microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS062

ASPIRERADIUS062

Error message

Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.

What it means

Thrown for ASPIRERADIUS062 when a secret store sets a materialization timeout but is not populated via WithSealedSecret. The materialization timeout only affects the sealed-secret deploy path, which awaits the SealedSecret controller; on any other population mode (inline data, existing secret, etc.) it would silently do nothing. The validator rejects the explicit override rather than let the author be misled into thinking it applies.

Solutions

Remove the WithMaterializationTimeout call from the store.
If a deploy-time timeout is genuinely needed, populate the store with WithSealedSecret so the timeout applies to the SealedSecret controller await.
Adjust application-side timeout settings if the intent was to limit secret retrieval at runtime instead.

Example fix

// before
store.WithData("key", "value")
     .WithMaterializationTimeout(TimeSpan.FromMinutes(5));

// after
store.WithData("key", "value"); // timeout removed: only meaningful with WithSealedSecret

Defensive patterns

Strategy: validation

Validate before calling

// Before building the store, assert the pairing.
if (useSealedSecret) store = store.WithSealedSecret(path).WithMaterializationTimeout(timeout);
else store = store.WithData(...); // no timeout call

Try / catch

try { ValidateSecretStore(store); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS062")) { /* strip WithMaterializationTimeout and rebuild without it */ }

Prevention

Treat WithMaterializationTimeout as exclusively paired with WithSealedSecret.
When removing sealed-secret population from a store, grep for leftover timeout calls.
Add a unit test that validates all store definitions in the AppHost.

When it happens

Trigger: Calling WithMaterializationTimeout on a RadiusSecretStoreResource whose population comes from anything other than WithSealedSecret — e.g. WithData/inline data or WithExistingSecret. Detected in ValidateStore as store.MaterializationTimeoutWasSet && !population.HasSealedSecret.

Common situations: Adding a timeout 'just in case' on stores populated with inline data; migrating a store away from sealed secrets and leaving the timeout call behind; misunderstanding the flag as a general secret-fetch timeout.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/9818847f335b2ec5. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:191

                        $"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. " +
                        "Diagnostic: ASPIRERADIUS042.");
                }

                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))
                {
                    throw new InvalidOperationException(
                        $"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is " +
                        $"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.");
                }
            }
        }

        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,
        // which awaits the SealedSecret controller. On any other population mode it would silently
        // no-op, so reject an explicit override rather than mislead the author.
        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)
        {
            throw new InvalidOperationException(
                $"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with " +
                "WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the " +
                "call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.");
        }

        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,
        // so a bare '<name>' reference has no deterministic namespace to default to (it would otherwise
        // fall back to whichever environment happens to build the store). Require a fully-qualified
        // '<namespace>/<name>' reference. Sealed stores are checked after their manifest metadata is read
        // because only then can we tell whether metadata.namespace was explicit or defaulted.
        if (store.Scope == RadiusSecretStoreScope.Application &&
            population.HasExistingSecret &&
            population.ResourceReference is { } reference &&
            !reference.Contains('/', StringComparison.Ordinal))
        {
            throw new InvalidOperationException(
                $"Application-scoped secret store '{store.Name}' references the existing Secret '{reference}' " +
                "without a namespace. Application-scoped stores have no owning environment to default the " +

View on GitHub (pinned to 25830f84bd)