semaphoreui/semaphore · error

access key type not supported for ansible become user

Error message

access key type not supported for ansible become user

What it means

Returned by KeyInstaller.Install in pkg/jwt/... more precisely pkg/ssh/agent.go when an access key used for the Ansible become-user role has a type other than db.AccessKeyLoginPassword. A simple inequality guard rejects the combination: the become (sudo/su) flow needs a plaintext login and password, so an SSH key or other credential type cannot fulfil this role.

Solutions

  1. Use a login/password access key for the become-user slot in the environment configuration
  2. Store the privilege-escalation account as a LoginPassword access key and select it for the become role
  3. Surface this error to the user in the environment editor so the wrong key type is fixed before a run is scheduled
Defensive patterns

Strategy: type-guard

When it happens

Trigger: Thrown at pkg/ssh/agent.go:214 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/c5772b7217207fc2. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ssh/agent.go:214

	switch usage {
	case db.AccessKeyRoleGit:
		switch key.Type {
		case db.AccessKeySSH:
			var agent Agent
			agent, err = StartSSHAgent(key, logger)
			installation.SSHAgent = &agent
			installation.Login = key.SshKey.Login
		}
	case db.AccessKeyRoleAnsiblePasswordVault:
		switch key.Type {
		case db.AccessKeyLoginPassword:
			installation.Password = key.LoginPassword.Password
		default:
			err = fmt.Errorf("access key type not supported for ansible password vault")
		}
	case db.AccessKeyRoleAnsibleBecomeUser:
		if key.Type != db.AccessKeyLoginPassword {
			err = fmt.Errorf("access key type not supported for ansible become user")
		}
		installation.Login = key.LoginPassword.Login
		installation.Password = key.LoginPassword.Password
	case db.AccessKeyRoleAnsibleUser:
		switch key.Type {
		case db.AccessKeySSH:
			var agent Agent
			agent, err = StartSSHAgent(key, logger)
			installation.SSHAgent = &agent
			installation.Login = key.SshKey.Login
		case db.AccessKeyLoginPassword:
			installation.Login = key.LoginPassword.Login
			installation.Password = key.LoginPassword.Password
		case db.AccessKeyNone:
			// No SSH agent or password needed for ansible user with no access key.
		default:
			err = fmt.Errorf("access key type not supported for ansible user")
		}

View on GitHub (pinned to 1774ccb71a)