microsoft/aspire · error · InvalidOperationException

Secret store ' ' references a manifest at ' ' that contains…

Error message

Secret store '{storeName}' references a manifest at '{manifestPath}' that contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.

What it means

When reading a sealed secret manifest for store metadata, the YAML parser found more than one document in the file. The library only accepts exactly one encrypted Bitnami SealedSecret document per manifest, because a store maps to a single resource.

Solutions

  1. Split the file so each SealedSecret lives in its own manifest and point the store at the single-document file.
  2. Remove extra documents, including empty ones created by stray '---' separators.
  3. If multiple secrets are needed, define multiple sealed secret stores, one per manifest.
  4. Validate with 'yamllint' or 'kubectl create --dry-run=client -f file.yaml' to count documents before referencing it.

Example fix

// before: one file, two documents
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
...second secret...
// after: single document per store manifest
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: my-secret
spec:
  encryptedData:
    key: AgB...
Defensive patterns

Strategy: validation

Validate before calling

// Count documents before use
var docs = File.ReadAllText(path).Split("\n---").Count(d => !string.IsNullOrWhiteSpace(d));
if (docs != 1) throw new InvalidOperationException($"{path} must contain exactly one YAML document");

Try / catch

catch (Exception ex) when (ex.Message.Contains("multiple YAML documents"))
{
    // split the file into single-document manifests and update the store path
}

Prevention

When it happens

Trigger: ReadMetadataFromYaml loads the manifest text with YamlStream and stream.Documents.Count != 1 (e.g. '---' separated documents or a leading '---' creating an empty extra doc).

Common situations: Concatenated manifests produced by piping multiple kubeseal outputs into one file; multi-resource YAML shared with kubectl apply -f; an accidental leading/trailing '---' creating an empty document.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/f6714856762576d3. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs:122

    /// (<c>ASPIRERADIUS063</c>).
    /// </exception>
    internal static Metadata ReadMetadata(
        string storeName, string manifestPath, string defaultNamespace) =>
        ReadValidated(storeName, manifestPath, defaultNamespace).Metadata;

    private static Metadata ReadMetadataFromYaml(
        string storeName, string manifestPath, string defaultNamespace, string text)
    {
        try
        {
            ValidateStructure(storeName, manifestPath, text);

            var stream = new YamlStream();
            stream.Load(new StringReader(text));

            if (stream.Documents.Count != 1)
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "contains multiple YAML documents. Provide a single encrypted Bitnami SealedSecret document.");
            }

            if (stream.Documents[0].RootNode is not YamlMappingNode root)
            {
                throw CreateInvalidManifestException(
                    storeName,
                    manifestPath,
                    "does not have a YAML mapping as its root. Provide a single encrypted Bitnami SealedSecret object.");
            }

            return ReadMetadataFromRoot(storeName, manifestPath, defaultNamespace, root);
        }
        catch (YamlException ex)
        {
            throw CreateInvalidManifestException(

View on GitHub (pinned to 25830f84bd)