{"record":{"id":"843d5335decae95c","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-843d53","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that does not have a YAML mapping as its root\\. Provide a single encrypted Bitnami SealedSecret object\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":130,"sourceCode":"    {\n        try\n        {\n            ValidateStructure(storeName, manifestPath, text);\n\n            var stream = new YamlStream();\n            stream.Load(new StringReader(text));\n\n            if (stream.Documents.Count != 1)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.\");\n            }\n\n            if (stream.Documents[0].RootNode is not YamlMappingNode root)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.\");\n            }\n\n            return ReadMetadataFromRoot(storeName, manifestPath, defaultNamespace, root);\n        }\n        catch (YamlException ex)\n        {\n            throw CreateInvalidManifestException(\n                storeName,\n                manifestPath,\n                \"is malformed YAML or uses unsupported YAML features.\",\n                ex);\n        }\n    }\n\n    private static Metadata ReadMetadataFromRoot(","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L112-L148","documentation":"The manifest parses as YAML but its top-level node is not a mapping (YAML object). A valid SealedSecret document must be an object with apiVersion/kind/metadata/spec keys; sequences or scalars at the root cannot carry the required metadata.","triggerScenarios":"ReadMetadataFromYaml casts stream.Documents[0].RootNode to YamlMappingNode; the cast fails because the root is a YamlSequenceNode ('- item' list) or a scalar (plain string/number).","commonSituations":"Pointing the store at the wrong file (e.g. a values list or a plain text blob saved with .yaml extension); a hand-edited manifest whose indentation collapsed the object into a scalar or list.","solutions":["Ensure the file's root is a single YAML mapping starting with 'apiVersion: bitnami.com/v1alpha1' and 'kind: SealedSecret'.","Re-generate the manifest with kubeseal instead of hand-editing indentation.","Check you referenced the intended manifest path for the store, not an unrelated YAML file.","Lint the file (yamllint) to see how the document root parses."],"exampleFix":"# before: root is a sequence\n- apiVersion: bitnami.com/v1alpha1\n  kind: SealedSecret\n# after: root is a mapping\napiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\nmetadata:\n  name: my-secret","handlingStrategy":"validation","validationCode":"// quick structural check\nif (!text.TrimStart().StartsWith(\"apiVersion:\")) throw new InvalidOperationException(\"Manifest root must be a YAML mapping\");","typeGuard":null,"tryCatchPattern":"catch (Exception ex) when (ex.Message.Contains(\"YAML mapping as its root\"))\n{\n    // verify file content; regenerate with kubeseal\n}","preventionTips":["Start manifests at column 0 with apiVersion/kind — never make the root a list or scalar.","Don't point stores at values/list files with a .yaml extension.","Regenerate manifests with kubeseal rather than hand-editing structure."],"tags":["yaml","sealed-secrets","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}