microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that is…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that is malformed YAML with an unbalanced sequence. Provide a single well-formed encrypted Bitnami SealedSecret document.

What it means

Like mappings, SequenceStart/SequenceEnd events must pair up. An unbalanced sequence close in the manifest's event stream triggers this error instead of an internal exception, signaling malformed YAML rather than a valid SealedSecret document.

Solutions

Run the file through yamllint or `yq` to locate the unbalanced sequence and repair it
Regenerate the SealedSecret manifest as a single well-formed document
Inspect the file for accidental duplication/concatenation of documents that unbalances brackets

Example fix

// before
spec:
  encryptedData: [key1, key2
// after
spec:
  encryptedData:
    key1: "AgA...=="
    key2: "AgB...=="

Defensive patterns

Strategy: validation

Validate before calling

try { new YamlDotNet.RepresentationModel.YamlStream().Load(new StringReader(File.ReadAllText(manifestPath))); }
catch (Exception ex) { throw new InvalidOperationException($"{manifestPath} has unbalanced YAML structure: {ex.Message}"); }

Prevention

Close all flow-style sequences `[...]` and block sequences consistently
Lint with yamllint before use
Regenerate manifests from tools instead of hand-joining fragments

When it happens

Trigger: ReadMetadataFromYaml -> ValidateStructure handles a SequenceEnd event while the frame stack is empty, i.e. a `]`-style sequence terminator with no open sequence.

Common situations: Malformed flow-style sequences `[a, b` left unclosed then closed later; corrupted file transfer; generator bugs emitting extra sequence ends.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/f46af251dc9a2df5. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:618

                if (stack.Count == 0)
                {
                    throw CreateInvalidManifestException(
                        storeName,
                        manifestPath,
                        "is malformed YAML with an unbalanced mapping. Provide a single well-formed encrypted Bitnami SealedSecret document.");
                }

                stack.Pop();
            }
            else if (yamlEvent is SequenceStart)
            {
                stack.Push(MappingFrame.s_sequence);
            }
            else if (yamlEvent is SequenceEnd)
            {
                if (stack.Count == 0)
                {
                    throw CreateInvalidManifestException(
                        storeName,
                        manifestPath,
                        "is malformed YAML with an unbalanced sequence. Provide a single well-formed encrypted Bitnami SealedSecret document.");
                }

                stack.Pop();
            }
        }
    }

    private static bool HasExplicitTag(NodeEvent nodeEvent) =>
        !nodeEvent.Tag.IsEmpty &&
        !string.Equals(nodeEvent.Tag.Value, "!", StringComparison.Ordinal);

    private static void RegisterNodeWithParent(
        string storeName, string manifestPath, ParsingEvent yamlEvent, Stack<MappingFrame> stack)
    {
        if (stack.Count == 0)

View on GitHub (pinned to 25830f84bd)