microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS051

ASPIRERADIUS051

Error message

Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is referenced as a {DescribeKind(consumer.Kind)} consumer, which requires a '{RadiusSecretStoreType.BasicAuthentication.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS051.

What it means

Thrown for ASPIRERADIUS051 when a Bicep private-registry auth consumer references a secret store whose type is not BasicAuthentication. Bicep registry authentication expects username/password credentials matching the OCI registry credential shape, which only a basicAuthentication store provides. envSecrets consumers are unconstrained, so this only applies to the BicepRegistryAuth consumer kind.

Solutions

Change the referenced store's type to RadiusSecretStoreType.BasicAuthentication (username/password).
Create a new basicAuthentication store populated with the registry username/password and point the consumer at it instead.
If the credentials must live in a generic store, reference them differently (e.g. as envSecrets) rather than as registry auth.

Example fix

// before
var store = radius.AddSecretStore("registry", t => t.WithType(RadiusSecretStoreType.Generic))...;
registryAuth.WithSecretStore(store);

// after
var store = radius.AddSecretStore("registry", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))
    .WithData("username", user).WithData("password", pass);
registryAuth.WithSecretStore(store);

Defensive patterns

Strategy: validation

Validate before calling

bool SupportsRegistryAuth(RadiusSecretStoreResource store, RadiusSecretStoreConsumer consumer) =>
    consumer.Kind != RadiusSecretStoreConsumerKind.BicepRegistryAuth || store.Type == RadiusSecretStoreType.BasicAuthentication;

Try / catch

try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS051")) { /* re-point consumer at a basicAuthentication store */ }

Prevention

Keep one dedicated basicAuthentication store for Bicep registry auth.
Do not reuse generic envSecrets stores as registry-auth sources.
Validate store/consumer wiring in unit tests before deploy.

When it happens

Trigger: Registering a consumer with Kind == RadiusSecretStoreConsumerKind.BicepRegistryAuth against a store whose RadiusSecretStoreType is anything other than BasicAuthentication (e.g. a generic store). Detected in ValidateConsumer.

Common situations: Pointing Bicep registry auth at a generic store that holds the password as a single key; reusing an existing generic envSecrets store for registry auth; forgetting to change the store type after switching a consumer from envSecrets to registry auth.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/0b3ca65b8bd29e74. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:251

            foreach (var consumer in annotation.Consumers)
            {
                ValidateConsumer(consumer);
            }
        }
    }

    private static void ValidateConsumer(RadiusSecretStoreConsumer consumer)
    {
        var store = consumer.Store;

        // ASPIRERADIUS051 — a Bicep private-registry auth consumer references a basicAuthentication
        // (username/password) store, matching the OCI registry credential shape. envSecrets can source
        // from any type, so it is unconstrained here (its per-key check is below).
        if (consumer.Kind == RadiusSecretStoreConsumerKind.BicepRegistryAuth &&
            store.Type != RadiusSecretStoreType.BasicAuthentication)
        {
            throw new InvalidOperationException(
                $"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is referenced as a " +
                $"{DescribeKind(consumer.Kind)} consumer, which requires a '{RadiusSecretStoreType.BasicAuthentication.ToRadiusTypeString()}' store. " +
                "Diagnostic: ASPIRERADIUS051.");
        }

        // ASPIRERADIUS051 — a Terraform Git PAT consumer references a store that must expose a 'pat' key
        // (optionally with 'username'); this is the shape Radius reads for
        // recipeConfig.terraform.authentication.git.pat, and it is typically a 'generic' store — NOT a
        // basicAuthentication (username/password) store, whose 'password' key Radius never consumes here.
        // See https://docs.radapp.io/guides/recipes/terraform/howto-private-registry/. Only enforce when
        // the store declares its keys inline/explicitly; an existing/sealed store that materializes keys
        // out-of-band is left unchecked (consistent with the envSecrets keyless handling below).
        if (consumer.Kind == RadiusSecretStoreConsumerKind.TerraformGitPat)
        {
            var declaredKeys = store.Population.HasInlineData
                ? store.Population.Data.Keys.ToList()
                : store.Population.Keys;

View on GitHub (pinned to 25830f84bd)