microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS011

ASPIRERADIUS011

Error message

{provider} cloud-provider credentials are registered per Radius installation (global) and are shared across all environments, but environments {envNames} configure different {provider} credentials that would overwrite one another. Configure a single shared credential for all environments, or deploy them to separate Radius installations. Diagnostic: ASPIRERADIUS011.

What it means

Radius registers cloud-provider credentials globally per Radius installation, so all environments in one publish share them. When multiple environments configured with the same provider supply different credentials (distinct canonical identities), deploying would silently overwrite one credential with another, so validation refuses up front with diagnostic ASPIRERADIUS011.

Solutions

1. Configure the same credential instance (identical tenant/client or role ARN) for all environments in the publish model.
2. Deploy the conflicting environments to separate Radius installations (separate control planes) so credentials are registered independently.
3. Inspect the listed environment names in the message and remove or consolidate the duplicate provider credential registrations.

Example fix

// before
var staging = builder.AddAzureEnvironment("staging").WithRadiusCredential(spCredential2);
var prod = builder.AddAzureEnvironment("prod").WithRadiusCredential(spCredential1);

// after
var sharedCredential = builder.AddAzureRadiusCredential(AzureRadiusCredentialKind.ServicePrincipal, ...);
var staging = builder.AddAzureEnvironment("staging").WithRadiusCredential(sharedCredential);
var prod = builder.AddAzureEnvironment("prod").WithRadiusCredential(sharedCredential);

// Before publish, collect credentials per provider per environment and assert a single distinct identity
var identities = environments
    .Select(e => GetProviderCredentialIdentity(e, provider))
    .Distinct()
    .ToList();
if (identities.Count > 1)
    throw new InvalidOperationException($"Multiple {provider} credentials configured for one Radius installation: {string.Join(", ", identities)}");

try { await publisher.ExecuteAsync(ct); }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS011"))
{
    logger.LogError(ex, "Conflicting provider credentials across environments; consolidate to one credential or separate Radius installations.");
}

When it happens

Trigger: Publishing/deploying two or more Aspire environments to the same Radius installation, each configured with a different credential for the same cloud provider (e.g. environment A uses a ServicePrincipal, environment B uses WorkloadIdentity, or two service principals with different tenant/client IDs).

Common situations: Teams adding a new environment with its own Azure SP while an existing environment already registers a different credential; copying an environment resource and changing only the client ID; testing prod/staging against a single shared dev Radius control plane.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• ASPIRERADIUS010
• rad credential register failed with exit code
• Unknown AWS credential type
• Unknown Azure credential type
• A ConfigureRadiusInfrastructure callback changed port

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/91dbe7cc56fc21b0. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Publishing/RadCredentialRegisterStep.cs:214

            {
                aws.Add((env.Name, AwsCredentialIdentity(awsConfig.Credential)));
            }
        }

        ThrowIfConflicting("Azure", azure);
        ThrowIfConflicting("AWS", aws);
    }

    private static void ThrowIfConflicting(string provider, IReadOnlyList<(string Env, string Identity)> configured)
    {
        var distinctIdentities = configured.Select(static c => c.Identity).Distinct(StringComparer.Ordinal).Count();
        if (distinctIdentities <= 1)
        {
            return;
        }

        var envNames = string.Join(", ", configured.Select(static c => $"'{c.Env}'").Distinct(StringComparer.Ordinal));
        throw new InvalidOperationException(
            $"{provider} cloud-provider credentials are registered per Radius installation (global) and " +
            $"are shared across all environments, but environments {envNames} configure different {provider} " +
            "credentials that would overwrite one another. Configure a single shared credential for all " +
            "environments, or deploy them to separate Radius installations. Diagnostic: ASPIRERADIUS011.");
    }

    private static string AzureCredentialIdentity(AzureRadiusCredential credential) => credential switch
    {
        AzureRadiusCredential.ServicePrincipal sp => $"sp|{Canonicalize(sp.TenantId)}|{Canonicalize(sp.ClientId)}",
        AzureRadiusCredential.WorkloadIdentity wi => $"wi|{Canonicalize(wi.TenantId)}|{Canonicalize(wi.ClientId)}",
        _ => throw new InvalidOperationException($"Unknown Azure credential type '{credential.GetType().Name}'."),
    };

    private static string AwsCredentialIdentity(AwsRadiusCredential credential) => credential switch
    {
        // The access key id identifies the principal; it is bound via a parameter, so its
        // resource name is used as a stable proxy without resolving the value here.
        AwsRadiusCredential.AccessKey ak => $"access-key|{ak.AccessKeyId.Resource.Name}",

View on GitHub (pinned to 25830f84bd)