microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that does not…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.

What it means

The manifest parses as YAML but its top-level node is not a mapping (YAML object). A valid SealedSecret document must be an object with apiVersion/kind/metadata/spec keys; sequences or scalars at the root cannot carry the required metadata.

Solutions

Ensure the file's root is a single YAML mapping starting with 'apiVersion: bitnami.com/v1alpha1' and 'kind: SealedSecret'.
Re-generate the manifest with kubeseal instead of hand-editing indentation.
Check you referenced the intended manifest path for the store, not an unrelated YAML file.
Lint the file (yamllint) to see how the document root parses.

Example fix

# before: root is a sequence
- apiVersion: bitnami.com/v1alpha1
  kind: SealedSecret
# after: root is a mapping
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: my-secret

Defensive patterns

Strategy: validation

Validate before calling

// quick structural check
if (!text.TrimStart().StartsWith("apiVersion:")) throw new InvalidOperationException("Manifest root must be a YAML mapping");

Try / catch

catch (Exception ex) when (ex.Message.Contains("YAML mapping as its root"))
{
    // verify file content; regenerate with kubeseal
}

Prevention

Start manifests at column 0 with apiVersion/kind — never make the root a list or scalar.
Don't point stores at values/list files with a .yaml extension.
Regenerate manifests with kubeseal rather than hand-editing structure.

When it happens

Trigger: ReadMetadataFromYaml casts stream.Documents[0].RootNode to YamlMappingNode; the cast fails because the root is a YamlSequenceNode ('- item' list) or a scalar (plain string/number).

Common situations: Pointing the store at the wrong file (e.g. a values list or a plain text blob saved with .yaml extension); a hand-edited manifest whose indentation collapsed the object into a scalar or list.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/843d5335decae95c. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:130

    {
        try
        {
            ValidateStructure(storeName, manifestPath, text);

            var stream = new YamlStream();
            stream.Load(new StringReader(text));

            if (stream.Documents.Count != 1)
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.");
            }

            if (stream.Documents[0].RootNode is not YamlMappingNode root)
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.");
            }

            return ReadMetadataFromRoot(storeName, manifestPath, defaultNamespace, root);
        }
        catch (YamlException ex)
        {
            throw CreateInvalidManifestException(
                storeName,
                manifestPath,
                "is malformed YAML or uses unsupported YAML features.",
                ex);
        }
    }

    private static Metadata ReadMetadataFromRoot(

View on GitHub (pinned to 25830f84bd)