microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS068

ASPIRERADIUS068

Error message

Application-scoped Radius secret store(s) '{string.Join("', '", orphaned)}' were declared but the model contains no Radius environment. Application-scoped stores are emitted and deployed by a Radius environment; add one with AddRadiusEnvironment. Diagnostic: ASPIRERADIUS068.

What it means

Validation of the application model (ASPIRERADIUS068) fails when application-scoped Radius secret stores exist but no Radius environment was added to the model. Application-scoped stores are emitted and deployed by a Radius environment, so without one they cannot be materialized. ValidateHasEnvironment collects application-scoped store names and throws listing them.

Solutions

1. Add a Radius environment to the model, e.g. builder.AddRadiusEnvironment("env", ...).
2. Remove or delay the application-scoped secret store if no Radius environment is intended.
3. Ensure any conditional logic guarding AddRadiusEnvironment actually runs.

Example fix

// before
builder.AddRadiusSecretStore("store", scope: RadiusSecretStoreScope.Application);
// after
builder.AddRadiusEnvironment("env", ...);
builder.AddRadiusSecretStore("store", scope: RadiusSecretStoreScope.Application);

if (usesApplicationScopedSecretStores && !model.Resources.OfType<RadiusEnvironmentResource>().Any())
    throw new InvalidOperationException("Add builder.AddRadiusEnvironment(...) before application-scoped secret stores.");

try { /* build/publish model */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS068")) { /* add the environment or drop the stores */ }

When it happens

Trigger: Calling AddRadiusSecretStore with Application scope in an AppHost model that never calls AddRadiusEnvironment; the environment resource was removed or is conditionally skipped.

Common situations: Following a secret-store sample without copying its AddRadiusEnvironment line; refactoring where the environment registration was deleted; feature flags that skip environment setup.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• ASPIRERADIUS040
• ASPIRERADIUS041
• ASPIRERADIUS042
• ASPIRERADIUS043
• ASPIRERADIUS043

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/405fec7f6ca69468. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs:81

    /// </summary>
    internal static void ValidateHasEnvironment(DistributedApplicationModel model)
    {
        ArgumentNullException.ThrowIfNull(model);

        if (model.Resources.OfType<RadiusEnvironmentResource>().Any())
        {
            return;
        }

        var orphaned = model.Resources
            .OfType<RadiusSecretStoreResource>()
            .Where(static s => s.Scope == RadiusSecretStoreScope.Application)
            .Select(static s => s.Name)
            .ToList();

        if (orphaned.Count > 0)
        {
            throw new InvalidOperationException(
                $"Application-scoped Radius secret store(s) '{string.Join("', '", orphaned)}' were declared " +
                "but the model contains no Radius environment. Application-scoped stores are emitted and " +
                "deployed by a Radius environment; add one with AddRadiusEnvironment. Diagnostic: ASPIRERADIUS068.");
        }
    }

    /// <summary>
    /// Validates every declared secret store over the whole application model.
    /// </summary>
    /// <exception cref="InvalidOperationException">
    /// A required key is missing (<c>ASPIRERADIUS040</c>), the population mode count is not
    /// exactly one (<c>ASPIRERADIUS041</c>), an inline key binds a non-secret parameter
    /// (<c>ASPIRERADIUS042</c>), a duplicate key is declared (<c>ASPIRERADIUS043</c>), an
    /// invalid encoding is set for the type (<c>ASPIRERADIUS047</c>), two stores share a
    /// Bicep identifier within the same emitted scope (<c>ASPIRERADIUS048</c>), an
    /// application-scoped existing store uses a namespace-less reference (<c>ASPIRERADIUS055</c>),
    /// or a non-sealed store sets <c>WithMaterializationTimeout</c> (<c>ASPIRERADIUS062</c>).
    /// </exception>

View on GitHub (pinned to 25830f84bd)