{"record":{"id":"09ca51d2af603d4c","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-09ca51","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that has no metadata mapping with metadata.name.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that has no metadata mapping with metadata\\.name\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":206,"sourceCode":"            throw CreateInvalidManifestException(\n                storeName,\n                manifestPath,\n                \"contains plaintext-capable spec.template.data or spec.template.stringData values. Seal secret material under spec.encryptedData instead.\");\n        }\n\n        // A `kubectl.kubernetes.io/last-applied-configuration` annotation records the full JSON of a\n        // previously-applied object. Unlike spec.encryptedData it is NOT encrypted, so a plaintext\n        // Secret embedded there (top-level metadata, or the templated Secret's metadata) would be\n        // copied verbatim into publish artifacts and re-applied — defeating sealing. Reject it.\n        RejectPlaintextLastAppliedAnnotation(storeName, manifestPath, root);\n\n        // Runs after the leak gates above so a manifest that both leaks cleartext and has a malformed\n        // payload still reports the more specific ASPIRERADIUS063/plaintext diagnostic.\n        ValidateEncryptedData(storeName, manifestPath, root);\n\n        if (!TryGetNode(root, \"metadata\", out var metadataNode) || metadataNode is not YamlMappingNode metadata)\n        {\n            throw CreateInvalidManifestException(\n                storeName,\n                manifestPath,\n                \"has no metadata mapping with metadata.name.\");\n        }\n\n        var name = ReadScalar(metadata, \"name\");\n        if (string.IsNullOrWhiteSpace(name))\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that has \" +\n                \"no metadata.name. Diagnostic: ASPIRERADIUS044.\");\n        }\n\n        var ns = ReadScalar(metadata, \"namespace\");\n        var namespaceWasExplicit = !string.IsNullOrWhiteSpace(ns);\n\n        // The resulting Secret is applied with `kubectl apply`, which enforces Kubernetes naming: the\n        // name must be a DNS-1123 subdomain and any explicit namespace a DNS-1123 label. Validate here","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L188-L224","documentation":"The manifest passed the sealed-payload checks but has no 'metadata' mapping (or metadata is not a mapping), so the resource name cannot be read. The store needs metadata.name to apply and track the SealedSecret in the cluster.","triggerScenarios":"ReadMetadataFromRoot executes after ValidateEncryptedData; TryGetNode(root, \"metadata\", ...) fails or the metadata node is a scalar/sequence rather than a YamlMappingNode.","commonSituations":"A hand-trimmed manifest that dropped metadata; metadata misspelled or nested at the wrong indent level; metadata written as a string ('metadata: my-secret') instead of a mapping with a name key.","solutions":["Add a proper metadata mapping with a name: apiVersion/kind/metadata.name/spec.encryptedData.","Fix indentation so metadata is a sibling of apiVersion and kind at the root level.","Regenerate the manifest with kubeseal, passing --name so metadata.name is set correctly."],"exampleFix":"# before: metadata as scalar\napiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\nmetadata: my-secret\n# after\napiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\nmetadata:\n  name: my-secret","handlingStrategy":"validation","validationCode":"if (doc[\"metadata\"]? [\"name\"] == null) throw new InvalidOperationException(\"Manifest must define metadata.name\");","typeGuard":null,"tryCatchPattern":"catch (Exception ex) when (ex.Message.Contains(\"metadata mapping with metadata.name\"))\n{\n    // add metadata: { name: ... } as a root-level mapping and retry\n}","preventionTips":["Always include metadata.name; use kubeseal --name to set it.","Keep metadata at root level with correct indentation.","Never hand-trim the metadata block from kubeseal output."],"tags":["sealed-secrets","validation","yaml"],"backgroundTag":"missing-required-argument","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}