microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS041

ASPIRERADIUS041

Error message

Secret store '{store.Name}' must declare exactly one population mode (WithData, WithExistingSecret, or WithSealedSecret); it declares {population.DeclaredModeCount}. Diagnostic: ASPIRERADIUS041.

What it means

ASPIRERADIUS041 requires each secret store to declare exactly one population mode: WithData, WithExistingSecret, or WithSealedSecret. ValidateStore counts the declared modes via population.DeclaredModeCount and throws when it is zero or more than one. This prevents ambiguous or empty population definitions.

Solutions

1. Keep exactly one population call per store; remove the extra WithData/WithExistingSecret/WithSealedSecret call.
2. If the store has no population yet, add one (e.g. WithData()).
3. Split into two separate secret stores if both population modes are genuinely needed.

Example fix

// before
var store = builder.AddRadiusSecretStore("s", ...)
    .WithData()
    .WithExistingSecret(...);
// after
var store = builder.AddRadiusSecretStore("s", ...)
    .WithData();

var modes = 0;
if (usedWithData) modes++;
if (usedExistingSecret) modes++;
if (usedSealedSecret) modes++;
if (modes != 1) throw new InvalidOperationException($"store must declare exactly one population mode, got {modes}");

try { /* validation runs */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS041")) { /* fix population calls */ }

When it happens

Trigger: Creating a store without calling any of WithData/WithExistingSecret/WithSealedSecret (count 0), or calling two of them on the same store (count 2), then running validation.

Common situations: Copy-pasting a second population call onto an existing store; forgetting the population call entirely; refactoring that combines two samples' population styles.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• ASPIRERADIUS040
• ASPIRERADIUS042
• ASPIRERADIUS043
• ASPIRERADIUS043
• ASPIRERADIUS046

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/44eea47d4362e1d0. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:126

        }

        foreach (var store in stores)
        {
            ValidateStore(store);
        }

        ValidateNoDuplicateNames(stores);
        ValidateConsumers(model);
    }

    private static void ValidateStore(RadiusSecretStoreResource store)
    {
        var population = store.Population;

        // ASPIRERADIUS041 — exactly one population mode.
        if (population.DeclaredModeCount != 1)
        {
            throw new InvalidOperationException(
                $"Secret store '{store.Name}' must declare exactly one population mode " +
                "(WithData, WithExistingSecret, or WithSealedSecret); it declares " +
                $"{population.DeclaredModeCount}. Diagnostic: ASPIRERADIUS041.");
        }

        var declaredKeys = population.HasInlineData
            ? population.Data.Keys.ToList()
            : population.Keys;

        // ASPIRERADIUS043 — duplicate keys. Inline keys are rejected as they are added (the data
        // dictionary rejects a duplicate via RadiusSecretStoreDataBuilder.Add), so only the
        // existing/sealed key list needs a duplicate scan here.
        if (population.IsSecretReference)
        {
            var seen = new HashSet<string>(StringComparer.Ordinal);
            foreach (var key in population.Keys)
            {
                if (!seen.Add(key))

View on GitHub (pinned to 25830f84bd)