microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that has no…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that has no metadata mapping with metadata.name.

What it means

The manifest passed the sealed-payload checks but has no 'metadata' mapping (or metadata is not a mapping), so the resource name cannot be read. The store needs metadata.name to apply and track the SealedSecret in the cluster.

Solutions

  1. Add a proper metadata mapping with a name: apiVersion/kind/metadata.name/spec.encryptedData.
  2. Fix indentation so metadata is a sibling of apiVersion and kind at the root level.
  3. Regenerate the manifest with kubeseal, passing --name so metadata.name is set correctly.

Example fix

# before: metadata as scalar
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata: my-secret
# after
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: my-secret
Defensive patterns

Strategy: validation

Validate before calling

if (doc["metadata"]? ["name"] == null) throw new InvalidOperationException("Manifest must define metadata.name");

Try / catch

catch (Exception ex) when (ex.Message.Contains("metadata mapping with metadata.name"))
{
    // add metadata: { name: ... } as a root-level mapping and retry
}

Prevention

When it happens

Trigger: ReadMetadataFromRoot executes after ValidateEncryptedData; TryGetNode(root, "metadata", ...) fails or the metadata node is a scalar/sequence rather than a YamlMappingNode.

Common situations: A hand-trimmed manifest that dropped metadata; metadata misspelled or nested at the wrong indent level; metadata written as a string ('metadata: my-secret') instead of a mapping with a name key.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/09ca51d2af603d4c. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:206

            throw CreateInvalidManifestException(
                storeName,
                manifestPath,
                "contains plaintext-capable spec.template.data or spec.template.stringData values. Seal secret material under spec.encryptedData instead.");
        }

        // A `kubectl.kubernetes.io/last-applied-configuration` annotation records the full JSON of a
        // previously-applied object. Unlike spec.encryptedData it is NOT encrypted, so a plaintext
        // Secret embedded there (top-level metadata, or the templated Secret's metadata) would be
        // copied verbatim into publish artifacts and re-applied — defeating sealing. Reject it.
        RejectPlaintextLastAppliedAnnotation(storeName, manifestPath, root);

        // Runs after the leak gates above so a manifest that both leaks cleartext and has a malformed
        // payload still reports the more specific ASPIRERADIUS063/plaintext diagnostic.
        ValidateEncryptedData(storeName, manifestPath, root);

        if (!TryGetNode(root, "metadata", out var metadataNode) || metadataNode is not YamlMappingNode metadata)
        {
            throw CreateInvalidManifestException(
                storeName,
                manifestPath,
                "has no metadata mapping with metadata.name.");
        }

        var name = ReadScalar(metadata, "name");
        if (string.IsNullOrWhiteSpace(name))
        {
            throw new InvalidOperationException(
                $"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that has " +
                "no metadata.name. Diagnostic: ASPIRERADIUS044.");
        }

        var ns = ReadScalar(metadata, "namespace");
        var namespaceWasExplicit = !string.IsNullOrWhiteSpace(ns);

        // The resulting Secret is applied with `kubectl apply`, which enforces Kubernetes naming: the
        // name must be a DNS-1123 subdomain and any explicit namespace a DNS-1123 label. Validate here

View on GitHub (pinned to 25830f84bd)