{"record":{"id":"2d1f40bb85a4da92","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-2d1f40","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that uses a non-scalar YAML mapping key. Provide a plain SealedSecret manifest with scalar keys.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that uses a non-scalar YAML mapping key\\. Provide a plain SealedSecret manifest with scalar keys\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":651,"sourceCode":"    private static void RegisterNodeWithParent(\n        string storeName, string manifestPath, ParsingEvent yamlEvent, Stack<MappingFrame> stack)\n    {\n        if (stack.Count == 0)\n        {\n            return;\n        }\n\n        var frame = stack.Peek();\n        if (frame.IsSequence)\n        {\n            return;\n        }\n\n        if (frame.ExpectsKey)\n        {\n            if (yamlEvent is not Scalar scalar)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"uses a non-scalar YAML mapping key. Provide a plain SealedSecret manifest with scalar keys.\");\n            }\n\n            var key = scalar.Value;\n            if (string.Equals(key, \"<<\", StringComparison.Ordinal))\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"uses YAML merge keys. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.\");\n            }\n\n            // YAML allows duplicate keys, and some high-level readers keep the last value. For a\n            // security gate that rejects plaintext-capable fields, last-wins semantics would let a\n            // document advertise `kind: SealedSecret` first and then override it with `kind: Secret`.\n            if (!frame.Keys.Add(key))","sourceCodeStart":633,"sourceCodeEnd":669,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L633-L669","documentation":"YAML mapping keys in a SealedSecret manifest must be scalars. A key that is itself a mapping or sequence (complex keys) cannot be interpreted as a field name, so the validator rejects the document as non-plain.","triggerScenarios":"ValidateStructure -> RegisterNodeWithParent, when the current frame expects a key and the incoming event is not a Scalar — e.g. `? [a, b] : value` or a nested-map used as a key.","commonSituations":"Machine-generated YAML with complex keys; flow-style `? {..} : ..` syntax; copy-pasted YAML using multi-line or structured keys.","solutions":["Replace complex keys with plain scalar strings","Simplify the mapping structure so each key is a simple identifier","Regenerate the manifest from kubeseal or the intended tool so keys are scalars"],"exampleFix":"// before\n? [environment, region]\n: prod\n// after\nenvironment-region: prod","handlingStrategy":"validation","validationCode":"var yaml = new YamlDotNet.RepresentationModel.YamlStream();\nyaml.Load(new StringReader(File.ReadAllText(manifestPath)));\nvar root = (YamlDotNet.RepresentationModel.YamlMappingNode)yaml.Documents[0].RootNode;\nforeach (var kv in root)\n    if (kv.Key.NodeType != YamlDotNet.RepresentationModel.YamlNodeType.Scalar)\n        throw new InvalidOperationException(\"Manifest has non-scalar keys\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only string keys in SealedSecret YAML","Avoid flow-style complex-key syntax `? {..} :`","Generate manifests with kubeseal rather than hand-building YAML"],"tags":["yaml","keys","sealed-secrets","validation"],"backgroundTag":"yaml-parse-error","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}