microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS043

ASPIRERADIUS043

Error message

Secret-store data key '{key}' is declared more than once. Diagnostic: ASPIRERADIUS043.

What it means

The inline-data population dictionary rejects a key added twice instead of silently overwriting the earlier binding. A silent overwrite would hide a duplicate declaration from the ASPIRERADIUS043 gate and could bind the store to the wrong parameter. This mirrors the duplicate-key rejection in the existing/sealed key list.

Solutions

1. Remove or rename the duplicate Add call so each inline key is declared once.
2. If rebinding intentionally, refactor so the key is added once with the correct parameter.
3. Deduplicate the source collection (e.g. Distinct by key, or last-wins on your side) before calling Add.

Example fix

// before
store.WithData().Add("password", p1);
store.WithData().Add("password", p2);
// after
store.WithData().Add("password", p2); // single declaration per key

var seen = new HashSet<string>(StringComparer.Ordinal);
foreach (var k in keys) { if (!seen.Add(k)) throw new InvalidOperationException($"duplicate key {k}"); }

try { population.Add(key, parameter); }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS043")) { /* resolve duplicate declaration */ }

When it happens

Trigger: Calling Add(key, ...) twice on the same secret-store builder with the same key string (ordinal comparison), e.g. Add("password", p1) followed by Add("password", p2).

Common situations: Looping over configuration where two sources produce the same key; copy-pasted binding lines; merging key sets from two code paths that overlap.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• ASPIRERADIUS043
• ASPIRERADIUS040
• ASPIRERADIUS041
• ASPIRERADIUS042
• ASPIRERADIUS046

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/05efbef20d455acc. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs:442

        // A Secret data key that is not a valid Kubernetes key (e.g. 'bad/key') would only be rejected
        // when the store is applied to the cluster; fail at the API boundary instead.
        if (!KubernetesName.IsValidSecretDataKey(key))
        {
            throw new ArgumentException(
                $"Secret data key '{key}' is invalid. A Kubernetes Secret key must be 1-253 characters, may contain only " +
                "alphanumeric characters, '-', '_', or '.', and may not be '.' or '..' or start with '..'. " +
                "Diagnostic: ASPIRERADIUS067.",
                nameof(key));
        }

        // Reject a duplicate inline key rather than silently overwriting the earlier binding via the
        // dictionary indexer: a silent overwrite would hide a duplicate declaration from the
        // ASPIRERADIUS043 gate and could bind the store to the wrong parameter. This mirrors the
        // duplicate-key rejection applied to the existing/sealed key list.
        if (!_population.Data.TryAdd(key, new RadiusSecretKeyBinding(parameter.Resource, encoding?.ToRadiusEncodingString())))
        {
            throw new InvalidOperationException(
                $"Secret-store data key '{key}' is declared more than once. Diagnostic: ASPIRERADIUS043.");
        }

        return this;
    }
}

View on GitHub (pinned to 25830f84bd)