{"record":{"id":"2a6ce555e0269481","repo":"microsoft/aspire","slug":"aspireradius067","errorCode":"ASPIRERADIUS067","errorMessage":"Secret data key '{key}' is invalid. A Kubernetes Secret key must be 1-253 characters, may contain only alphanumeric characters, '-', '_', or '.', and may not be '.' or '..' or start with '..'. Diagnostic: ASPIRERADIUS067.","messagePattern":"Secret data key '(.+?)' is invalid\\. A Kubernetes Secret key must be 1-253 characters, may contain only alphanumeric characters, '-', '_', or '\\.', and may not be '\\.' or '\\.\\.' or start with '\\.\\.'\\. Diagnostic: ASPIRERADIUS067\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs","lineNumber":311,"sourceCode":"        store.Resource.MaterializationTimeoutWasSet = true;\n        return store;\n    }\n\n    // Validates every key without mutating the store's population, so a later invalid key cannot\n    // leave the population partially assigned (which would then trip the ASPIRERADIUS065 guard on a\n    // corrected retry). Returns the validated keys for the caller to commit atomically.\n    private static List<string> ValidateKeys(string[] keys)\n    {\n        ArgumentNullException.ThrowIfNull(keys);\n        foreach (var key in keys)\n        {\n            ArgumentException.ThrowIfNullOrWhiteSpace(key, nameof(keys));\n\n            // A Secret data key that is not a valid Kubernetes key (e.g. 'bad/key') would only be\n            // rejected when the store is applied to the cluster; fail at the API boundary instead.\n            if (!KubernetesName.IsValidSecretDataKey(key))\n            {\n                throw new ArgumentException(\n                    $\"Secret data key '{key}' is invalid. A Kubernetes Secret key must be 1-253 characters, may contain only \" +\n                    \"alphanumeric characters, '-', '_', or '.', and may not be '.' or '..' or start with '..'. \" +\n                    \"Diagnostic: ASPIRERADIUS067.\",\n                    nameof(keys));\n            }\n        }\n\n        return [.. keys];\n    }\n\n    // Validates that an existing-secret reference is either a bare Kubernetes object name or exactly\n    // one '<namespace>/<name>' pair, and that each segment is a valid Kubernetes name. Radius's\n    // Kubernetes secret-store parser rejects anything else at deploy time, so validating at the API\n    // boundary keeps the failure fast and local. Accepted:  'db-creds', 'app/db-creds'. Rejected:\n    // '/secret' (empty namespace), 'namespace/' (empty name), 'a/b/c' (more than one separator), and\n    // names that are not DNS-1123-conformant (e.g. 'App_Creds', 'UPPER').\n    private static string ValidateSecretReference(string namespaceAndName)\n    {","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L293-L329","documentation":"Kubernetes Secret data keys have strict rules: 1-253 characters, only alphanumeric characters, '-', '_', or '.', and may not be '.', '..', or start with '..'. Rather than failing only when the store is applied to the cluster, ValidateKeys rejects invalid keys at the API boundary with diagnostic ASPIRERADIUS067.","triggerScenarios":"Calling WithData/WithSealedSecret (via validatedKeys/ValidateKeys) with a key containing '/', a leading '..', an empty or whitespace key, or a key longer than 253 characters.","commonSituations":"Using file paths ('config/app.json') as secret keys; copying Windows-style names with backslashes; deriving keys from arbitrary environment variable or database column names.","solutions":["Rename the key to contain only [A-Za-z0-9-_.] and be 1-253 characters","Replace path separators with '-' or '_' (e.g. 'config-app-json')","Sanitize keys programmatically before passing them to WithData"],"exampleFix":"// before\n.WithData(\"config/app.json\", secretValue)\n// after\n.WithData(\"config-app-json\", secretValue)","handlingStrategy":"validation","validationCode":"static bool IsValidSecretKey(string key) => key.Length is >= 1 and <= 253 && System.Text.RegularExpressions.Regex.IsMatch(key, \"^(?!\\.\\.?[A-Za-z0-9_.-])[A-Za-z0-9_.-]+$\") && key is not \".\" and not \"..\";","typeGuard":null,"tryCatchPattern":"try { store.WithData(key, value); } catch (ArgumentException ex) when (ex.Message.Contains(\"ASPIRERADIUS067\")) { logger.LogError(ex, \"Invalid secret key '{Key}'\", key); throw; }","preventionTips":["Sanitize keys: replace '/' and other separators with '-'","Reject keys derived from paths or arbitrary identifiers","Keep keys within 253 characters and alphanumeric/-/_/. only"],"tags":["radius","secrets","kubernetes","validation","diagnostics"],"backgroundTag":"invalid-identifier-format","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}