microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS044

ASPIRERADIUS044

Error message

Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that is missing or unreadable ({ex.GetType().Name}). Diagnostic: ASPIRERADIUS044.

What it means

Thrown for ASPIRERADIUS044 when a secret store references a SealedSecret manifest file that cannot be read: the file is missing, or any IO/path/permission/argument error occurs while opening it. All such failures (IOException, PathTooLongException, UnauthorizedAccessException, NotSupportedException, ArgumentException incl. empty/invalid paths) are normalized to this single diagnostic so every 'unreadable manifest' failure matches the documented contract instead of leaking a raw exception.

Solutions

Verify the file exists at the exact path passed to WithSealedSecret (use an absolute path).
If the manifest must ship with the app, mark it CopyToOutputDirectory and reference the output location.
Check file permissions and that the path contains no invalid characters or is not empty.
Ensure the inner exception (ex) reported alongside this message for the underlying cause (e.g. FileNotFoundException) is addressed.

Example fix

// before
store.WithSealedSecret("sealed-secret.yaml"); // relative; missing in CI

// after
var manifestPath = Path.Combine(AppContext.BaseDirectory, "sealed-secret.yaml");
if (!File.Exists(manifestPath)) throw new FileNotFoundException("SealedSecret manifest missing", manifestPath);
store.WithSealedSecret(manifestPath);

Defensive patterns

Strategy: validation

Validate before calling

// Check the manifest before calling WithSealedSecret.
if (string.IsNullOrWhiteSpace(manifestPath) || !File.Exists(manifestPath))
    throw new FileNotFoundException($"SealedSecret manifest not found: {manifestPath}", manifestPath);

Try / catch

try { store = store.WithSealedSecret(manifestPath); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS044")) { logger.LogError(ex, "Manifest unreadable at {Path}", manifestPath); throw; }

Prevention

Use absolute paths (e.g. Path.Combine(AppContext.BaseDirectory, ...)) for manifests.
Mark manifests CopyToOutputDirectory so they exist next to the built app.
Assert file existence in a startup check or unit test before wiring stores.

When it happens

Trigger: Calling WithSealedSecret (leading to SealedSecretManifest.ReadValidated/ReadMetadata) with a path that does not exist, a relative path resolved against an unexpected working directory, a path that is too long, a file without read permission, or an empty/whitespace/invalid-character path string.

Common situations: Using a relative path whose working directory differs between dev machine and CI; forgetting to copy the manifest into the build output; passing an environment-variable-derived path that is unset (empty string); moving the manifest file after wiring the store.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/c9643f8b0b6043ec. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:73

    /// (<c>ASPIRERADIUS063</c>).
    /// </exception>
    internal static ValidatedManifest ReadValidated(
        string storeName, string manifestPath, string defaultNamespace)
    {
        byte[] content;
        try
        {
            content = File.ReadAllBytes(manifestPath);
        }
        // File.ReadAllBytes surfaces an unreadable path as several exception types: IO/permission
        // failures (IOException — includes FileNotFoundException/DirectoryNotFoundException/
        // PathTooLongException — and UnauthorizedAccessException/NotSupportedException) as well as
        // argument failures for an empty/whitespace/invalid-character path (ArgumentException, which
        // covers ArgumentNullException). Normalize them all to ASPIRERADIUS044 so every "unreadable
        // manifest" failure matches the XML-doc/README contract instead of leaking a raw exception.
        catch (Exception ex) when (ex is IOException or PathTooLongException or UnauthorizedAccessException or NotSupportedException or ArgumentException)
        {
            throw new InvalidOperationException(
                $"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that " +
                $"is missing or unreadable ({ex.GetType().Name}). Diagnostic: ASPIRERADIUS044.", ex);
        }

        string text;
        try
        {
            text = s_utf8.GetString(content);
        }
        catch (DecoderFallbackException ex)
        {
            throw new InvalidOperationException(
                $"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that " +
                "is not valid UTF-8 YAML. Diagnostic: ASPIRERADIUS044.", ex);
        }

        var metadata = ReadMetadataFromYaml(storeName, manifestPath, defaultNamespace, text);
        return new ValidatedManifest(metadata, manifestPath, content);

View on GitHub (pinned to 25830f84bd)