microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that contains…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that contains a duplicate YAML mapping key '{key}'. Provide a single unambiguous SealedSecret manifest.

What it means

YAML technically permits duplicate keys (many readers apply last-wins), but for a security gate this is dangerous: a document could advertise `kind: SealedSecret` first and then override it with `kind: Secret`. Duplicate keys anywhere in the manifest are therefore rejected.

Solutions

  1. Search the manifest for duplicated keys within each mapping and delete the redundant one, keeping the intended value
  2. Validate with a strict YAML parser (yamllint with key-duplicates rule) before submitting
  3. Regenerate the manifest cleanly rather than merging fragments by hand

Example fix

// before
kind: SealedSecret
kind: Secret
// after
kind: SealedSecret
Defensive patterns

Strategy: validation

Validate before calling

// Detect duplicate keys at one nesting level with a strict parser
var deserializer = new YamlDotNet.Serialization.DeserializerBuilder()
    .WithAttemptingUnquotedStringTypeDeserialization()
    .Build();
// Duplicate keys throw YamlDotNet.Core.YamlException with duplicate-key semantics when configured strict.

Prevention

When it happens

Trigger: ValidateStructure -> RegisterNodeWithParent fails frame.Keys.Add(key) because the same scalar key appears twice within one mapping, e.g. two `kind:` entries after a bad edit or merge.

Common situations: Hand-editing or diff-merging manifests leaving duplicated keys; copy/paste errors; concatenation of overlapping fragments; some tools emitting repeated keys.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/35109d1597158a8a. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:671

                    manifestPath,
                    "uses a non-scalar YAML mapping key. Provide a plain SealedSecret manifest with scalar keys.");
            }

            var key = scalar.Value;
            if (string.Equals(key, "<<", StringComparison.Ordinal))
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "uses YAML merge keys. Provide a self-contained SealedSecret manifest without anchors, aliases, or merge keys.");
            }

            // YAML allows duplicate keys, and some high-level readers keep the last value. For a
            // security gate that rejects plaintext-capable fields, last-wins semantics would let a
            // document advertise `kind: SealedSecret` first and then override it with `kind: Secret`.
            if (!frame.Keys.Add(key))
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    $"contains a duplicate YAML mapping key '{key}'. Provide a single unambiguous SealedSecret manifest.");
            }
        }

        frame.ExpectsKey = !frame.ExpectsKey;
    }

    private static InvalidOperationException CreateInvalidManifestException(
        string storeName, string manifestPath, string reason, Exception? innerException = null) =>
        new(
            $"Secret store '{storeName}' references a SealedSecret manifest at '{manifestPath}' that {reason} " +
            "Diagnostic: ASPIRERADIUS044.",
            innerException);

    private sealed class MappingFrame
    {

View on GitHub (pinned to 25830f84bd)