{"record":{"id":"1f181b7101cf088b","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-1f181b","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that uses YAML aliases. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that uses YAML aliases\\. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":572,"sourceCode":"            }\n        }\n\n        node = null!;\n        return false;\n    }\n\n    private static void ValidateStructure(string storeName, string manifestPath, string text)\n    {\n        var parser = new Parser(new StringReader(text));\n        var stack = new Stack<MappingFrame>();\n\n        while (parser.MoveNext())\n        {\n            var yamlEvent = parser.Current;\n\n            if (yamlEvent is AnchorAlias)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"uses YAML aliases. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.\");\n            }\n\n            if (yamlEvent is NodeEvent nodeEvent)\n            {\n                if (!nodeEvent.Anchor.IsEmpty || HasExplicitTag(nodeEvent))\n                {\n                    throw CreateInvalidManifestException(\n                        storeName,\n                        manifestPath,\n                        \"uses YAML anchors or explicit tags. Provide a plain SealedSecret manifest without anchors, aliases, merge keys, or tags.\");\n                }\n\n                RegisterNodeWithParent(storeName, manifestPath, yamlEvent, stack);\n            }\n","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L554-L590","documentation":"The parser rejects SealedSecret manifests containing YAML aliases (references like *anchor), because aliases make the document non-self-contained and complicate security validation of secret-bearing fields. A manifest must be a plain, expanded YAML document.","triggerScenarios":"ReadMetadataFromYaml -> ValidateStructure's event loop sees an AnchorAlias event anywhere in the manifest while streaming the YAML document.","commonSituations":"Using YAML anchors with aliases (&config / *config) to deduplicate repeated blocks; templating tools generating aliased documents; copy-pasting manifests that use merge-key aliases.","solutions":["Remove all *alias references and inline the referenced content so every value is written out literally","Re-generate the manifest without anchors (avoid anchors when authoring sealed secrets)","If using yq/templating, expand anchors before saving (e.g. `yq eval-all` or an expander tool)"],"exampleFix":"// before\nspec:\n  template: &t\n    type: Opaque\nspec2:\n  template: *t\n// after\nspec:\n  template:\n    type: Opaque\nspec2:\n  template:\n    type: Opaque","handlingStrategy":"validation","validationCode":"if (File.ReadAllText(manifestPath).Contains('*') &&\n    System.Text.RegularExpressions.Regex.IsMatch(File.ReadAllText(manifestPath), \"(^|\\\\s)\\\\*\\\\w+\", System.Text.RegularExpressions.RegexOptions.Multiline))\n    throw new InvalidOperationException(\"Manifest contains YAML aliases\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid YAML anchors/aliases when authoring sealed-secret manifests","Expand anchors with a tool before saving the final manifest","Lint manifests with yamllint (aliases rule) in CI"],"tags":["yaml","aliases","sealed-secrets","validation"],"backgroundTag":"yaml-parse-error","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}