, err := tpm2.OpenTPM(tpmPath)
	if err != nil {
		return nil, fmt.Errorf("tpm2.OpenTPM(%q): %w", tpmPath, err)
	}
	return rw, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Enable the vTPM (Shielded VM) on the GCE instance
2. Verify /dev/tpm0 exists and is accessible to the process
3. Check the wrapped error for permission vs not-found

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/tpm/gcetpmsigner/tpm_other.go:33 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e4247e6bd6ec6928. Report an issue: GitHub.