RadiusSecretStoreExtensions Methods

1. Docs
2. /Reference
3. /Search C# APIs
4. /Aspire.Hosting.Radius
5. /RadiusSecretStoreExtensions
6. /Methods

ClassMethods7 members

Builder entry points for declaring and populating Radius secret stores ( Applications.Core/secretStores). All surface is experimental and gated by ASPIRERADIUS006.

Experimental — ASPIRERADIUS006

AddRadiusSecretStore(IDistributedApplicationBuilder, string, RadiusSecretStoreType)extensionIResourceBuilder<RadiusSecretStoreResource>

Declares an application-scoped Radius secret store ( properties.application). Choose the population mode with exactly one of WithData / WithExistingSecret / WithSealedSecret.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> AddRadiusSecretStore(
        this IDistributedApplicationBuilder builder,
        string name,
        RadiusSecretStoreType type)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L61-L88

Parameters

builderIDistributedApplicationBuilderThe distributed application builder.

namestringThe secret-store name (a valid resource-name segment).

typeRadiusSecretStoreTypeThe Radius secret-store type.

Returns

IResourceBuilder<RadiusSecretStoreResource>A builder for the new RadiusSecretStoreResource.

Exceptions

ArgumentExceptionThe name is empty/whitespace or not a valid resource-name segment.

Remarks

The store is emitted and deployed by a Radius environment; the application model must contain at least one environment added with AddRadiusEnvironment or publish/deploy fails with ASPIRERADIUS068. In Run mode the store is inert and is not surfaced in the dashboard.

Populate the returned store with exactly one of WithData (Radius-created from Aspire secret parameters), WithExistingSecret (reference a pre-existing Kubernetes Secret), or WithSealedSecret (apply a Bitnami SealedSecret manifest).

Examples

Declare an application-scoped store populated inline from a secret parameter:

var builder = DistributedApplication.CreateBuilder(args);
builder.AddRadiusEnvironment("radius");

var apiKey = builder.AddParameter("api-key", secret: true);
builder.AddRadiusSecretStore("appsecrets", RadiusSecretStoreType.Generic)
       .WithData(data => data.Add("apiKey", apiKey));

Ignored by ATS

Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

Experimental — ASPIRERADIUS006

WithData(IResourceBuilder<RadiusSecretStoreResource>, Action<RadiusSecretStoreDataBuilder>)extensionIResourceBuilder<RadiusSecretStoreResource>

Populates the store inline (Radius-created) from Aspire secret parameters. Each key's value is emitted as a valueless @secure() Bicep param and supplied at deploy time via rad deploy --parameters.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithData(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        Action<RadiusSecretStoreDataBuilder> configure)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L140-L158

Parameters

storeIResourceBuilder<RadiusSecretStoreResource>The secret-store builder.

configureAction<RadiusSecretStoreDataBuilder>Callback binding data keys to secret parameters.

Returns

IResourceBuilder<RadiusSecretStoreResource>The same store builder for chaining.

Ignored by ATS

Reason: Experimental Radius secret-store surface; the data-binding callback is not ATS-compatible.

Experimental — ASPIRERADIUS006

WithData(IResourceBuilder<RadiusSecretStoreResource>, string, IResourceBuilder<ParameterResource>, RadiusSecretStoreEncoding?)extensionIResourceBuilder<RadiusSecretStoreResource>

Populates the store inline (Radius-created) by binding a single data key to a secret parameter. This is a convenience over the callback overload for the common single-key case; the value is emitted as a valueless @secure() Bicep param and supplied at deploy time via rad deploy --parameters. Like the other population methods this may be called at most once per store (a second population call throws ASPIRERADIUS065); use the callback overload to bind multiple keys.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithData(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string key,
        IResourceBuilder<ParameterResource> parameter,
        RadiusSecretStoreEncoding? encoding = null)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L183-L186

Parameters

storeIResourceBuilder<RadiusSecretStoreResource>The secret-store builder.

keystringThe data key (non-empty).

parameterIResourceBuilder<ParameterResource>The secret parameter supplying the value (must be secret: true).

encodingRadiusSecretStoreEncoding?optionalOptional per-key encoding (defaults to the store type's default).

Returns

IResourceBuilder<RadiusSecretStoreResource>The same store builder for chaining.

Exceptions

ArgumentExceptionThe key is empty/whitespace.

Ignored by ATS

Reason: Experimental Radius secret-store surface; the data binding is not ATS-compatible.

Experimental — ASPIRERADIUS006

WithExistingSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])extensionIResourceBuilder<RadiusSecretStoreResource>

References an existing cluster Secret by <namespace>/<name> (or a bare <name>, whose namespace defaults to the owning environment's). No secret value flows through Aspire.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithExistingSecret(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string namespaceAndName,
        params string[] keys)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L205-L219

Parameters

storeIResourceBuilder<RadiusSecretStoreResource>The secret-store builder.

namespaceAndNamestringThe <namespace>/<name> or bare <name> reference.

keysstring[]The keys to expose from the referenced Secret.

Returns

IResourceBuilder<RadiusSecretStoreResource>The same store builder for chaining.

Ignored by ATS

Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

Experimental — ASPIRERADIUS006

WithMaterializationTimeout(IResourceBuilder<RadiusSecretStoreResource>, TimeSpan)extensionIResourceBuilder<RadiusSecretStoreResource>

Overrides the per-store timeout for awaiting a sealed Secret to materialize in-cluster before rad deploy (default 120 seconds). The timeout bounds the whole apply→sync-poll→key-verify sequence as a single shared budget, so a stalled kubectl apply or verify call is cancelled with ASPIRERADIUS066 once it is exhausted.

This only affects the sealed-secret deploy path ( WithSealedSecret). Calling it on a store that is not populated with WithSealedSecret is rejected by the validation gate with ASPIRERADIUS062 rather than silently ignored.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithMaterializationTimeout(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        TimeSpan timeout)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L277-L294

Parameters

storeIResourceBuilder<RadiusSecretStoreResource>The secret-store builder.

timeoutTimeSpanA positive materialization timeout, at most Int32.MaxValue milliseconds (~24.85 days).

Returns

IResourceBuilder<RadiusSecretStoreResource>The same store builder for chaining.

Exceptions

ArgumentOutOfRangeExceptiontimeout is not positive or exceeds the supported timer range.

Ignored by ATS

Reason: Sealed-secret deploy-timing knob with no polyglot ATS equivalent.

Experimental — ASPIRERADIUS006

WithSealedSecret(IResourceBuilder<RadiusSecretStoreResource>, string, string[])extensionIResourceBuilder<RadiusSecretStoreResource>

References the decrypted Secret of a committed, encrypted Bitnami SealedSecret manifest. At publish the manifest is copied alongside the owning group's app.bicep; at deploy it is applied and awaited before rad deploy. The integration never seals plaintext.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusSecretStoreResource> WithSealedSecret(
        this IResourceBuilder<RadiusSecretStoreResource> store,
        string manifestPath,
        params string[] keys)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L239-L252

Parameters

storeIResourceBuilder<RadiusSecretStoreResource>The secret-store builder.

manifestPathstringPath to the committed encrypted SealedSecret manifest.

keysstring[]The keys to expose from the decrypted Secret.

Returns

IResourceBuilder<RadiusSecretStoreResource>The same store builder for chaining.

Ignored by ATS

Reason: Experimental Radius secret-store surface; there is no polyglot ATS equivalent yet.

Experimental — ASPIRERADIUS006

WithSecretStore(IResourceBuilder<RadiusEnvironmentResource>, string, RadiusSecretStoreType, Action<IResourceBuilder<RadiusSecretStoreResource>>)extensionIResourceBuilder<RadiusEnvironmentResource>

Declares an environment-scoped Radius secret store ( properties.environment) on radius and configures it.

public static class RadiusSecretStoreExtensions
{
    public static IResourceBuilder<RadiusEnvironmentResource> WithSecretStore(
        this IResourceBuilder<RadiusEnvironmentResource> radius,
        string name,
        RadiusSecretStoreType type,
        Action<IResourceBuilder<RadiusSecretStoreResource>> configure)
    {
        // ...
    }
}

RadiusSecretStoreExtensions.cs#L109-L123

Parameters

radiusIResourceBuilder<RadiusEnvironmentResource>The Radius environment resource builder.

namestringThe secret-store name (a valid resource-name segment).

typeRadiusSecretStoreTypeThe Radius secret-store type.

configureAction<IResourceBuilder<RadiusSecretStoreResource>>Callback selecting the population mode (and optional timeout).

Returns

IResourceBuilder<RadiusEnvironmentResource>The same environment builder for chaining.

Exceptions

ArgumentExceptionThe name is empty/whitespace or not a valid resource-name segment.

Ignored by ATS

Reason: Experimental Radius secret-store surface; the population callback is not ATS-compatible.