{"record":{"id":"2ede938f1d24a108","repo":"microsoft/aspire","slug":"aspireradius083","errorCode":"ASPIRERADIUS083","errorMessage":"Environment variable '${envVarName}' on resource '${resource.Name}' holds a credential, so it is published as a Kubernetes secret key, but its name is not a valid one (a key must be 1-253 characters of letters, digits, '-', '_' and '.', and may not be '.' or '..' or start with '..'). Rename the variable. Diagnostic: ASPIRERADIUS083.","messagePattern":"Environment variable '(.+?)' on resource '(.+?)' holds a credential, so it is published as a Kubernetes secret key, but its name is not a valid one \\(a key must be 1-253 characters of letters, digits, '-', '_' and '\\.', and may not be '\\.' or '\\.\\.' or start with '\\.\\.'\\)\\. Rename the variable\\. Diagnostic: ASPIRERADIUS083\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs","lineNumber":3821,"sourceCode":"\n    /// <summary>\n    /// Maps an environment-variable name to a key of the container's secret.\n    /// </summary>\n    /// <remarks>\n    /// Kubernetes restricts <c>Secret</c> data keys to <c>[-._a-zA-Z0-9]+</c>, caps them at 253\n    /// characters, and rejects <c>.</c>, <c>..</c> and any name starting with <c>..</c> — all\n    /// narrower than what an environment-variable name may contain. Aspire's own names\n    /// (<c>services__*</c>, <c>ConnectionStrings__*</c>, <c>OTEL_*</c>) all satisfy it, but a name\n    /// supplied through <c>WithEnvironment</c> need not, and an invalid key is rejected by the API\n    /// server at deploy time rather than at publish time. Reject it here instead, where the name can\n    /// be attributed. <see cref=\"KubernetesName.IsValidSecretDataKey\"/> carries the full contract,\n    /// so it is reused rather than restated as a looser character-class check here.\n    /// </remarks>\n    private static string ToSecretKey(IResource resource, string envVarName)\n    {\n        if (!KubernetesName.IsValidSecretDataKey(envVarName))\n        {\n            throw new InvalidOperationException(\n                $\"Environment variable '{envVarName}' on resource '{resource.Name}' holds a credential, so it is \" +\n                $\"published as a Kubernetes secret key, but its name is not a valid one (a key must be 1-253 \" +\n                $\"characters of letters, digits, '-', '_' and '.', and may not be '.' or '..' or start with '..'). \" +\n                $\"Rename the variable. Diagnostic: ASPIRERADIUS083.\");\n        }\n\n        return envVarName;\n    }\n\n    /// <summary>\n    /// Creates the single <c>Radius.Security/secrets</c> resource holding every credential-bearing\n    /// environment value of one container.\n    /// </summary>\n    /// <remarks>\n    /// One secret per container rather than one per variable keeps the emitted artifact\n    /// proportional to the number of workloads instead of the number of variables.\n    /// <para>\n    /// This secret is only ever consumed by its own container, so it cannot create the","sourceCodeStart":3803,"sourceCodeEnd":3839,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs#L3803-L3839","documentation":"Environment variables that hold credentials on a container are emitted as a Kubernetes Secret, so the variable name becomes the secret data key. Kubernetes requires keys to be 1-253 chars of letters, digits, '-', '_' or '.', not be '.' or '..', and not start with '..'. An invalid name throws ASPIRERADIUS083 via KubernetesName.IsValidSecretDataKey.","triggerScenarios":"Publishing a container whose credential-bearing environment variable (added with e.g. WithEnvironment(name, value) where the value is treated as a secret) has a name violating Kubernetes secret-key rules (empty, too long, illegal characters, or '../..'-style names).","commonSituations":"Env var names built dynamically with spaces, slashes, or special characters; very long generated names over 253 chars; names like \".env\" siblings or those starting with '..'; names from config keys copied verbatim (e.g., containing ':' or '/').","solutions":["Rename the environment variable to a valid Kubernetes key: letters, digits, '-', '_', '.', up to 253 chars, not '.' or '..' and not starting with '..'.","Sanitize dynamically generated names before passing them to WithEnvironment.","Move the credential out of the env var name path (e.g., map the config key to a conventional name like ConnectionStrings__MyDb)."],"exampleFix":"// before\nbuilder.AddContainer(\"api\", \"image\")\n    .WithEnvironment(\"my app/connection:secret\", secretRef);\n// after\nbuilder.AddContainer(\"api\", \"image\")\n    .WithEnvironment(\"my_app_connection_secret\", secretRef);","handlingStrategy":"validation","validationCode":"static bool IsValidSecretKey(string name) =>\n    name.Length is >= 1 and <= 253 &&\n    name.All(c => char.IsLetterOrDigit(c) || c is '-' or '_' or '.') &&\n    name is not (\".\" or \"..\") && !name.StartsWith(\"..\");","typeGuard":null,"tryCatchPattern":"catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS083\"))\n{\n    logger.LogError(ex, \"Invalid Kubernetes secret key from env var name\");\n}","preventionTips":["Validate env var names against Kubernetes key rules before WithEnvironment.","Sanitize dynamic names (replace illegal chars with '-') instead of passing config keys verbatim.","Prefer conventional names like ConnectionStrings__X for credentials."],"tags":["radius","kubernetes","secret","env-var","naming"],"backgroundTag":"invalid-identifier-format","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}