{"record":{"id":"7041675292ef9da9","repo":"microsoft/aspire","slug":"aspireradius081-endpoint-endpointreference-endpointname-of","errorCode":"ASPIRERADIUS081","errorMessage":"Endpoint '{endpointReference.EndpointName}' of resource '{resource.Name}' is TLS-enabled, but the Radius type '{radiusType}' that provisions it publishes no transport-security output, so '{property}' would describe how '{resource.Name}' runs locally rather than how the recipe deploys it. Remove the TLS configuration for publishing, or provision the resource yourself if the deployed workload must use TLS. Diagnostic: ASPIRERADIUS081.","messagePattern":"Endpoint '(.+?)' of resource '(.+?)' is TLS-enabled, but the Radius type '(.+?)' that provisions it publishes no transport-security output, so '(.+?)' would describe how '(.+?)' runs locally rather than how the recipe deploys it\\. Remove the TLS configuration for publishing, or provision the resource yourself if the deployed workload must use TLS\\. Diagnostic: ASPIRERADIUS081\\.","errorType":"exception","errorClass":"RadiusBackingResourceProjectionException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/RadiusEnvironmentResource.cs","lineNumber":255,"sourceCode":"    // recipe deploys without TLS, so it is rejected here too rather than only on the Radius path.\n    private static void ThrowIfTransportSecurityIsNotRecipeBacked(EndpointReference endpointReference, EndpointProperty property)\n    {\n        if (!endpointReference.EndpointAnnotation.TlsEnabled ||\n            property is not (EndpointProperty.Scheme or EndpointProperty.TlsEnabled or EndpointProperty.Url))\n        {\n            return;\n        }\n\n        // Child resources (a database on a server, say) are represented by their parent in the\n        // Radius model, so classify against the resource Radius actually emits.\n        var resource = endpointReference.Resource is IResourceWithParent child ? child.Parent : endpointReference.Resource;\n\n        if (ResourceTypeMapper.TryGetEmittedBackingType(resource) is not { } radiusType)\n        {\n            return;\n        }\n\n        throw new RadiusBackingResourceProjectionException(\n            resource,\n            $\"Endpoint '{endpointReference.EndpointName}' of resource '{resource.Name}' is TLS-enabled, but the Radius \" +\n            $\"type '{radiusType}' that provisions it publishes no transport-security output, so '{property}' would \" +\n            $\"describe how '{resource.Name}' runs locally rather than how the recipe deploys it. Remove the TLS \" +\n            $\"configuration for publishing, or provision the resource yourself if the deployed workload must use TLS. \" +\n            $\"Diagnostic: ASPIRERADIUS081.\");\n    }\n\n    // A backing resource maps to a Radius recipe type (Applications.Datastores/*, Radius.Data/*,\n    // ...) rather than Radius.Compute/containers. Its Kubernetes objects and credentials are owned\n    // by the recipe, so every *address* for it is wrong. Fail loudly instead of emitting an address\n    // that silently resolves to nothing.\n    //\n    // This guard intentionally applies to every caller that asks for an address, including\n    // ComputeEnvironmentEndpointResolver, which routes here when a Kubernetes/ACA/App Service\n    // consumer references a resource owned by this Radius environment. Suppressing it there would\n    // not avoid a false positive — the resolver only delegates for resources this environment owns,\n    // so the address really is underivable — it would merely replace an accurate failure with a","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/RadiusEnvironmentResource.cs#L237-L273","documentation":"When an endpoint of a resource is TLS-enabled but the resource is provisioned by a Radius recipe whose emitted backing type publishes no transport-security output, Aspire refuses to project a TLS-related endpoint property (TlsEnabled). Doing so would describe the local run mode rather than the deployed recipe behavior, producing misleading configuration in the published manifest. The failure is thrown as RadiusBackingResourceProjectionException with diagnostic ASPIRERADIUS081.","triggerScenarios":"Calling GetEndpointPropertyExpression for a TLS-enabled endpoint (e.g. EndpointProperty.TlsEnabled) where ResourceTypeMapper.TryGetEmittedBackingType returns a Radius recipe type that has no transport-security output.","commonSituations":"Adding WithEndpoint with TlsEnabled (or HTTPS scheme) to a resource like a database/cache that is provisioned by a Radius recipe, then consuming its endpoint properties in a dependent service.","solutions":["Remove the TLS configuration from the endpoint when publishing to Radius","Provision the backing resource yourself (container/external resource) if the deployed workload must use TLS","Check ResourceTypeMapper output for the resource type to confirm whether the recipe emits transport-security outputs"],"exampleFix":"// before\nbuilder.AddProject<Projects.Api>(\"api\")\n    .WithEndpoint(\"https\", e => e.TlsEnabled = true); // consumed by recipe-provisioned resource\n// after\nbuilder.AddProject<Projects.Api>(\"api\")\n    .WithEndpoint(\"http\", e => { }); // drop TLS, or provision the backing resource yourself","handlingStrategy":"try-catch","validationCode":"var isRecipeBacked = ResourceTypeMapper.TryGetEmittedBackingType(resource) is not null; var hasTls = endpoint.TlsEnabled; if (isRecipeBacked && hasTls) { /* remove TLS or provision yourself */ }","typeGuard":null,"tryCatchPattern":"try { var expr = env.GetEndpointPropertyExpression(endpointRef, EndpointProperty.TlsEnabled); } catch (RadiusBackingResourceProjectionException ex) when (ex.Message.Contains(\"ASPIRERADIUS081\")) { logger.LogWarning(ex, \"TLS endpoint projected from recipe-backed resource\"); throw; }","preventionTips":["Do not set TlsEnabled on endpoints of recipe-provisioned resources","Provision TLS-terminating resources as containers or external resources","Verify the recipe type emits transport-security outputs before enabling TLS"],"tags":["radius","tls","recipes","diagnostics"],"backgroundTag":"unsupported-operation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}