{"record":{"id":"35109d1597158a8a","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-35109d","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that contains a duplicate YAML mapping key '{key}'. Provide a single unambiguous SealedSecret manifest.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that contains a duplicate YAML mapping key '(.+?)'\\. Provide a single unambiguous SealedSecret manifest\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":671,"sourceCode":"                    manifestPath,\n                    \"uses a non-scalar YAML mapping key. Provide a plain SealedSecret manifest with scalar keys.\");\n            }\n\n            var key = scalar.Value;\n            if (string.Equals(key, \"<<\", StringComparison.Ordinal))\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"uses YAML merge keys. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.\");\n            }\n\n            // YAML allows duplicate keys, and some high-level readers keep the last value. For a\n            // security gate that rejects plaintext-capable fields, last-wins semantics would let a\n            // document advertise `kind: SealedSecret` first and then override it with `kind: Secret`.\n            if (!frame.Keys.Add(key))\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    $\"contains a duplicate YAML mapping key '{key}'. Provide a single unambiguous SealedSecret manifest.\");\n            }\n        }\n\n        frame.ExpectsKey = !frame.ExpectsKey;\n    }\n\n    private static InvalidOperationException CreateInvalidManifestException(\n        string storeName, string manifestPath, string reason, Exception? innerException = null) =>\n        new(\n            $\"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that {reason} \" +\n            \"Diagnostic: ASPIRERADIUS044.\",\n            innerException);\n\n    private sealed class MappingFrame\n    {","sourceCodeStart":653,"sourceCodeEnd":689,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L653-L689","documentation":"YAML technically permits duplicate keys (many readers apply last-wins), but for a security gate this is dangerous: a document could advertise `kind: SealedSecret` first and then override it with `kind: Secret`. Duplicate keys anywhere in the manifest are therefore rejected.","triggerScenarios":"ValidateStructure -> RegisterNodeWithParent fails frame.Keys.Add(key) because the same scalar key appears twice within one mapping, e.g. two `kind:` entries after a bad edit or merge.","commonSituations":"Hand-editing or diff-merging manifests leaving duplicated keys; copy/paste errors; concatenation of overlapping fragments; some tools emitting repeated keys.","solutions":["Search the manifest for duplicated keys within each mapping and delete the redundant one, keeping the intended value","Validate with a strict YAML parser (yamllint with key-duplicates rule) before submitting","Regenerate the manifest cleanly rather than merging fragments by hand"],"exampleFix":"// before\nkind: SealedSecret\nkind: Secret\n// after\nkind: SealedSecret","handlingStrategy":"validation","validationCode":"// Detect duplicate keys at one nesting level with a strict parser\nvar deserializer = new YamlDotNet.Serialization.DeserializerBuilder()\n    .WithAttemptingUnquotedStringTypeDeserialization()\n    .Build();\n// Duplicate keys throw YamlDotNet.Core.YamlException with duplicate-key semantics when configured strict.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable yamllint key-duplicates rule in CI","Avoid hand-merging manifest fragments; regenerate instead","Review diffs for duplicated top-level keys after edits"],"tags":["yaml","duplicate-keys","sealed-secrets","security"],"backgroundTag":"schema-validation-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}