semaphoreui/semaphore · error

access key does not suite for inventory's sudo user…

Error message

access key does not suite for inventory's sudo user credentials

What it means

The executor validates the inventory's become (sudo) key type in a parallel switch: it supports SSH keys, login/password keys, or no key. A become key with any other type cannot supply sudo credentials, so preparation fails with this message distinguishing it from the user-credentials variant.

Solutions

1. Set the inventory's become key to an access key of type SSH or login/password that includes sudo credentials
2. Detach the become key (set BecomeKeyID to null) if privilege escalation is not needed
3. Use key type 'none' if no become credentials are required
4. Upgrade Semaphore so the executor recognizes the key type attached as become key

Example fix

// before
Inventory.BecomeKeyID -> key with Type: "jwt" (unsupported for become)
// after
Inventory.BecomeKeyID -> key with Type: db.AccessKeySSH containing sudo credentials

if inv.BecomeKey != nil {
    switch inv.BecomeKey.Type {
    case db.AccessKeySSH, db.AccessKeyLoginPassword, db.AccessKeyNone:
        // ok
    default:
        return fmt.Errorf("become key %q type %q not usable for sudo credentials", inv.BecomeKey.Name, inv.BecomeKey.Type)
    }
}

func becomeKeyUsable(k *db.AccessKey) bool {
    return k == nil || k.Type == db.AccessKeySSH || k.Type == db.AccessKeyLoginPassword || k.Type == db.AccessKeyNone
}

When it happens

Trigger: Inventory.BecomeKeyID points to an access key whose db.AccessKey.Type is not ssh/privatekey, login_password, or none — e.g. a newer/unknown key type or a key intended only for login use that cannot be used with --become.

Common situations: Selecting an incompatible key in the inventory's 'become key' field; keys created by a newer Semaphore version used on an older build; API clients setting BecomeKeyID without type validation.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Related errors

• invalid inventory type
• access key does not suite for inventory's user credentials
• err
• name can not be empty
• missing secret

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/f81d1db186884871. Report an issue: GitHub.

Appendix: source

Thrown at services/tasks/local_executor.go:500

		default:
			err = fmt.Errorf("access key does not suite for inventory's user credentials")
			return
		}
	}

	if t.Inventory.BecomeKeyID != nil {
		switch t.Inventory.BecomeKey.Type {
		case db.AccessKeyLoginPassword:
			if t.becomeKeyInstallation.Login != "" {
				args = append(args, "--become-user", t.becomeKeyInstallation.Login)
			}
			if t.becomeKeyInstallation.Password != "" {
				args = append(args, "--ask-become-pass")
				inputMap[db.AccessKeyRoleAnsibleBecomeUser] = t.becomeKeyInstallation.Password
			}
		case db.AccessKeyNone:
		default:
			err = fmt.Errorf("access key does not suite for inventory's sudo user credentials")
			return
		}
	}

	var tplParams db.AnsibleTemplateParams

	err = t.Template.FillParams(&tplParams)
	if err != nil {
		return
	}

	var params db.AnsibleTaskParams

	err = t.Task.ExtractParams(&params)
	if err != nil {
		return
	}

View on GitHub (pinned to 1774ccb71a)