microsoft/aspire · error · ArgumentException

ASPIRERADIUS046

ASPIRERADIUS046

Error message

Existing-secret reference '{namespaceAndName}' is invalid. Use a bare '<name>' or a single '<namespace>/<name>' pair. Diagnostic: ASPIRERADIUS046.

What it means

WithExistingSecret accepts either a bare secret name or a single '<namespace>/<name>' pair. A reference containing more than one slash is ambiguous and rejected at the API boundary with diagnostic ASPIRERADIUS046.

Solutions

1. Pass just the secret name ('creds') to use the store's namespace
2. Pass exactly one '<namespace>/<name>' pair ('team/creds')
3. Extract and hardcode or compute namespace and name separately before joining

Example fix

// before
.WithExistingSecret("radius/team/app/creds")
// after
.WithExistingSecret("team/creds")

if (namespaceAndName.Count(c => c == '/') > 1) throw new ArgumentException("Use a bare name or a single namespace/name pair.");

try { store.WithExistingSecret(reference); } catch (ArgumentException ex) when (ex.Message.Contains("ASPIRERADIUS046")) { logger.LogError(ex, "Invalid secret reference"); throw; }

When it happens

Trigger: Calling WithExistingSecret with values like 'team/app/creds', 'ns/sub/name', or a fully qualified UCP/Kubernetes resource ID containing multiple slashes.

Common situations: Pasting a full resource path or cluster-scoped fully-qualified name into the parameter instead of just the namespace and secret name.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• ASPIRERADIUS067
• ASPIRERADIUS042
• ASPIRERADIUS055
• ASPIRERADIUS061
• ASPIRERADIUS065

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/a9f8c4a1a2c5b66e. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs:333

                    nameof(keys));
            }
        }

        return [.. keys];
    }

    // Validates that an existing-secret reference is either a bare Kubernetes object name or exactly
    // one '<namespace>/<name>' pair, and that each segment is a valid Kubernetes name. Radius's
    // Kubernetes secret-store parser rejects anything else at deploy time, so validating at the API
    // boundary keeps the failure fast and local. Accepted:  'db-creds', 'app/db-creds'. Rejected:
    // '/secret' (empty namespace), 'namespace/' (empty name), 'a/b/c' (more than one separator), and
    // names that are not DNS-1123-conformant (e.g. 'App_Creds', 'UPPER').
    private static string ValidateSecretReference(string namespaceAndName)
    {
        var separatorCount = namespaceAndName.Count(c => c == '/');
        if (separatorCount > 1)
        {
            throw new ArgumentException(
                $"Existing-secret reference '{namespaceAndName}' is invalid. Use a bare '<name>' or a single " +
                "'<namespace>/<name>' pair. Diagnostic: ASPIRERADIUS046.",
                nameof(namespaceAndName));
        }

        string? ns = null;
        string name;
        if (separatorCount == 1)
        {
            var slash = namespaceAndName.IndexOf('/', StringComparison.Ordinal);
            ns = namespaceAndName[..slash];
            name = namespaceAndName[(slash + 1)..];
        }
        else
        {
            name = namespaceAndName;
        }

View on GitHub (pinned to 25830f84bd)