semaphoreui/semaphore · error

access key type not supported for ansible password vault

Error message

access key type not supported for ansible password vault

What it means

Returned by KeyInstaller.Install in pkg/ssh/agent.go when an access key is used in the Ansible password vault role but its type is not db.AccessKeyLoginPassword. The switch over key.Type falls to the default branch, meaning an SSH key or other non-login-password key type was attached where the vault requires a literal password credential.

Solutions

  1. Attach a login/password type access key to the environment's vault slot instead of an SSH key
  2. Create a dedicated LoginPassword access key holding the Ansible vault password and reference that key for the vault role
  3. Validate the access key type in the UI/API at attachment time so the mismatch is caught before task startup
Defensive patterns

Strategy: type-guard

When it happens

Trigger: Thrown at pkg/ssh/agent.go:210 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/c15b3365b544cb04. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ssh/agent.go:210

type KeyInstaller struct{}

func (KeyInstaller) Install(key db.AccessKey, usage db.AccessKeyRole, logger task_logger.Logger) (installation AccessKeyInstallation, err error) {

	switch usage {
	case db.AccessKeyRoleGit:
		switch key.Type {
		case db.AccessKeySSH:
			var agent Agent
			agent, err = StartSSHAgent(key, logger)
			installation.SSHAgent = &agent
			installation.Login = key.SshKey.Login
		}
	case db.AccessKeyRoleAnsiblePasswordVault:
		switch key.Type {
		case db.AccessKeyLoginPassword:
			installation.Password = key.LoginPassword.Password
		default:
			err = fmt.Errorf("access key type not supported for ansible password vault")
		}
	case db.AccessKeyRoleAnsibleBecomeUser:
		if key.Type != db.AccessKeyLoginPassword {
			err = fmt.Errorf("access key type not supported for ansible become user")
		}
		installation.Login = key.LoginPassword.Login
		installation.Password = key.LoginPassword.Password
	case db.AccessKeyRoleAnsibleUser:
		switch key.Type {
		case db.AccessKeySSH:
			var agent Agent
			agent, err = StartSSHAgent(key, logger)
			installation.SSHAgent = &agent
			installation.Login = key.SshKey.Login
		case db.AccessKeyLoginPassword:
			installation.Login = key.LoginPassword.Login
			installation.Password = key.LoginPassword.Password
		case db.AccessKeyNone:

View on GitHub (pinned to 1774ccb71a)