microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS055

ASPIRERADIUS055

Error message

Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' without a namespace. Application-scoped stores have no owning environment to default the namespace from; use a fully-qualified '<namespace>/<name>' reference. Diagnostic: ASPIRERADIUS055.

What it means

Thrown for ASPIRERADIUS055 when an application-scoped secret store references an existing Kubernetes Secret by a bare name with no namespace. Application-scoped stores have no owning environment from which a namespace could be defaulted, so a '<name>' reference is ambiguous. The validator requires the fully-qualified '<namespace>/<name>' form for such references.

Solutions

Change the reference to a fully-qualified '<namespace>/<name>' string, e.g. "my-namespace/my-secret".
Alternatively scope the store to an environment instead of the application so the namespace can be defaulted.
Inline the secret data (WithData) if you do not actually need an external Secret reference.

Example fix

// before
.WithExistingSecret("db-password")

// after
.WithExistingSecret("my-namespace/db-password");

Defensive patterns

Strategy: validation

Validate before calling

bool IsQualifiedReference(string reference) => reference.Contains('/', StringComparison.Ordinal);
// use with application-scoped existing-secret references

Try / catch

try { ValidateSecretStore(store); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS055")) { /* prompt for namespace-qualified reference */ }

Prevention

Always use '<namespace>/<name>' form for existing-Secret references in application-scoped stores.
Never rely on implicit namespace defaulting when store scope is Application.
Centralize reference formatting in a helper that takes an explicit namespace argument.

When it happens

Trigger: Building a store with store.Scope == RadiusSecretStoreScope.Application, populating it with WithExistingSecret (population.HasExistingSecret) where population.ResourceReference (e.g. "my-secret") contains no '/' character. Checked in ValidateStore.

Common situations: Copying a store configuration from an environment-scoped store (where the environment supplies the namespace) into an application-scoped one; assuming the application's own namespace is used by default; renaming stores/scopes during refactoring.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/8680a15cdebd192b. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:207

        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)
        {
            throw new InvalidOperationException(
                $"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with " +
                "WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the " +
                "call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.");
        }

        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,
        // so a bare '<name>' reference has no deterministic namespace to default to (it would otherwise
        // fall back to whichever environment happens to build the store). Require a fully-qualified
        // '<namespace>/<name>' reference. Sealed stores are checked after their manifest metadata is read
        // because only then can we tell whether metadata.namespace was explicit or defaulted.
        if (store.Scope == RadiusSecretStoreScope.Application &&
            population.HasExistingSecret &&
            population.ResourceReference is { } reference &&
            !reference.Contains('/', StringComparison.Ordinal))
        {
            throw new InvalidOperationException(
                $"Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' " +
                "without a namespace. Application-scoped stores have no owning environment to default the " +
                "namespace from; use a fully-qualified '<namespace>/<name>' reference. " +
                "Diagnostic: ASPIRERADIUS055.");
        }
    }

    /// <summary>
    /// Validates every recorded secret-store consumer wiring across the model.
    /// </summary>
    /// <exception cref="InvalidOperationException">
    /// A consumer kind is incompatible with the store type (<c>ASPIRERADIUS051</c>), an
    /// <c>envSecrets</c> consumer references a key the store does not declare
    /// (<c>ASPIRERADIUS052</c>), or a key-specific <c>envSecrets</c> consumer references a store
    /// that declares no keys (<c>ASPIRERADIUS064</c>).
    /// </exception>
    private static void ValidateConsumers(DistributedApplicationModel model)
    {

View on GitHub (pinned to 25830f84bd)