{"record":{"id":"8680a15cdebd192b","repo":"microsoft/aspire","slug":"aspireradius055","errorCode":"ASPIRERADIUS055","errorMessage":"Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' without a namespace. Application-scoped stores have no owning environment to default the namespace from; use a fully-qualified '<namespace>/<name>' reference. Diagnostic: ASPIRERADIUS055.","messagePattern":"Application-scoped secret store '(.+?)' references the existing Secret '(.+?)' without a namespace\\. Application-scoped stores have no owning environment to default the namespace from; use a fully-qualified '<namespace>/<name>' reference\\. Diagnostic: ASPIRERADIUS055\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":207,"sourceCode":"        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with \" +\n                \"WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the \" +\n                \"call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.\");\n        }\n\n        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,\n        // so a bare '<name>' reference has no deterministic namespace to default to (it would otherwise\n        // fall back to whichever environment happens to build the store). Require a fully-qualified\n        // '<namespace>/<name>' reference. Sealed stores are checked after their manifest metadata is read\n        // because only then can we tell whether metadata.namespace was explicit or defaulted.\n        if (store.Scope == RadiusSecretStoreScope.Application &&\n            population.HasExistingSecret &&\n            population.ResourceReference is { } reference &&\n            !reference.Contains('/', StringComparison.Ordinal))\n        {\n            throw new InvalidOperationException(\n                $\"Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' \" +\n                \"without a namespace. Application-scoped stores have no owning environment to default the \" +\n                \"namespace from; use a fully-qualified '<namespace>/<name>' reference. \" +\n                \"Diagnostic: ASPIRERADIUS055.\");\n        }\n    }\n\n    /// <summary>\n    /// Validates every recorded secret-store consumer wiring across the model.\n    /// </summary>\n    /// <exception cref=\"InvalidOperationException\">\n    /// A consumer kind is incompatible with the store type (<c>ASPIRERADIUS051</c>), an\n    /// <c>envSecrets</c> consumer references a key the store does not declare\n    /// (<c>ASPIRERADIUS052</c>), or a key-specific <c>envSecrets</c> consumer references a store\n    /// that declares no keys (<c>ASPIRERADIUS064</c>).\n    /// </exception>\n    private static void ValidateConsumers(DistributedApplicationModel model)\n    {","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L189-L225","documentation":"Thrown for ASPIRERADIUS055 when an application-scoped secret store references an existing Kubernetes Secret by a bare name with no namespace. Application-scoped stores have no owning environment from which a namespace could be defaulted, so a '<name>' reference is ambiguous. The validator requires the fully-qualified '<namespace>/<name>' form for such references.","triggerScenarios":"Building a store with store.Scope == RadiusSecretStoreScope.Application, populating it with WithExistingSecret (population.HasExistingSecret) where population.ResourceReference (e.g. \"my-secret\") contains no '/' character. Checked in ValidateStore.","commonSituations":"Copying a store configuration from an environment-scoped store (where the environment supplies the namespace) into an application-scoped one; assuming the application's own namespace is used by default; renaming stores/scopes during refactoring.","solutions":["Change the reference to a fully-qualified '<namespace>/<name>' string, e.g. \"my-namespace/my-secret\".","Alternatively scope the store to an environment instead of the application so the namespace can be defaulted.","Inline the secret data (WithData) if you do not actually need an external Secret reference."],"exampleFix":"// before\n.WithExistingSecret(\"db-password\")\n\n// after\n.WithExistingSecret(\"my-namespace/db-password\");","handlingStrategy":"validation","validationCode":"bool IsQualifiedReference(string reference) => reference.Contains('/', StringComparison.Ordinal);\n// use with application-scoped existing-secret references","typeGuard":null,"tryCatchPattern":"try { ValidateSecretStore(store); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS055\")) { /* prompt for namespace-qualified reference */ }","preventionTips":["Always use '<namespace>/<name>' form for existing-Secret references in application-scoped stores.","Never rely on implicit namespace defaulting when store scope is Application.","Centralize reference formatting in a helper that takes an explicit namespace argument."],"tags":["radius","secrets","kubernetes","namespace"],"backgroundTag":"invalid-argument-format","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}