microsoft/aspire · error · ArgumentException

ASPIRERADIUS067

ASPIRERADIUS067

Error message

Secret data key '{key}' is invalid. A Kubernetes Secret key must be 1-253 characters, may contain only alphanumeric characters, '-', '_', or '.', and may not be '.' or '..' or start with '..'. Diagnostic: ASPIRERADIUS067.

What it means

Kubernetes Secret data keys have strict rules: 1-253 characters, only alphanumeric characters, '-', '_', or '.', and may not be '.', '..', or start with '..'. Rather than failing only when the store is applied to the cluster, ValidateKeys rejects invalid keys at the API boundary with diagnostic ASPIRERADIUS067.

Solutions

1. Rename the key to contain only [A-Za-z0-9-_.] and be 1-253 characters
2. Replace path separators with '-' or '_' (e.g. 'config-app-json')
3. Sanitize keys programmatically before passing them to WithData

Example fix

// before
.WithData("config/app.json", secretValue)
// after
.WithData("config-app-json", secretValue)

static bool IsValidSecretKey(string key) => key.Length is >= 1 and <= 253 && System.Text.RegularExpressions.Regex.IsMatch(key, "^(?!\.\.?[A-Za-z0-9_.-])[A-Za-z0-9_.-]+$") && key is not "." and not "..";

try { store.WithData(key, value); } catch (ArgumentException ex) when (ex.Message.Contains("ASPIRERADIUS067")) { logger.LogError(ex, "Invalid secret key '{Key}'", key); throw; }

When it happens

Trigger: Calling WithData/WithSealedSecret (via validatedKeys/ValidateKeys) with a key containing '/', a leading '..', an empty or whitespace key, or a key longer than 253 characters.

Common situations: Using file paths ('config/app.json') as secret keys; copying Windows-style names with backslashes; deriving keys from arbitrary environment variable or database column names.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• ASPIRERADIUS046
• ASPIRERADIUS042
• ASPIRERADIUS055
• ASPIRERADIUS061
• ASPIRERADIUS065

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/2a6ce555e0269481. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs:311

        store.Resource.MaterializationTimeoutWasSet = true;
        return store;
    }

    // Validates every key without mutating the store's population, so a later invalid key cannot
    // leave the population partially assigned (which would then trip the ASPIRERADIUS065 guard on a
    // corrected retry). Returns the validated keys for the caller to commit atomically.
    private static List<string> ValidateKeys(string[] keys)
    {
        ArgumentNullException.ThrowIfNull(keys);
        foreach (var key in keys)
        {
            ArgumentException.ThrowIfNullOrWhiteSpace(key, nameof(keys));

            // A Secret data key that is not a valid Kubernetes key (e.g. 'bad/key') would only be
            // rejected when the store is applied to the cluster; fail at the API boundary instead.
            if (!KubernetesName.IsValidSecretDataKey(key))
            {
                throw new ArgumentException(
                    $"Secret data key '{key}' is invalid. A Kubernetes Secret key must be 1-253 characters, may contain only " +
                    "alphanumeric characters, '-', '_', or '.', and may not be '.' or '..' or start with '..'. " +
                    "Diagnostic: ASPIRERADIUS067.",
                    nameof(keys));
            }
        }

        return [.. keys];
    }

    // Validates that an existing-secret reference is either a bare Kubernetes object name or exactly
    // one '<namespace>/<name>' pair, and that each segment is a valid Kubernetes name. Radius's
    // Kubernetes secret-store parser rejects anything else at deploy time, so validating at the API
    // boundary keeps the failure fast and local. Accepted:  'db-creds', 'app/db-creds'. Rejected:
    // '/secret' (empty namespace), 'namespace/' (empty name), 'a/b/c' (more than one separator), and
    // names that are not DNS-1123-conformant (e.g. 'App_Creds', 'UPPER').
    private static string ValidateSecretReference(string namespaceAndName)
    {

View on GitHub (pinned to 25830f84bd)