{"record":{"id":"a9f8c4a1a2c5b66e","repo":"microsoft/aspire","slug":"aspireradius046","errorCode":"ASPIRERADIUS046","errorMessage":"Existing-secret reference '{namespaceAndName}' is invalid. Use a bare '<name>' or a single '<namespace>/<name>' pair. Diagnostic: ASPIRERADIUS046.","messagePattern":"Existing-secret reference '(.+?)' is invalid\\. Use a bare '<name>' or a single '<namespace>/<name>' pair\\. Diagnostic: ASPIRERADIUS046\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs","lineNumber":333,"sourceCode":"                    nameof(keys));\n            }\n        }\n\n        return [.. keys];\n    }\n\n    // Validates that an existing-secret reference is either a bare Kubernetes object name or exactly\n    // one '<namespace>/<name>' pair, and that each segment is a valid Kubernetes name. Radius's\n    // Kubernetes secret-store parser rejects anything else at deploy time, so validating at the API\n    // boundary keeps the failure fast and local. Accepted:  'db-creds', 'app/db-creds'. Rejected:\n    // '/secret' (empty namespace), 'namespace/' (empty name), 'a/b/c' (more than one separator), and\n    // names that are not DNS-1123-conformant (e.g. 'App_Creds', 'UPPER').\n    private static string ValidateSecretReference(string namespaceAndName)\n    {\n        var separatorCount = namespaceAndName.Count(c => c == '/');\n        if (separatorCount > 1)\n        {\n            throw new ArgumentException(\n                $\"Existing-secret reference '{namespaceAndName}' is invalid. Use a bare '<name>' or a single \" +\n                \"'<namespace>/<name>' pair. Diagnostic: ASPIRERADIUS046.\",\n                nameof(namespaceAndName));\n        }\n\n        string? ns = null;\n        string name;\n        if (separatorCount == 1)\n        {\n            var slash = namespaceAndName.IndexOf('/', StringComparison.Ordinal);\n            ns = namespaceAndName[..slash];\n            name = namespaceAndName[(slash + 1)..];\n        }\n        else\n        {\n            name = namespaceAndName;\n        }\n","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L315-L351","documentation":"WithExistingSecret accepts either a bare secret name or a single '<namespace>/<name>' pair. A reference containing more than one slash is ambiguous and rejected at the API boundary with diagnostic ASPIRERADIUS046.","triggerScenarios":"Calling WithExistingSecret with values like 'team/app/creds', 'ns/sub/name', or a fully qualified UCP/Kubernetes resource ID containing multiple slashes.","commonSituations":"Pasting a full resource path or cluster-scoped fully-qualified name into the parameter instead of just the namespace and secret name.","solutions":["Pass just the secret name ('creds') to use the store's namespace","Pass exactly one '<namespace>/<name>' pair ('team/creds')","Extract and hardcode or compute namespace and name separately before joining"],"exampleFix":"// before\n.WithExistingSecret(\"radius/team/app/creds\")\n// after\n.WithExistingSecret(\"team/creds\")","handlingStrategy":"validation","validationCode":"if (namespaceAndName.Count(c => c == '/') > 1) throw new ArgumentException(\"Use a bare name or a single namespace/name pair.\");","typeGuard":null,"tryCatchPattern":"try { store.WithExistingSecret(reference); } catch (ArgumentException ex) when (ex.Message.Contains(\"ASPIRERADIUS046\")) { logger.LogError(ex, \"Invalid secret reference\"); throw; }","preventionTips":["Strip cluster/UCP prefixes down to '<name>' or '<namespace>/<name>'","Never pass full resource IDs to WithExistingSecret","Compute namespace and name separately and join once"],"tags":["radius","secrets","kubernetes","validation","diagnostics"],"backgroundTag":"invalid-argument-format","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}