RadiusSecretStoreExtensions

1. Docs
2. /Reference
3. /Search C# APIs
4. /Aspire.Hosting.Radius
5. /RadiusSecretStoreExtensions

Classstaticnet10.0

📦 Aspire.Hosting.Radius v13.6.0-preview.1.26478.8

Builder entry points for declaring and populating Radius secret stores ( Applications.Core/secretStores). All surface is experimental and gated by ASPIRERADIUS006.

namespace Aspire.Hosting;

public static class RadiusSecretStoreExtensions
{
    // ...
}

Source

Search members of RadiusSecretStoreExtensions...

7 members

Clear filtersReset all

Methods7

AddRadiusSecretStore(IDistributedApplicationBuilder, string, RadiusSecretStoreType)extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

Declares an application-scoped Radius secret store ( properties.application). Choose the population mode with exactly one of WithData / WithExistingSecret / WithSealedSecret.

WithData(IResourceBuilder<RadiusSecretStoreResource>, Action<RadiusSecretStoreDataBuilder>)extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

Populates the store inline (Radius-created) from Aspire secret parameters. Each key's value is emitted as a valueless @secure() Bicep param and supplied at deploy time via rad deploy --parameters.

WithData(IResourceBuilder<RadiusSecretStoreResource>, string, IResourceBuilder<ParameterResource>, RadiusSecretStoreEncoding?)extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

Populates the store inline (Radius-created) by binding a single data key to a secret parameter. This is a convenience over the callback overload for the common single-key case; the value is emitted as a valueless @secure() Bicep param and supplied at deploy time via rad deploy --parameters. Like the other population methods this may be called at most once per store (a second population call throws ASPIRERADIUS065); use the callback overload to bind multiple keys.

WithExistingSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

References an existing cluster Secret by <namespace>/<name> (or a bare <name>, whose namespace defaults to the owning environment's). No secret value flows through Aspire.

WithMaterializationTimeout(IResourceBuilder<RadiusSecretStoreResource>, TimeSpan)extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

Overrides the per-store timeout for awaiting a sealed Secret to materialize in-cluster before rad deploy (default 120 seconds). The timeout bounds the whole apply→sync-poll→key-verify sequence as a single shared budget, so a stalled kubectl apply or verify call is cancelled with ASPIRERADIUS066 once it is exhausted.

This only affects the sealed-secret deploy path ( WithSealedSecret). Calling it on a store that is not populated with WithSealedSecret is rejected by the validation gate with ASPIRERADIUS062 rather than silently ignored.

WithSealedSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])extensionexperimentalats ignored

IResourceBuilder<RadiusSecretStoreResource>

References the decrypted Secret of a committed, encrypted Bitnami SealedSecret manifest. At publish the manifest is copied alongside the owning group's app.bicep; at deploy it is applied and awaited before rad deploy. The integration never seals plaintext.

WithSecretStore(IResourceBuilder<RadiusEnvironmentResource>, string, RadiusSecretStoreType, Action<IResourceBuilder<RadiusSecretStoreResource>>)extensionexperimentalats ignored

IResourceBuilder<RadiusEnvironmentResource>

Declares an environment-scoped Radius secret store ( properties.environment) on radius and configures it.

View all methods