microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS050

ASPIRERADIUS050

Error message

Environment '{_environment.Name}' references secret store '{store.Name}', but that store is not emitted for this environment. Ensure the store is declared on this environment. Diagnostic: ASPIRERADIUS050.

What it means

During Radius publish, an environment resource references a secret store by .id, but that store was never emitted as a resource for the same environment. The builder deliberately refuses to fall back to the bare store name (a plain string where a secret-store .id is expected), which Radius would only reject at deploy time or silently resolve to nothing. It fails fast at build/publish time with ASPIRERADIUS050 naming the environment and the unresolved store.

Solutions

Declare the secret store on the referenced environment so it is emitted into the same environment's resources.
Check the environment name in the message against your publish code; if the reference belongs to another environment, fix the wiring to point at a store emitted for this environment.
Look for conditional or reordered code that skips store emission and ensure the store is always emitted before the environment references it.

Example fix

// before
var env = builder.AddRadiusEnvironment("env").WithSecretStoreReference("missing-store");
// store never declared on this environment

// after
var env = builder.AddRadiusEnvironment("env");
var store = env.AddSealedSecretStore("my-store") /* ... */;
env.WithSecretStoreReference(store);

Defensive patterns

Strategy: validation

Validate before calling

// Before publish: verify every secret-store reference is emitted in the same environment
foreach (var (envName, storeName) in environmentStoreReferences)
{
    if (!emittedStoresByEnvironment[envName].Contains(storeName))
        throw new InvalidOperationException($"Environment '{envName}' references undeclared secret store '{storeName}'.");
}

Prevention

Declare the secret store on the same environment that consumes it, before building the environment resource.
When using multiple environments, keep a shared helper that wires stores and environments together so references cannot drift.
Search publish code for store references after any rename or conditional emission change.

When it happens

Trigger: Calling the Radius publisher when an environment's model references a secret store that was not added to that environment — e.g. an environment built via the Radius infrastructure builder references a store declared under a different environment, or the WithSecretStore-like wiring was done before the store resource was added to the environment's resource set.

Common situations: Splitting resources across multiple environments and forgetting to declare the store on the consuming one; renaming or conditionally omitting the store so the environment reference dangles; refactoring publish code so the store emission runs after/behind a condition while the environment reference is built unconditionally.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/ef4fba8af0474f4f. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Publishing/RadiusInfrastructureBuilder.cs:5672

    /// <c>.id</c> expression.
    /// </summary>
    /// <exception cref="InvalidOperationException">
    /// The store is not emitted for this environment (<c>ASPIRERADIUS050</c>).
    /// </exception>
    private object ResolveSecretStoreReference(
        RadiusSecretStoreResource store,
        IReadOnlyDictionary<string, RadiusSecretStoreConstruct> storeConstructs)
    {
        if (storeConstructs.TryGetValue(store.Name, out var construct))
        {
            return BuildIdExpression(construct);
        }

        // Never fall back to the bare store name: that emits a plain string where a secret-store
        // `.id` is expected, producing a reference Radius rejects only at deploy (or, worse, that
        // silently resolves to nothing). Fail fast with an actionable diagnostic naming the
        // consuming environment and the unresolved store.
        throw new InvalidOperationException(
            $"Environment '{_environment.Name}' references secret store '{store.Name}', but that store is not " +
            "emitted for this environment. Ensure the store is declared on this environment. " +
            "Diagnostic: ASPIRERADIUS050.");
    }

    /// <summary>
    /// Populates a secret-store construct's <c>data</c> for the inline (Radius-created) mode: each
    /// key's value is a reference to a valueless <c>@secure()</c> Bicep <c>param</c> (reusing
    /// <see cref="GetOrAddRecipeParameter"/>), with <c>encoding</c> emitted when the author set it
    /// explicitly or the type default is not <c>raw</c>.
    /// </summary>
    private void PopulateInlineSecretStoreData(RadiusSecretStoreResource store, RadiusSecretStoreConstruct construct)
    {
        if (!store.Population.HasInlineData)
        {
            return;
        }

View on GitHub (pinned to 25830f84bd)