Warn when persistent containers lack user secrets configuration

src/Aspire.Hosting/BuiltInDistributedApplicationEventSubscriptionHandlers.cs

@@ -1,11 +1,15 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+#pragma warning disable ASPIREUSERSECRETS001
+
 using Aspire;
 using Aspire.Hosting;
 using Aspire.Hosting.ApplicationModel;
 using Aspire.Hosting.Dcp;
+using Aspire.Hosting.Resources;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 
 internal static class BuiltInDistributedApplicationEventSubscriptionHandlers
 {
@@ -78,4 +82,29 @@ public static Task UpdateContainerRegistryAsync(BeforeStartEvent @event, Distrib
 
         return Task.CompletedTask;
     }
+
+    public static Task WarnPersistentContainersWithoutUserSecrets(BeforeStartEvent beforeStartEvent, CancellationToken _)
+    {
+        var userSecretsManager = beforeStartEvent.Services.GetRequiredService<IUserSecretsManager>();
+
+        if (userSecretsManager.IsAvailable)
+        {
+            return Task.CompletedTask;
+        }
+
+        var logger = beforeStartEvent.Services.GetRequiredService<ILoggerFactory>().CreateLogger("Aspire.Hosting");
+
+        foreach (var resource in beforeStartEvent.Model.Resources)
+        {
+            if (resource.GetContainerLifetimeType() == ContainerLifetime.Persistent)
+            {
+                if (logger.IsEnabled(LogLevel.Warning))
+                {
+                    logger.LogWarning(MessageStrings.PersistentContainerWithoutUserSecrets, resource.Name);
+                }
+            }
+        }
+
+        return Task.CompletedTask;
+    }
 }

src/Aspire.Hosting/DistributedApplicationBuilder.cs

@@ -496,6 +496,7 @@ public DistributedApplicationBuilder(DistributedApplicationOptions options)
             _innerBuilder.Services.AddSingleton<IKubernetesService, KubernetesService>();
 
             Eventing.Subscribe<BeforeStartEvent>(BuiltInDistributedApplicationEventSubscriptionHandlers.InitializeDcpAnnotations);
+            Eventing.Subscribe<BeforeStartEvent>(BuiltInDistributedApplicationEventSubscriptionHandlers.WarnPersistentContainersWithoutUserSecrets);
         }
 
         // Publishing support

src/Aspire.Hosting/Resources/MessageStrings.resx

@@ -150,6 +150,9 @@
   <data name="RequiredCommandValidationFailedWithLink" xml:space="preserve">
     <value>Command '{0}' validation failed: {1}. For installation instructions, see: {2}</value>
   </data>
+  <data name="PersistentContainerWithoutUserSecrets" xml:space="preserve">
+    <value>Resource '{0}' has a persistent lifetime but the AppHost project does not have user secrets configured. Generated parameter values (such as passwords) may change on each restart, causing persistent containers to be recreated. Run 'dotnet user-secrets init' in the AppHost directory to configure user secrets.</value>
+  </data>
   <data name="ResourceMayFailToStart" xml:space="preserve">
     <value>Resource '{0}' may fail to start: {1}</value>
   </data>