microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS064

ASPIRERADIUS064

Error message

Secret store '{store.Name}' declares no keys, but the recipe environment secret '{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). Diagnostic: ASPIRERADIUS064.

What it means

Thrown for ASPIRERADIUS064 when a key-specific envSecrets consumer (a recipe environment secret selector like 'key@value' referencing a specific key) points at a store that declares no keys at all. Since the store declares nothing, the validator cannot confirm the referenced key will exist, so it fails fast and asks the author to declare the key via WithData or via WithExistingSecret/WithSealedSecret key declarations.

Solutions

Declare the referenced key on the store: use WithData for inline data, or pass keys when calling WithExistingSecret/WithSealedSecret.
If you cannot enumerate keys, use a non-key-specific envSecrets selector instead of a key-specific one.
Verify the store you intended to reference actually got populated (order-of-declaration mistakes are common).

Example fix

// before
store.WithExistingSecret("ns/db-secret"); // no keys declared
recipeSecret.Reference(store, "connectionString");

// after
store.WithExistingSecret("ns/db-secret", keys: new[] { "connectionString" });
recipeSecret.Reference(store, "connectionString");

Defensive patterns

Strategy: validation

Validate before calling

bool KeyIsDeclared(RadiusSecretStoreResource store, string key) =>
    (store.Population.HasInlineData ? store.Population.Data.Keys : store.Population.Keys).Count > 0;

Try / catch

try { ValidateConsumers(...); } catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS064")) { /* declare keys on the store or drop key-specific selector */ }

Prevention

Always enumerate keys when using WithExistingSecret/WithSealedSecret with key-specific consumers.
Never wire key-specific consumers to stores before populating them.
Validate all stores+consumers at startup in tests.

When it happens

Trigger: An envSecrets consumer with a key-specific Selector referencing a store where declaredKeys.Count == 0 — i.e. no WithData inline data and no keys declared for an existing/sealed secret population. Detected in ValidateConsumer.

Common situations: Pointing a key-specific recipe secret at an existing-Secret store without enumerating its keys; assuming the validator/Radius will resolve keys from the live Kubernetes Secret; creating a bare store shell and wiring consumers before populating it.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/830003edf587ea67. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:295

            }
        }

        // ASPIRERADIUS052 / ASPIRERADIUS064 — a key-specific envSecrets consumer must reference a key the
        // store exposes. Emission only exposes explicitly declared keys, so:
        //   * a keyless store (no inline data and no existing/sealed key list) cannot satisfy a
        //     key-specific reference — the emitted envSecrets entry would dangle (ASPIRERADIUS064);
        //   * a store with a non-empty declared set must contain the referenced key (ASPIRERADIUS052).
        // A store with no declared keys that is referenced WITHOUT a specific key is left alone: such a
        // sealed/existing store materializes its keys out-of-band and is intentionally unchecked.
        if (consumer.Kind == RadiusSecretStoreConsumerKind.EnvSecret && consumer.Key is { } key)
        {
            var declaredKeys = store.Population.HasInlineData
                ? store.Population.Data.Keys.ToList()
                : store.Population.Keys;

            if (declaredKeys.Count == 0)
            {
                throw new InvalidOperationException(
                    $"Secret store '{store.Name}' declares no keys, but the recipe environment secret " +
                    $"'{consumer.Selector}' references the key '{key}'. A key-specific envSecrets consumer requires " +
                    "the store to declare that key (via WithData, or WithExistingSecret/WithSealedSecret with keys). " +
                    "Diagnostic: ASPIRERADIUS064.");
            }

            if (!declaredKeys.Contains(key, StringComparer.Ordinal))
            {
                throw new InvalidOperationException(
                    $"Secret store '{store.Name}' does not declare the key '{key}' referenced by the recipe " +
                    $"environment secret '{consumer.Selector}'. Declared keys: {string.Join(", ", declaredKeys)}. " +
                    "Diagnostic: ASPIRERADIUS052.");
            }
        }
    }

    private static string DescribeKind(RadiusSecretStoreConsumerKind kind) => kind switch
    {

View on GitHub (pinned to 25830f84bd)