{"record":{"id":"038ff89251fb1380","repo":"cilium/cilium","slug":"invalid-characters-in-matchname-s-only-0-9-a","errorCode":null,"errorMessage":"Invalid characters in MatchName: \"%s\". Only 0-9, a-z, A-Z and ., -, _ characters are allowed","messagePattern":"Invalid characters in MatchName: \"(.+?)\"\\. Only 0-9, a-z, A-Z and \\., -, _ characters are allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/api/fqdn.go","lineNumber":105,"sourceCode":"// ToRegex function\nfunc (s *FQDNSelector) IdentityLabel() labels.Label {\n\tmatch := s.MatchPattern\n\tif s.MatchName != \"\" {\n\t\tmatch = s.MatchName\n\t}\n\n\treturn labels.NewLabel(match, \"\", labels.LabelSourceFQDN)\n}\n\n// Validate for FQDNSelector is a little wonky. While we do more processing\n// when using MatchName the basic requirement is that is a valid regexp. We\n// test that it can compile here.\nfunc (s *FQDNSelector) Validate() error {\n\tif len(s.MatchName) > 0 && len(s.MatchPattern) > 0 {\n\t\treturn fmt.Errorf(\"only one of MatchName or MatchPattern is allowed in an FQDNSelector\")\n\t}\n\tif len(s.MatchName) > 0 && !allowedMatchNameChars.MatchString(s.MatchName) {\n\t\treturn fmt.Errorf(\"Invalid characters in MatchName: \\\"%s\\\". Only 0-9, a-z, A-Z and ., -, _ characters are allowed\", s.MatchName)\n\t}\n\n\t_, err := matchpattern.Validate(s.MatchPattern)\n\treturn err\n}\n\n// ToRegex converts the given FQDNSelector to its corresponding regular\n// expression. If the MatchName field is set in the selector, it performs all\n// needed formatting to ensure that the field is a valid regular expression.\nfunc (s *FQDNSelector) ToRegex() (*regexp.Regexp, error) {\n\tvar preparedMatch string\n\tif s.MatchName != \"\" {\n\t\tpreparedMatch = dns.FQDN(s.MatchName)\n\t} else {\n\t\tpreparedMatch = matchpattern.Sanitize(s.MatchPattern)\n\t}\n\n\tregex, err := matchpattern.Validate(preparedMatch)","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/api/fqdn.go#L87-L123","documentation":"FQDNSelector.Validate checks MatchName against allowedMatchNameChars (^[-a-zA-Z0-9_.]+$): only alphanumerics, dot, dash, and underscore. This error means MatchName contains characters outside that set — most commonly wildcard characters like '*', which are only valid in MatchPattern.","triggerScenarios":"Setting FQDNSelector.MatchName to a value containing '*', '?', ':', spaces, uppercase-invalid punycode, or a protocol prefix like \"https://api.example.com\"; Validate() is called during policy import/validation.","commonSituations":"Users copying wildcard syntax (*.example.com) into matchName instead of matchPattern; pasting full URLs or ports (api.example.com:443) into matchName; typos or trailing whitespace/newline from YAML copy-paste.","solutions":["Remove invalid characters; if you need wildcards, move the value to matchPattern instead.","Use only 0-9, a-z, A-Z, '.', '-', '_' in matchName (it is a literal DNS name, not a regex).","Strip scheme/port/whitespace: use the bare hostname, e.g. \"api.example.com\" not \"https://api.example.com:443\".","Pre-validate with the same regex before submitting: regexp.MustCompile(\"^[-a-zA-Z0-9_.]+$\").MatchString(matchName)."],"exampleFix":"// before (invalid)\nfqdn:\n  matchName: \"*.example.com\"\n// after\nfqdn:\n  matchPattern: \"*.example.com\"","handlingStrategy":"validation","validationCode":"var matchNameRe = regexp.MustCompile(`^[-a-zA-Z0-9_.]+$`)\nfunc validMatchName(name string) bool { return matchNameRe.MatchString(name) }","typeGuard":"func isLiteralFQDN(s string) bool {\n    return s != \"\" && regexp.MustCompile(`^[-a-zA-Z0-9_.]+$`).MatchString(s)\n}","tryCatchPattern":"if err := sel.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"Invalid characters in MatchName\") {\n        return fmt.Errorf(\"fix matchName %q: use a literal DNS name or move wildcards to matchPattern\", sel.MatchName)\n    }\n    return err\n}","preventionTips":["Use matchPattern for any value containing '*'","Strip scheme, port, path, and whitespace before assigning MatchName","Sanitize templated inputs (trim spaces) before policy generation","Add the allowedMatchNameChars regex as a client-side schema check"],"tags":["cilium","networkpolicy","dns","validation"],"backgroundTag":"fqdn-selector-validation","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}