{"record":{"id":"f81d1db186884871","repo":"semaphoreui/semaphore","slug":"access-key-does-not-suite-for-inventory-s-sudo-use","errorCode":null,"errorMessage":"access key does not suite for inventory's sudo user credentials","messagePattern":"access key does not suite for inventory's sudo user credentials","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"services/tasks/local_executor.go","lineNumber":500,"sourceCode":"\t\tdefault:\n\t\t\terr = fmt.Errorf(\"access key does not suite for inventory's user credentials\")\n\t\t\treturn\n\t\t}\n\t}\n\n\tif t.Inventory.BecomeKeyID != nil {\n\t\tswitch t.Inventory.BecomeKey.Type {\n\t\tcase db.AccessKeyLoginPassword:\n\t\t\tif t.becomeKeyInstallation.Login != \"\" {\n\t\t\t\targs = append(args, \"--become-user\", t.becomeKeyInstallation.Login)\n\t\t\t}\n\t\t\tif t.becomeKeyInstallation.Password != \"\" {\n\t\t\t\targs = append(args, \"--ask-become-pass\")\n\t\t\t\tinputMap[db.AccessKeyRoleAnsibleBecomeUser] = t.becomeKeyInstallation.Password\n\t\t\t}\n\t\tcase db.AccessKeyNone:\n\t\tdefault:\n\t\t\terr = fmt.Errorf(\"access key does not suite for inventory's sudo user credentials\")\n\t\t\treturn\n\t\t}\n\t}\n\n\tvar tplParams db.AnsibleTemplateParams\n\n\terr = t.Template.FillParams(&tplParams)\n\tif err != nil {\n\t\treturn\n\t}\n\n\tvar params db.AnsibleTaskParams\n\n\terr = t.Task.ExtractParams(&params)\n\tif err != nil {\n\t\treturn\n\t}\n","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/services/tasks/local_executor.go#L482-L518","documentation":"The executor validates the inventory's become (sudo) key type in a parallel switch: it supports SSH keys, login/password keys, or no key. A become key with any other type cannot supply sudo credentials, so preparation fails with this message distinguishing it from the user-credentials variant.","triggerScenarios":"Inventory.BecomeKeyID points to an access key whose db.AccessKey.Type is not ssh/privatekey, login_password, or none — e.g. a newer/unknown key type or a key intended only for login use that cannot be used with --become.","commonSituations":"Selecting an incompatible key in the inventory's 'become key' field; keys created by a newer Semaphore version used on an older build; API clients setting BecomeKeyID without type validation.","solutions":["Set the inventory's become key to an access key of type SSH or login/password that includes sudo credentials","Detach the become key (set BecomeKeyID to null) if privilege escalation is not needed","Use key type 'none' if no become credentials are required","Upgrade Semaphore so the executor recognizes the key type attached as become key"],"exampleFix":"// before\nInventory.BecomeKeyID -> key with Type: \"jwt\" (unsupported for become)\n// after\nInventory.BecomeKeyID -> key with Type: db.AccessKeySSH containing sudo credentials","handlingStrategy":"validation","validationCode":"if inv.BecomeKey != nil {\n    switch inv.BecomeKey.Type {\n    case db.AccessKeySSH, db.AccessKeyLoginPassword, db.AccessKeyNone:\n        // ok\n    default:\n        return fmt.Errorf(\"become key %q type %q not usable for sudo credentials\", inv.BecomeKey.Name, inv.BecomeKey.Type)\n    }\n}","typeGuard":"func becomeKeyUsable(k *db.AccessKey) bool {\n    return k == nil || k.Type == db.AccessKeySSH || k.Type == db.AccessKeyLoginPassword || k.Type == db.AccessKeyNone\n}","tryCatchPattern":null,"preventionTips":["Attach only SSH or login/password keys as become keys","Clear BecomeKeyID when privilege escalation is unnecessary","Validate become key type on inventory create/update","Keep all components on matching Semaphore versions"],"tags":["go","ansible","sudo"],"backgroundTag":"incompatible-source-type","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}