{"record":{"id":"a34cf5d0d54b88b9","repo":"opentofu/opentofu","slug":"the-secret-name-v-is-invalid-s-this-is-a-requir","errorCode":null,"errorMessage":"the secret name %v is invalid, %s\nThis is a requirement for Kubernetes secret names. \nThe workspace name and key must adhere to Kubernetes naming conventions.","messagePattern":"the secret name (.+?) is invalid, (.+?)\nThis is a requirement for Kubernetes secret names\\. \nThe workspace name and key must adhere to Kubernetes naming conventions\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/kubernetes/client.go","lineNumber":335,"sourceCode":"\tif !ok || v != \"true\" {\n\t\treturn fmt.Errorf(\"Lease does does not have %q label\", tfstateKey)\n\t}\n\n\tdelProp := metav1.DeletePropagationBackground\n\tdelOps := metav1.DeleteOptions{PropagationPolicy: &delProp}\n\treturn c.kubernetesLeaseClient.Delete(ctx, name, delOps)\n}\n\nfunc (c *RemoteClient) createSecretName() (string, error) {\n\tsecretName := strings.Join([]string{tfstateKey, c.workspace, c.nameSuffix}, \"-\")\n\n\terrs := validation.IsDNS1123Subdomain(secretName)\n\tif len(errs) > 0 {\n\t\tk8sInfo := `\nThis is a requirement for Kubernetes secret names. \nThe workspace name and key must adhere to Kubernetes naming conventions.`\n\t\tmsg := fmt.Sprintf(\"the secret name %v is invalid, \", secretName)\n\t\treturn \"\", errors.New(msg + strings.Join(errs, \",\") + k8sInfo)\n\t}\n\n\treturn secretName, nil\n}\n\nfunc (c *RemoteClient) createLeaseName() (string, error) {\n\tn, err := c.createSecretName()\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn \"lock-\" + n, nil\n}\n\nfunc compressState(data []byte) ([]byte, error) {\n\tb := new(bytes.Buffer)\n\tgz := gzip.NewWriter(b)\n\tif _, err := gz.Write(data); err != nil {\n\t\treturn nil, err","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/opentofu/opentofu/blob/3561785c48c1ce615e7c50261bd351f26053efa2/internal/backend/remote-state/kubernetes/client.go#L317-L353","documentation":"Returned by (*RemoteClient).createSecretName (internal/backend/remote-state/kubernetes/client.go). The state Secret is named by joining tfstateKey, the workspace, and `secret_suffix` with hyphens (tfstate-<workspace>-<suffix>); the result must satisfy validation.IsDNS1123Subdomain — lowercase alphanumerics, '-' and '.', max 253 chars. Any violation (e.g., an underscore in the workspace name, uppercase, excessive length) fails with this message before any Kubernetes API call.","triggerScenarios":"Selecting or creating a workspace whose name contains '_' or uppercase (tofu permits underscores in workspace names, Kubernetes does not in subdomains), or a workspace+secret_suffix combination exceeding 253 characters or starting/ending with '-'.","commonSituations":"Teams adopting workspace names like team_env_prod on other backends then switching to kubernetes; very long feature-branch workspace names; secret_suffix values with underscores.","solutions":["Use workspace names containing only lowercase letters, digits, and hyphens","Keep tfstate-<workspace>-<secret_suffix> within 253 characters and make secret_suffix DNS-1123 safe too","Recreate the state under a compliant name (new workspace + `tofu state push`) if an invalid-named workspace already has state elsewhere"],"exampleFix":"# before\ntofu workspace new team_env_prod   # underscore breaks DNS-1123\n\n# after\ntofu workspace new team-env-prod   # lowercase + hyphens only","handlingStrategy":"validation","validationCode":"import \"k8s.io/apimachinery/pkg/util/validation\"\n\nfunc validSecretName(workspace, suffix string) bool {\n    errs := validation.IsDNS1123Subdomain(\"tfstate-\" + workspace + \"-\" + suffix)\n    return len(errs) == 0\n}","typeGuard":null,"tryCatchPattern":"if _, err := b.StateMgr(ctx, ws); err != nil {\n    if strings.Contains(err.Error(), \"the secret name\") && strings.Contains(err.Error(), \"is invalid\") {\n        // workspace or suffix breaks DNS-1123: rename with lowercase/hyphens only\n    }\n    return err\n}","preventionTips":["Restrict workspace naming policy to ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ from day one","Budget name length: keep tfstate-<workspace>-<suffix> well under 253 chars","Add a pre-init check that mirrors IsDNS1123Subdomain in CI"],"tags":["kubernetes","naming","workspaces","validation"],"backgroundTag":null,"analyzedSha":"3561785c48c1ce615e7c50261bd351f26053efa2","analyzedAt":"2026-08-15T23:27:16.226Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}