microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that uses…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that uses YAML aliases. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.

What it means

The parser rejects SealedSecret manifests containing YAML aliases (references like *anchor), because aliases make the document non-self-contained and complicate security validation of secret-bearing fields. A manifest must be a plain, expanded YAML document.

Solutions

Remove all *alias references and inline the referenced content so every value is written out literally
Re-generate the manifest without anchors (avoid anchors when authoring sealed secrets)
If using yq/templating, expand anchors before saving (e.g. `yq eval-all` or an expander tool)

Example fix

// before
spec:
  template: &t
    type: Opaque
spec2:
  template: *t
// after
spec:
  template:
    type: Opaque
spec2:
  template:
    type: Opaque

Defensive patterns

Strategy: validation

Validate before calling

if (File.ReadAllText(manifestPath).Contains('*') &&
    System.Text.RegularExpressions.Regex.IsMatch(File.ReadAllText(manifestPath), "(^|\\s)\\*\\w+", System.Text.RegularExpressions.RegexOptions.Multiline))
    throw new InvalidOperationException("Manifest contains YAML aliases");

Prevention

Avoid YAML anchors/aliases when authoring sealed-secret manifests
Expand anchors with a tool before saving the final manifest
Lint manifests with yamllint (aliases rule) in CI

When it happens

Trigger: ReadMetadataFromYaml -> ValidateStructure's event loop sees an AnchorAlias event anywhere in the manifest while streaming the YAML document.

Common situations: Using YAML anchors with aliases (&config / *config) to deduplicate repeated blocks; templating tools generating aliased documents; copy-pasting manifests that use merge-key aliases.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/1f181b7101cf088b. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:572

            }
        }

        node = null!;
        return false;
    }

    private static void ValidateStructure(string storeName, string manifestPath, string text)
    {
        var parser = new Parser(new StringReader(text));
        var stack = new Stack<MappingFrame>();

        while (parser.MoveNext())
        {
            var yamlEvent = parser.Current;

            if (yamlEvent is AnchorAlias)
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "uses YAML aliases. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.");
            }

            if (yamlEvent is NodeEvent nodeEvent)
            {
                if (!nodeEvent.Anchor.IsEmpty || HasExplicitTag(nodeEvent))
                {
                    throw CreateInvalidManifestException(
                        storeName,
                        manifestPath,
                        "uses YAML anchors or explicit tags. Provide a plain SealedSecret manifest without anchors, aliases, merge keys, or tags.");
                }

                RegisterNodeWithParent(storeName, manifestPath, yamlEvent, stack);
            }

View on GitHub (pinned to 25830f84bd)