{"record":{"id":"830003edf587ea67","repo":"microsoft/aspire","slug":"aspireradius064","errorCode":"ASPIRERADIUS064","errorMessage":"Secret store '{store.Name}' declares no keys, but the recipe environment secret '{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). Diagnostic: ASPIRERADIUS064.","messagePattern":"Secret store '(.+?)' declares no keys, but the recipe environment secret '(.+?)' references the key '(.+?)'\\. A key-specific envSecrets consumer requires the store to declare that key \\(via WithData, or WithExistingSecret/WithSealedSecret with keys\\)\\. Diagnostic: ASPIRERADIUS064\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":295,"sourceCode":"            }\n        }\n\n        // ASPIRERADIUS052 / ASPIRERADIUS064 — a key-specific envSecrets consumer must reference a key the\n        // store exposes. Emission only exposes explicitly declared keys, so:\n        //   * a keyless store (no inline data and no existing/sealed key list) cannot satisfy a\n        //     key-specific reference — the emitted envSecrets entry would dangle (ASPIRERADIUS064);\n        //   * a store with a non-empty declared set must contain the referenced key (ASPIRERADIUS052).\n        // A store with no declared keys that is referenced WITHOUT a specific key is left alone: such a\n        // sealed/existing store materializes its keys out-of-band and is intentionally unchecked.\n        if (consumer.Kind == RadiusSecretStoreConsumerKind.EnvSecret && consumer.Key is { } key)\n        {\n            var declaredKeys = store.Population.HasInlineData\n                ? store.Population.Data.Keys.ToList()\n                : store.Population.Keys;\n\n            if (declaredKeys.Count == 0)\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' declares no keys, but the recipe environment secret \" +\n                    $\"'{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires \" +\n                    \"the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). \" +\n                    \"Diagnostic: ASPIRERADIUS064.\");\n            }\n\n            if (!declaredKeys.Contains(key, StringComparer.Ordinal))\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe \" +\n                    $\"environment secret '{consumer.Selector}'. Declared keys: {string.Join(\", \", declaredKeys)}. \" +\n                    \"Diagnostic: ASPIRERADIUS052.\");\n            }\n        }\n    }\n\n    private static string DescribeKind(RadiusSecretStoreConsumerKind kind) => kind switch\n    {","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L277-L313","documentation":"Thrown for ASPIRERADIUS064 when a key-specific envSecrets consumer (a recipe environment secret selector like 'key@value' referencing a specific key) points at a store that declares no keys at all. Since the store declares nothing, the validator cannot confirm the referenced key will exist, so it fails fast and asks the author to declare the key via WithData or via WithExistingSecret/WithSealedSecret key declarations.","triggerScenarios":"An envSecrets consumer with a key-specific Selector referencing a store where declaredKeys.Count == 0 — i.e. no WithData inline data and no keys declared for an existing/sealed secret population. Detected in ValidateConsumer.","commonSituations":"Pointing a key-specific recipe secret at an existing-Secret store without enumerating its keys; assuming the validator/Radius will resolve keys from the live Kubernetes Secret; creating a bare store shell and wiring consumers before populating it.","solutions":["Declare the referenced key on the store: use WithData for inline data, or pass keys when calling WithExistingSecret/WithSealedSecret.","If you cannot enumerate keys, use a non-key-specific envSecrets selector instead of a key-specific one.","Verify the store you intended to reference actually got populated (order-of-declaration mistakes are common)."],"exampleFix":"// before\nstore.WithExistingSecret(\"ns/db-secret\"); // no keys declared\nrecipeSecret.Reference(store, \"connectionString\");\n\n// after\nstore.WithExistingSecret(\"ns/db-secret\", keys: new[] { \"connectionString\" });\nrecipeSecret.Reference(store, \"connectionString\");","handlingStrategy":"validation","validationCode":"bool KeyIsDeclared(RadiusSecretStoreResource store, string key) =>\n    (store.Population.HasInlineData ? store.Population.Data.Keys : store.Population.Keys).Count > 0;","typeGuard":null,"tryCatchPattern":"try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS064\")) { /* declare keys on the store or drop key-specific selector */ }","preventionTips":["Always enumerate keys when using WithExistingSecret/WithSealedSecret with key-specific consumers.","Never wire key-specific consumers to stores before populating them.","Validate all stores+consumers at startup in tests."],"tags":["radius","secrets","undeclared-key","recipes"],"backgroundTag":"missing-required-argument","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}