{"record":{"id":"f6714856762576d3","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that contains multiple YAML documents\\. Provide a single encrypted Bitnami SealedSecret document\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":122,"sourceCode":"    /// (<c>ASPIRERADIUS063</c>).\n    /// </exception>\n    internal static Metadata ReadMetadata(\n        string storeName, string manifestPath, string defaultNamespace) =>\n        ReadValidated(storeName, manifestPath, defaultNamespace).Metadata;\n\n    private static Metadata ReadMetadataFromYaml(\n        string storeName, string manifestPath, string defaultNamespace, string text)\n    {\n        try\n        {\n            ValidateStructure(storeName, manifestPath, text);\n\n            var stream = new YamlStream();\n            stream.Load(new StringReader(text));\n\n            if (stream.Documents.Count != 1)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.\");\n            }\n\n            if (stream.Documents[0].RootNode is not YamlMappingNode root)\n            {\n                throw CreateInvalidManifestException(\n                    storeName,\n                    manifestPath,\n                    \"does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.\");\n            }\n\n            return ReadMetadataFromRoot(storeName, manifestPath, defaultNamespace, root);\n        }\n        catch (YamlException ex)\n        {\n            throw CreateInvalidManifestException(","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L104-L140","documentation":"When reading a sealed secret manifest for store metadata, the YAML parser found more than one document in the file. The library only accepts exactly one encrypted Bitnami SealedSecret document per manifest, because a store maps to a single resource.","triggerScenarios":"ReadMetadataFromYaml loads the manifest text with YamlStream and stream.Documents.Count != 1 (e.g. '---' separated documents or a leading '---' creating an empty extra doc).","commonSituations":"Concatenated manifests produced by piping multiple kubeseal outputs into one file; multi-resource YAML shared with kubectl apply -f; an accidental leading/trailing '---' creating an empty document.","solutions":["Split the file so each SealedSecret lives in its own manifest and point the store at the single-document file.","Remove extra documents, including empty ones created by stray '---' separators.","If multiple secrets are needed, define multiple sealed secret stores, one per manifest.","Validate with 'yamllint' or 'kubectl create --dry-run=client -f file.yaml' to count documents before referencing it."],"exampleFix":"// before: one file, two documents\n---\napiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\n...second secret...\n// after: single document per store manifest\napiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\nmetadata:\n  name: my-secret\nspec:\n  encryptedData:\n    key: AgB...","handlingStrategy":"validation","validationCode":"// Count documents before use\nvar docs = File.ReadAllText(path).Split(\"\\n---\").Count(d => !string.IsNullOrWhiteSpace(d));\nif (docs != 1) throw new InvalidOperationException($\"{path} must contain exactly one YAML document\");","typeGuard":null,"tryCatchPattern":"catch (Exception ex) when (ex.Message.Contains(\"multiple YAML documents\"))\n{\n    // split the file into single-document manifests and update the store path\n}","preventionTips":["Keep one SealedSecret per manifest file.","Never concatenate kubeseal outputs into one file.","Avoid stray '---' separators that create empty documents.","Lint multi-doc YAML with yamllint before referencing."],"tags":["yaml","sealed-secrets","validation"],"backgroundTag":"yaml-parse-error","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}