{"record":{"id":"9818847f335b2ec5","repo":"microsoft/aspire","slug":"aspireradius062","errorCode":"ASPIRERADIUS062","errorMessage":"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.","messagePattern":"Secret store '(.+?)' sets WithMaterializationTimeout but is not populated with WithSealedSecret\\. The materialization timeout only applies to sealed secrets; remove the call or use WithSealedSecret\\. Diagnostic: ASPIRERADIUS062\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":191,"sourceCode":"                        $\"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. \" +\n                        \"Diagnostic: ASPIRERADIUS042.\");\n                }\n\n                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is \" +\n                        $\"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.\");\n                }\n            }\n        }\n\n        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,\n        // which awaits the SealedSecret controller. On any other population mode it would silently\n        // no-op, so reject an explicit override rather than mislead the author.\n        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with \" +\n                \"WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the \" +\n                \"call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.\");\n        }\n\n        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,\n        // so a bare '<name>' reference has no deterministic namespace to default to (it would otherwise\n        // fall back to whichever environment happens to build the store). Require a fully-qualified\n        // '<namespace>/<name>' reference. Sealed stores are checked after their manifest metadata is read\n        // because only then can we tell whether metadata.namespace was explicit or defaulted.\n        if (store.Scope == RadiusSecretStoreScope.Application &&\n            population.HasExistingSecret &&\n            population.ResourceReference is { } reference &&\n            !reference.Contains('/', StringComparison.Ordinal))\n        {\n            throw new InvalidOperationException(\n                $\"Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' \" +\n                \"without a namespace. Application-scoped stores have no owning environment to default the \" +","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L173-L209","documentation":"Thrown for ASPIRERADIUS062 when a secret store sets a materialization timeout but is not populated via WithSealedSecret. The materialization timeout only affects the sealed-secret deploy path, which awaits the SealedSecret controller; on any other population mode (inline data, existing secret, etc.) it would silently do nothing. The validator rejects the explicit override rather than let the author be misled into thinking it applies.","triggerScenarios":"Calling WithMaterializationTimeout on a RadiusSecretStoreResource whose population comes from anything other than WithSealedSecret — e.g. WithData/inline data or WithExistingSecret. Detected in ValidateStore as store.MaterializationTimeoutWasSet && !population.HasSealedSecret.","commonSituations":"Adding a timeout 'just in case' on stores populated with inline data; migrating a store away from sealed secrets and leaving the timeout call behind; misunderstanding the flag as a general secret-fetch timeout.","solutions":["Remove the WithMaterializationTimeout call from the store.","If a deploy-time timeout is genuinely needed, populate the store with WithSealedSecret so the timeout applies to the SealedSecret controller await.","Adjust application-side timeout settings if the intent was to limit secret retrieval at runtime instead."],"exampleFix":"// before\nstore.WithData(\"key\", \"value\")\n     .WithMaterializationTimeout(TimeSpan.FromMinutes(5));\n\n// after\nstore.WithData(\"key\", \"value\"); // timeout removed: only meaningful with WithSealedSecret","handlingStrategy":"validation","validationCode":"// Before building the store, assert the pairing.\nif (useSealedSecret) store = store.WithSealedSecret(path).WithMaterializationTimeout(timeout);\nelse store = store.WithData(...); // no timeout call","typeGuard":null,"tryCatchPattern":"try { ValidateSecretStore(store); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS062\")) { /* strip WithMaterializationTimeout and rebuild without it */ }","preventionTips":["Treat WithMaterializationTimeout as exclusively paired with WithSealedSecret.","When removing sealed-secret population from a store, grep for leftover timeout calls.","Add a unit test that validates all store definitions in the AppHost."],"tags":["radius","secrets","conflicting-options","configuration-validation"],"backgroundTag":"conflicting-config-options","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}