# RadiusSecretStoreExtensions Methods

- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Type: [RadiusSecretStoreExtensions](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreextensions.md)
- Kind: `Methods`
- Members: `7`

Builder entry points for declaring and populating Radius secret stores ( `Applications.Core/secretStores`). All surface is experimental and gated by `ASPIRERADIUS006`.

<a id="addradiussecretstore"></a>
<a id="addradiussecretstore-idistributedapplicationbuilder-string-radiussecretstoretype"></a>

## AddRadiusSecretStore(IDistributedApplicationBuilder, string, RadiusSecretStoreType)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `AddRadiusSecretStore(IDistributedApplicationBuilder, string, RadiusSecretStoreType)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L61-L88)

Declares an application-scoped Radius secret store ( `properties.application`). Choose the population mode with exactly one of `WithData` / `WithExistingSecret` / `WithSealedSecret`.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> AddRadiusSecretStore(
        this IDistributedApplicationBuilder builder,
        string name,
        RadiusSecretStoreType type)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IDistributedApplicationBuilder`)
  The distributed application builder.
- `name` (`string`)
  The secret-store name (a valid resource-name segment).
- `type` ([RadiusSecretStoreType](/reference/api/csharp/aspire.hosting.radius/radiussecretstoretype.md))
  The Radius secret-store type.

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- A builder for the new [RadiusSecretStoreResource](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreresource.md).

## Exceptions

- `ArgumentException` -- The name is empty/whitespace or not a valid resource-name segment.

## Remarks

The store is emitted and deployed by a Radius environment; the application model must contain at least one environment added with `AddRadiusEnvironment` or publish/deploy fails with `ASPIRERADIUS068`. In Run mode the store is inert and is not surfaced in the dashboard.

Populate the returned store with exactly one of `WithData` (Radius-created from Aspire secret parameters), `WithExistingSecret` (reference a pre-existing Kubernetes Secret), or `WithSealedSecret` (apply a Bitnami SealedSecret manifest).

## Examples

Declare an application-scoped store populated inline from a secret parameter:

```csharp
var builder = DistributedApplication.CreateBuilder(args);
builder.AddRadiusEnvironment("radius");

var apiKey = builder.AddParameter("api-key", secret: true);
builder.AddRadiusSecretStore("appsecrets", RadiusSecretStoreType.Generic)
       .WithData(data => data.Add("apiKey", apiKey));
```

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

<a id="withdata"></a>
<a id="withdata-iresourcebuilder-radiussecretstoreresource-action-radiussecretstoredatabuilder"></a>

## WithData(IResourceBuilder<RadiusSecretStoreResource>, Action<RadiusSecretStoreDataBuilder>)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithData(IResourceBuilder<RadiusSecretStoreResource>, Action<RadiusSecretStoreDataBuilder>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L140-L158)

Populates the store inline (Radius-created) from Aspire secret parameters. Each key's value is emitted as a valueless `@secure()` Bicep `param` and supplied at deploy time via `rad deploy --parameters`.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithData(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        Action<RadiusSecretStoreDataBuilder> configure)
    {
        // ...
    }
}
```

## Parameters

- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret-store builder.
- `configure` (`Action<RadiusSecretStoreDataBuilder>`)
  Callback binding data keys to secret parameters.

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- The same store builder for chaining.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; the data-binding callback is not ATS-compatible.

<a id="withdata-iresourcebuilder-radiussecretstoreresource-string-iresourcebuilder-parameterresource-radiussecretstoreencoding"></a>

## WithData(IResourceBuilder<RadiusSecretStoreResource>, string, IResourceBuilder<ParameterResource>, RadiusSecretStoreEncoding?)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithData(IResourceBuilder<RadiusSecretStoreResource>, string, IResourceBuilder<ParameterResource>, RadiusSecretStoreEncoding?)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L183-L186)

Populates the store inline (Radius-created) by binding a single data `key` to a secret parameter. This is a convenience over the callback overload for the common single-key case; the value is emitted as a valueless `@secure()` Bicep `param` and supplied at deploy time via `rad deploy --parameters`. Like the other population methods this may be called at most once per store (a second population call throws `ASPIRERADIUS065`); use the callback overload to bind multiple keys.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithData(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string key,
        IResourceBuilder<ParameterResource> parameter,
        RadiusSecretStoreEncoding? encoding = null)
    {
        // ...
    }
}
```

## Parameters

- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret-store builder.
- `key` (`string`)
  The data key (non-empty).
- `parameter` (`IResourceBuilder<ParameterResource>`)
  The secret parameter supplying the value (must be `secret: true`).
- `encoding` ([RadiusSecretStoreEncoding?](/reference/api/csharp/aspire.hosting.radius/radiussecretstoreencoding.md)) `optional`
  Optional per-key encoding (defaults to the store type's default).

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- The same store builder for chaining.

## Exceptions

- `ArgumentException` -- The key is empty/whitespace.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; the data binding is not ATS-compatible.

<a id="withexistingsecret"></a>
<a id="withexistingsecret-iresourcebuilder-radiussecretstoreresource-string-string"></a>

## WithExistingSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithExistingSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L205-L219)

References an existing cluster `Secret` by `<namespace>/<name>` (or a bare `<name>`, whose namespace defaults to the owning environment's). No secret value flows through Aspire.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithExistingSecret(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string namespaceAndName,
        params string[] keys)
    {
        // ...
    }
}
```

## Parameters

- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret-store builder.
- `namespaceAndName` (`string`)
  The `<namespace>/<name>` or bare `<name>` reference.
- `keys` (`string[]`)
  The keys to expose from the referenced `Secret`.

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- The same store builder for chaining.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

<a id="withmaterializationtimeout"></a>
<a id="withmaterializationtimeout-iresourcebuilder-radiussecretstoreresource-timespan"></a>

## WithMaterializationTimeout(IResourceBuilder<RadiusSecretStoreResource>, TimeSpan)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithMaterializationTimeout(IResourceBuilder<RadiusSecretStoreResource>, TimeSpan)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L277-L294)

Overrides the per-store timeout for awaiting a sealed `Secret` to materialize in-cluster before `rad deploy` (default 120 seconds). The timeout bounds the whole apply→sync-poll→key-verify sequence as a single shared budget, so a stalled `kubectl apply` or verify call is cancelled with `ASPIRERADIUS066` once it is exhausted.

This only affects the sealed-secret deploy path ( `WithSealedSecret`). Calling it on a store that is not populated with `WithSealedSecret` is rejected by the validation gate with `ASPIRERADIUS062` rather than silently ignored.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithMaterializationTimeout(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        TimeSpan timeout)
    {
        // ...
    }
}
```

## Parameters

- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret-store builder.
- `timeout` (`TimeSpan`)
  A positive materialization timeout, at most `Int32.MaxValue` milliseconds (~24.85 days).

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- The same store builder for chaining.

## Exceptions

- `ArgumentOutOfRangeException` -- `timeout` is not positive or exceeds the supported timer range.

## ATS metadata

### Ignored by ATS

- Reason: Sealed-secret deploy-timing knob with no polyglot ATS equivalent.

<a id="withsealedsecret"></a>
<a id="withsealedsecret-iresourcebuilder-radiussecretstoreresource-string-string"></a>

## WithSealedSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithSealedSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusSecretStoreResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L239-L252)

References the decrypted `Secret` of a committed, encrypted Bitnami `SealedSecret` manifest. At publish the manifest is copied alongside the owning group's `app.bicep`; at deploy it is applied and awaited before `rad deploy`. The integration never seals plaintext.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithSealedSecret(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string manifestPath,
        params string[] keys)
    {
        // ...
    }
}
```

## Parameters

- `store` (`IResourceBuilder<RadiusSecretStoreResource>`)
  The secret-store builder.
- `manifestPath` (`string`)
  Path to the committed encrypted `SealedSecret` manifest.
- `keys` (`string[]`)
  The keys to expose from the decrypted `Secret`.

## Returns

`IResourceBuilder<RadiusSecretStoreResource>` -- The same store builder for chaining.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

<a id="withsecretstore"></a>
<a id="withsecretstore-iresourcebuilder-radiusenvironmentresource-string-radiussecretstoretype-action-iresourcebuilder-radiussecretstoreresource"></a>

## WithSecretStore(IResourceBuilder<RadiusEnvironmentResource>, string, RadiusSecretStoreType, Action<IResourceBuilder<RadiusSecretStoreResource>>)

> **Experimental:** ASPIRERADIUS006 - [Learn more](/diagnostics/aspireradius006/)

- Name: `WithSecretStore(IResourceBuilder<RadiusEnvironmentResource>, string, RadiusSecretStoreType, Action<IResourceBuilder<RadiusSecretStoreResource>>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<RadiusEnvironmentResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L109-L123)

Declares an environment-scoped Radius secret store ( `properties.environment`) on `radius` and configures it.

```csharp
public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusEnvironmentResource> WithSecretStore(
        this IResourceBuilder<RadiusEnvironmentResource> radius,
        string name,
        RadiusSecretStoreType type,
        Action<IResourceBuilder<RadiusSecretStoreResource>> configure)
    {
        // ...
    }
}
```

## Parameters

- `radius` (`IResourceBuilder<RadiusEnvironmentResource>`)
  The Radius environment resource builder.
- `name` (`string`)
  The secret-store name (a valid resource-name segment).
- `type` ([RadiusSecretStoreType](/reference/api/csharp/aspire.hosting.radius/radiussecretstoretype.md))
  The Radius secret-store type.
- `configure` (`Action<IResourceBuilder<RadiusSecretStoreResource>>`)
  Callback selecting the population mode (and optional timeout).

## Returns

`IResourceBuilder<RadiusEnvironmentResource>` -- The same environment builder for chaining.

## Exceptions

- `ArgumentException` -- The name is empty/whitespace or not a valid resource-name segment.

## ATS metadata

### Ignored by ATS

- Reason: Experimental Radius secret-store surface; the population callback is not ATS-compatible.