microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS058

ASPIRERADIUS058

Error message

The SealedSecret '{ns}/{name}' referenced by sealed secret store '{storeName}' failed to sync generation {appliedGeneration}: {decision.Message}. Diagnostic: ASPIRERADIUS058.

What it means

After applying a SealedSecret, the step polls the controller for the applied generation. When the sync decision is SealedSecretSyncDecisionKind.Failed, ASPIRERADIUS058 is thrown with the controller's own failure message. This means the Sealed Secrets controller processed the resource but could not decrypt or materialize it into a Secret.

Solutions

1. Read decision.Message in the error for the controller's root cause and fix accordingly (usually re-seal the secret).
2. Re-seal the secret with kubeseal using the current controller certificate of the target cluster: `kubeseal --fetch-cert > pub-cert.pem` then seal with it.
3. Verify the Sealed Secrets controller is healthy (`kubectl -n kube-system get pods -l name=sealed-secrets-controller`) and its version matches the kubeseal used.

Example fix

// before
kubeseal -f secret.yaml -o yaml   # sealed against old/other cluster cert

// after
kubeseal --controller-namespace kube-system --fetch-cert > pub-cert.pem
kubeseal -f secret.yaml --cert pub-cert.pem -o yaml

// Pre-flight: verify the controller cert matches what was used to seal
var cert = await Process.RunAsync("kubeseal", "--fetch-cert");
if (cert.ExitCode != 0) throw new InvalidOperationException("Sealed Secrets controller unreachable or cert unavailable; re-seal with the current cert.");

// Catch sync failure and prompt re-sealing
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS058"))
{
    logger.LogError("SealedSecret failed to sync; re-seal the secret with the target cluster's current controller cert. {Message}", ex.Message);
    throw;
}

When it happens

Trigger: WaitForSealedSecretSyncedAsync (called from ApplyStoreAsync) observes a Failed decision for generation appliedGeneration — the controller reports a sync error such as decryption failure (wrong sealed-secret cert/key), invalid encryptedData, or a missing secret-key annotation.

Common situations: kubeseal sealed against a different cluster's controller certificate than the target cluster; controller certificate rotated after sealing; corrupted/truncated encryptedData; unsupported sealed-secrets controller version.

Related errors

• ASPIRERADIUS061
• A ConfigureRadiusInfrastructure callback left container
• ASPIRERADIUS046
• ASPIRERADIUS055
• ASPIRERADIUS063

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/37a41c4bca1bb5f8. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Publishing/SealedSecretApplyStep.cs:298

                cancellationToken,
                () => CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout))
                .ConfigureAwait(false);
            var decision = EvaluateSealedSecretSync(status, appliedGeneration);
            if (decision.Kind == SealedSecretSyncDecisionKind.Synced)
            {
                if (await InvokeProbeWithRemainingBudgetAsync(
                    secretExists,
                    RemainingBudget(deadline),
                    cancellationToken,
                    () => CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout))
                    .ConfigureAwait(false))
                {
                    return;
                }
            }
            else if (decision.Kind == SealedSecretSyncDecisionKind.Failed)
            {
                throw new InvalidOperationException(
                    $"The SealedSecret '{ns}/{name}' referenced by sealed secret store '{storeName}' " +
                    $"failed to sync generation {appliedGeneration}: {decision.Message}. Diagnostic: ASPIRERADIUS058.");
            }

            var remaining = RemainingBudget(deadline);
            if (remaining <= TimeSpan.Zero)
            {
                throw CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout);
            }

            try
            {
                await Task.Delay(remaining < interval ? remaining : interval, cancellationToken).ConfigureAwait(false);
            }
            catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
            {
                throw CreateSealedSecretSyncTimeoutException(storeName, ns, name, appliedGeneration, timeout);
            }

View on GitHub (pinned to 25830f84bd)