microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS052

ASPIRERADIUS052

Error message

Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe environment secret '{consumer.Selector}'. Declared keys: {string.Join(", ", declaredKeys)}. Diagnostic: ASPIRERADIUS052.

What it means

Thrown for ASPIRERADIUS052 when a key-specific envSecrets consumer references a key that the store does declare some keys for, but not the one requested. This is a case-sensitive (ordinal) check against the declared key list. It ensures recipe environment secrets can only reference keys the store explicitly exposes.

Solutions

Fix the consumer selector to use the exact declared key name (watch casing).
Add the missing key to the store's declared keys (WithData or key list on WithExistingSecret/WithSealedSecret).
Print/log store.Population keys during development to compare against the selector.

Example fix

// before
recipeSecret.Reference(store, "connectionstring"); // store declares "connectionString"

// after
recipeSecret.Reference(store, "connectionString");

Defensive patterns

Strategy: validation

Validate before calling

bool ExactKeyDeclared(RadiusSecretStoreResource store, string key) =>
    (store.Population.HasInlineData ? store.Population.Data.Keys : store.Population.Keys)
        .Contains(key, StringComparer.Ordinal);

Try / catch

try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS052")) { /* correct the selector casing/spelling to a declared key */ }

Prevention

Copy key names from the actual Secret rather than typing from memory (case-sensitive).
Keep a single constant source of key names shared between store and consumer code.
Compare declared keys vs selectors in a startup validation test.

When it happens

Trigger: An envSecrets consumer whose Selector resolves to key 'key' where declaredKeys is non-empty but does not contain 'key' (ordinal comparison) — e.g. the store declares 'Password' but the consumer asks for 'password'. Detected in ValidateConsumer.

Common situations: Case mismatches between the Kubernetes Secret's actual key names and the selector; typos in key names; a Secret's keys were renamed upstream while the consumer selector stayed stale.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/8f7f1a8b6a8c580c. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:304

        // sealed/existing store materializes its keys out-of-band and is intentionally unchecked.
        if (consumer.Kind == RadiusSecretStoreConsumerKind.EnvSecret && consumer.Key is { } key)
        {
            var declaredKeys = store.Population.HasInlineData
                ? store.Population.Data.Keys.ToList()
                : store.Population.Keys;

            if (declaredKeys.Count == 0)
            {
                throw new InvalidOperationException(
                    $"Secret store '{store.Name}' declares no keys, but the recipe environment secret " +
                    $"'{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires " +
                    "the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). " +
                    "Diagnostic: ASPIRERADIUS064.");
            }

            if (!declaredKeys.Contains(key, StringComparer.Ordinal))
            {
                throw new InvalidOperationException(
                    $"Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe " +
                    $"environment secret '{consumer.Selector}'. Declared keys: {string.Join(", ", declaredKeys)}. " +
                    "Diagnostic: ASPIRERADIUS052.");
            }
        }
    }

    private static string DescribeKind(RadiusSecretStoreConsumerKind kind) => kind switch
    {
        RadiusSecretStoreConsumerKind.BicepRegistryAuth => "Bicep registry authentication",
        RadiusSecretStoreConsumerKind.TerraformGitPat => "Terraform Git PAT authentication",
        RadiusSecretStoreConsumerKind.EnvSecret => "recipe environment secret",
        _ => kind.ToString(),
    };

    /// <summary>Validates that an application-scoped sealed store has deterministic manifest namespace metadata.</summary>
    /// <exception cref="InvalidOperationException">
    /// The store is application-scoped and its sealed manifest omitted <c>metadata.namespace</c> (<c>ASPIRERADIUS055</c>).

View on GitHub (pinned to 25830f84bd)