{"record":{"id":"8f7f1a8b6a8c580c","repo":"microsoft/aspire","slug":"aspireradius052","errorCode":"ASPIRERADIUS052","errorMessage":"Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe environment secret '{consumer.Selector}'. Declared keys: {string.Join(\", \", declaredKeys)}. Diagnostic: ASPIRERADIUS052.","messagePattern":"Secret store '(.+?)' does not declare the key '(.+?)' referenced by the recipe environment secret '(.+?)'\\. Declared keys: (.+?)\\. Diagnostic: ASPIRERADIUS052\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":304,"sourceCode":"        // sealed/existing store materializes its keys out-of-band and is intentionally unchecked.\n        if (consumer.Kind == RadiusSecretStoreConsumerKind.EnvSecret && consumer.Key is { } key)\n        {\n            var declaredKeys = store.Population.HasInlineData\n                ? store.Population.Data.Keys.ToList()\n                : store.Population.Keys;\n\n            if (declaredKeys.Count == 0)\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' declares no keys, but the recipe environment secret \" +\n                    $\"'{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires \" +\n                    \"the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). \" +\n                    \"Diagnostic: ASPIRERADIUS064.\");\n            }\n\n            if (!declaredKeys.Contains(key, StringComparer.Ordinal))\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe \" +\n                    $\"environment secret '{consumer.Selector}'. Declared keys: {string.Join(\", \", declaredKeys)}. \" +\n                    \"Diagnostic: ASPIRERADIUS052.\");\n            }\n        }\n    }\n\n    private static string DescribeKind(RadiusSecretStoreConsumerKind kind) => kind switch\n    {\n        RadiusSecretStoreConsumerKind.BicepRegistryAuth => \"Bicep registry authentication\",\n        RadiusSecretStoreConsumerKind.TerraformGitPat => \"Terraform Git PAT authentication\",\n        RadiusSecretStoreConsumerKind.EnvSecret => \"recipe environment secret\",\n        _ => kind.ToString(),\n    };\n\n    /// <summary>Validates that an application-scoped sealed store has deterministic manifest namespace metadata.</summary>\n    /// <exception cref=\"InvalidOperationException\">\n    /// The store is application-scoped and its sealed manifest omitted <c>metadata.namespace</c> (<c>ASPIRERADIUS055</c>).","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L286-L322","documentation":"Thrown for ASPIRERADIUS052 when a key-specific envSecrets consumer references a key that the store does declare some keys for, but not the one requested. This is a case-sensitive (ordinal) check against the declared key list. It ensures recipe environment secrets can only reference keys the store explicitly exposes.","triggerScenarios":"An envSecrets consumer whose Selector resolves to key 'key' where declaredKeys is non-empty but does not contain 'key' (ordinal comparison) — e.g. the store declares 'Password' but the consumer asks for 'password'. Detected in ValidateConsumer.","commonSituations":"Case mismatches between the Kubernetes Secret's actual key names and the selector; typos in key names; a Secret's keys were renamed upstream while the consumer selector stayed stale.","solutions":["Fix the consumer selector to use the exact declared key name (watch casing).","Add the missing key to the store's declared keys (WithData or key list on WithExistingSecret/WithSealedSecret).","Print/log store.Population keys during development to compare against the selector."],"exampleFix":"// before\nrecipeSecret.Reference(store, \"connectionstring\"); // store declares \"connectionString\"\n\n// after\nrecipeSecret.Reference(store, \"connectionString\");","handlingStrategy":"validation","validationCode":"bool ExactKeyDeclared(RadiusSecretStoreResource store, string key) =>\n    (store.Population.HasInlineData ? store.Population.Data.Keys : store.Population.Keys)\n        .Contains(key, StringComparer.Ordinal);","typeGuard":null,"tryCatchPattern":"try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS052\")) { /* correct the selector casing/spelling to a declared key */ }","preventionTips":["Copy key names from the actual Secret rather than typing from memory (case-sensitive).","Keep a single constant source of key names shared between store and consumer code.","Compare declared keys vs selectors in a startup validation test."],"tags":["radius","secrets","key-mismatch","case-sensitivity"],"backgroundTag":"record-not-found","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}