semaphoreui/semaphore · error

failed to delete some secrets

Error message

failed to delete some secrets: %v

What it means

During environment deletion, the service also deletes secrets associated with the environment from external secret stores. Individual per-secret deletion failures are collected rather than aborting; if any failed, Delete returns this aggregated error listing them, so the caller knows the environment may be gone but some secrets remain orphaned in the storage backend.

Solutions

1. Read the %v details in the error to see which secrets failed and why (permissions vs network).
2. Grant the secret-storage credentials delete permissions on the affected store, then retry deletion.
3. Manually remove leftover secrets in AWS SM / Azure KV if the environment deletion must not be re-run.
4. Check connectivity/quotas of the secret storage backend and re-delete the environment.

Example fix

// before: service account lacks sm:DeleteSecret
{"secret-1": "AccessDenied: ..."}
// after: attach a policy allowing secretsmanager:DeleteSecret, then retry
envSvc.Delete(projectID, environmentID)

if err := envSvc.Delete(projectID, environmentID); err != nil && strings.Contains(err.Error(), "failed to delete some secrets") { // parse aggregated per-secret failures
    // fix permissions/network for the listed secrets and clean up leftovers
}

When it happens

Trigger: Calling Delete on an environment whose secret cleanup against external storage (AWS SM / Azure KV) partially fails — network errors, missing permissions, already-deleted secrets, throttling.

Common situations: Secret store IAM credentials lacking delete permission; network connectivity issues to AWS/Azure; secrets removed out-of-band causing not-found errors; rate limits during bulk deletion.

Related errors

• missing secret
• secret must be valid json in key
• invalid ssh key
• invalid password key
• source storage key is required

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/cc1a38223e23b48b. Report an issue: GitHub.

Appendix: source

Thrown at services/server/environment_svc.go:75

		if err != nil {
			return
		}

		if !storage.ReadOnly {
			for _, secret := range secrets {
				if secret.Synchronized {
					continue
				}
				err = s.encryptionService.DeleteSecret(&secret)
				if err != nil {
					errors = append(errors, err)
				}
			}
		}
	}

	if len(errors) > 0 {
		err = fmt.Errorf("failed to delete some secrets: %v", errors)
		return
	}

	return
}

View on GitHub (pinned to 1774ccb71a)