microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS042

ASPIRERADIUS042

Error message

Secret store '{store.Name}' binds key '{key}' to the non-secret parameter '{binding.Parameter.Name}'. Bind a parameter created with secret: true. Diagnostic: ASPIRERADIUS042.

What it means

ASPIRERADIUS042 requires that inline data bindings (WithData population) target secret parameters. When population.HasInlineData, ValidateStore iterates population.Data and throws for any binding whose Parameter.Secret is false — the value comes from a Secret at deploy time, so a non-secret parameter would be a type/semantics mismatch.

Solutions

  1. Create the bound parameter with secret: true (e.g. WithParameter(..., secret: true)).
  2. Bind a different, already-secret parameter instead.
  3. Remove the inline binding if it should not target a secret parameter.

Example fix

// before
var p = resource.WithParameter("apiKey", "...");
store.WithData().Add("apiKey", p);
// after
var p = resource.WithParameter("apiKey", secret: true);
store.WithData().Add("apiKey", p);
Defensive patterns

Strategy: validation

Validate before calling

foreach (var (key, binding) in population.Data)
    if (!binding.Parameter.Secret)
        throw new InvalidOperationException($"{key} must bind a parameter created with secret: true");

Try / catch

try { /* validation runs */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS042")) { /* recreate the parameter with secret: true */ }

Prevention

When it happens

Trigger: Calling store.WithData().Add(key, parameter) where the parameter resource was created without secret: true, then validating the model.

Common situations: Reusing an ordinary value parameter for a secret binding; a helper that creates parameters without setting secret; refactoring parameter creation and losing the secret flag.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/1608601f0918f225. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:171

        // ASPIRERADIUS040 — type-aware required keys.
        foreach (var required in store.Type.RequiredKeys())
        {
            if (!declaredKeys.Contains(required, StringComparer.Ordinal))
            {
                throw new InvalidOperationException(
                    $"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is missing " +
                    $"the required key '{required}'. Diagnostic: ASPIRERADIUS040.");
            }
        }

        // ASPIRERADIUS042 / ASPIRERADIUS047 — inline bindings must be secret and use valid encoding.
        if (population.HasInlineData)
        {
            foreach (var (key, binding) in population.Data)
            {
                if (!binding.Parameter.Secret)
                {
                    throw new InvalidOperationException(
                        $"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter " +
                        $"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. " +
                        "Diagnostic: ASPIRERADIUS042.");
                }

                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))
                {
                    throw new InvalidOperationException(
                        $"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is " +
                        $"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.");
                }
            }
        }

        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,
        // which awaits the SealedSecret controller. On any other population mode it would silently
        // no-op, so reject an explicit override rather than mislead the author.
        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)

View on GitHub (pinned to 25830f84bd)