{"record":{"id":"37a41c4bca1bb5f8","repo":"microsoft/aspire","slug":"aspireradius058","errorCode":"ASPIRERADIUS058","errorMessage":"The SealedSecret '{ns}/{name}' referenced by sealed secret store '{storeName}' failed to sync generation {appliedGeneration}: {decision.Message}. Diagnostic: ASPIRERADIUS058.","messagePattern":"The SealedSecret '(.+?)/(.+?)' referenced by sealed secret store '(.+?)' failed to sync generation (.+?): (.+?)\\. Diagnostic: ASPIRERADIUS058\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/SealedSecretApplyStep.cs","lineNumber":298,"sourceCode":"                cancellationToken,\n                () => CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout))\n                .ConfigureAwait(false);\n            var decision = EvaluateSealedSecretSync(status, appliedGeneration);\n            if (decision.Kind == SealedSecretSyncDecisionKind.Synced)\n            {\n                if (await InvokeProbeWithRemainingBudgetAsync(\n                    secretExists,\n                    RemainingBudget(deadline),\n                    cancellationToken,\n                    () => CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout))\n                    .ConfigureAwait(false))\n                {\n                    return;\n                }\n            }\n            else if (decision.Kind == SealedSecretSyncDecisionKind.Failed)\n            {\n                throw new InvalidOperationException(\n                    $\"The SealedSecret '{ns}/{name}' referenced by sealed secret store '{storeName}' \" +\n                    $\"failed to sync generation {appliedGeneration}: {decision.Message}. Diagnostic: ASPIRERADIUS058.\");\n            }\n\n            var remaining = RemainingBudget(deadline);\n            if (remaining <= TimeSpan.Zero)\n            {\n                throw CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout);\n            }\n\n            try\n            {\n                await Task.Delay(remaining < interval ? remaining : interval, cancellationToken).ConfigureAwait(false);\n            }\n            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)\n            {\n                throw CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout);\n            }","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/SealedSecretApplyStep.cs#L280-L316","documentation":"After applying a SealedSecret, the step polls the controller for the applied generation. When the sync decision is SealedSecretSyncDecisionKind.Failed, ASPIRERADIUS058 is thrown with the controller's own failure message. This means the Sealed Secrets controller processed the resource but could not decrypt or materialize it into a Secret.","triggerScenarios":"WaitForSealedSecretSyncedAsync (called from ApplyStoreAsync) observes a Failed decision for generation appliedGeneration — the controller reports a sync error such as decryption failure (wrong sealed-secret cert/key), invalid encryptedData, or a missing secret-key annotation.","commonSituations":"kubeseal sealed against a different cluster's controller certificate than the target cluster; controller certificate rotated after sealing; corrupted/truncated encryptedData; unsupported sealed-secrets controller version.","solutions":["Read decision.Message in the error for the controller's root cause and fix accordingly (usually re-seal the secret).","Re-seal the secret with kubeseal using the current controller certificate of the target cluster: `kubeseal --fetch-cert > pub-cert.pem` then seal with it.","Verify the Sealed Secrets controller is healthy (`kubectl -n kube-system get pods -l name=sealed-secrets-controller`) and its version matches the kubeseal used."],"exampleFix":"// before\nkubeseal -f secret.yaml -o yaml   # sealed against old/other cluster cert\n\n// after\nkubeseal --controller-namespace kube-system --fetch-cert > pub-cert.pem\nkubeseal -f secret.yaml --cert pub-cert.pem -o yaml","handlingStrategy":"retry","validationCode":"// Pre-flight: verify the controller cert matches what was used to seal\nvar cert = await Process.RunAsync(\"kubeseal\", \"--fetch-cert\");\nif (cert.ExitCode != 0) throw new InvalidOperationException(\"Sealed Secrets controller unreachable or cert unavailable; re-seal with the current cert.\");","typeGuard":null,"tryCatchPattern":"// Catch sync failure and prompt re-sealing\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS058\"))\n{\n    logger.LogError(\"SealedSecret failed to sync; re-seal the secret with the target cluster's current controller cert. {Message}\", ex.Message);\n    throw;\n}","preventionTips":["Always seal with a freshly fetched controller cert from the target cluster.","Pin kubeseal and controller versions to compatible releases.","Check controller pod health before deploying sealed secrets."],"tags":["radius","sealed-secrets","kubernetes","sync"],"backgroundTag":"sealed-secret-sync-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}