microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that is…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that is malformed YAML with an unbalanced mapping. Provide a single well-formed encrypted Bitnami SealedSecret document.

What it means

The structural validator tracks MappingStart/MappingEnd pairs on a stack. Receiving a MappingEnd without a matching open mapping means the YAML event stream is unbalanced (malformed), so the code fails with this explicit error instead of a raw Stack.Pop() InvalidOperationException.

Solutions

Validate the YAML with a standard parser (e.g. `yq .` or yamllint) to find the unbalanced mapping and fix indentation/structure
Re-export or regenerate the manifest as a single well-formed SealedSecret document
Check the file wasn't truncated or concatenated (paste of multiple documents, stray characters at EOF)

Example fix

// before (extra closing mapping)
kind: SealedSecret
}
// after
kind: SealedSecret
metadata:
  name: mystore

Defensive patterns

Strategy: validation

Validate before calling

try { new YamlDotNet.RepresentationModel.YamlStream().Load(new StringReader(File.ReadAllText(manifestPath))); }
catch (Exception ex) { throw new InvalidOperationException($"{manifestPath} is not well-formed YAML: {ex.Message}"); }

Prevention

Parse the manifest with a YAML parser before handing it to the app host
Avoid manual edits/concatenation of YAML documents
Check file integrity after transfer (no truncation, BOM, or stray characters)

When it happens

Trigger: ReadMetadataFromYaml -> ValidateStructure pops a MappingFrame on SequenceEnd... rather on MappingEnd when the stack is empty — an extra mapping close from a corrupted or truncated document stream.

Common situations: Manifest truncated or corrupted in transit; a parser misconfiguration producing mismatched events; file encoding or BOM issues breaking event pairing; programmatic YAML emission with mismatched start/end writes.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/2497e94572fc4c9c. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:602

                        manifestPath,
                        "uses YAML anchors or explicit tags. Provide a plain SealedSecret manifest without anchors, aliases, merge keys, or tags.");
                }

                RegisterNodeWithParent(storeName, manifestPath, yamlEvent, stack);
            }

            if (yamlEvent is MappingStart)
            {
                stack.Push(new MappingFrame());
            }
            else if (yamlEvent is MappingEnd)
            {
                // A well-formed stream always pairs MappingStart/MappingEnd, but guard the pop so a
                // malformed or out-of-sync event stream fails as ASPIRERADIUS044 rather than escaping
                // ValidateStructure as a raw InvalidOperationException from Stack.Pop() on an empty stack.
                if (stack.Count == 0)
                {
                    throw CreateInvalidManifestException(
                        storeName,
                        manifestPath,
                        "is malformed YAML with an unbalanced mapping. Provide a single well-formed encrypted Bitnami SealedSecret document.");
                }

                stack.Pop();
            }
            else if (yamlEvent is SequenceStart)
            {
                stack.Push(MappingFrame.s_sequence);
            }
            else if (yamlEvent is SequenceEnd)
            {
                if (stack.Count == 0)
                {
                    throw CreateInvalidManifestException(
                        storeName,
                        manifestPath,

View on GitHub (pinned to 25830f84bd)