{"record":{"id":"a4ca4203c1b8c56c","repo":"hashicorp/terraform","slug":"the-secret-name-v-is-invalid-validationerrors","errorCode":null,"errorMessage":"the secret name %v is invalid, {validationErrors}\nThis is a requirement for Kubernetes secret names. \nThe workspace name and key must adhere to Kubernetes naming conventions.","messagePattern":"the secret name (.+?) is invalid, (.+?)\nThis is a requirement for Kubernetes secret names\\. \nThe workspace name and key must adhere to Kubernetes naming conventions\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/kubernetes/client.go","lineNumber":420,"sourceCode":"\tdelProp := metav1.DeletePropagationBackground\n\tdelOps := metav1.DeleteOptions{PropagationPolicy: &delProp}\n\treturn c.kubernetesLeaseClient.Delete(context.Background(), name, delOps)\n}\n\nfunc (c *RemoteClient) createSecretName(idx int) (string, error) {\n\tsecretName := strings.Join([]string{tfstateKey, c.workspace, c.nameSuffix}, \"-\")\n\n\tif idx > 0 {\n\t\tsecretName = fmt.Sprintf(\"%s-part-%d\", secretName, idx)\n\t}\n\n\terrs := validation.IsDNS1123Subdomain(secretName)\n\tif len(errs) > 0 {\n\t\tk8sInfo := `\nThis is a requirement for Kubernetes secret names. \nThe workspace name and key must adhere to Kubernetes naming conventions.`\n\t\tmsg := fmt.Sprintf(\"the secret name %v is invalid, \", secretName)\n\t\treturn \"\", errors.New(msg + strings.Join(errs, \",\") + k8sInfo)\n\t}\n\n\treturn secretName, nil\n}\n\nfunc (c *RemoteClient) createLeaseName() (string, error) {\n\tn, err := c.createSecretName(0)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn \"lock-\" + n, nil\n}\n\nfunc compressState(data []byte) ([]byte, error) {\n\tb := new(bytes.Buffer)\n\tgz := gzip.NewWriter(b)\n\tif _, err := gz.Write(data); err != nil {\n\t\treturn nil, err","sourceCodeStart":402,"sourceCodeEnd":438,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/kubernetes/client.go#L402-L438","documentation":"Returned by RemoteClient.createSecretName (internal/backend/remote-state/kubernetes/client.go:420) when validation.IsDNS1123Subdomain(secretName) returns errors. The secret name is built as 'tfstate-<workspace>-<nameSuffix>' (plus '-part-N' for chunked state); Kubernetes requires secret names to be valid DNS subdomains (lowercase alphanumeric or '-', start/end alphanumeric, <=253 chars). The message appends the specific validation errors and a note about naming conventions.","triggerScenarios":"Configuring the kubernetes backend with a workspace name or secret suffix (the 'labels'/nameSuffix derived from 'secret_suffix' config) containing uppercase letters, underscores, dots, or other invalid characters; a workspace name exceeding the length budget when combined with the suffix and 'tfstate-' prefix.","commonSituations":"Workspace names like 'Prod_Env' or 'my.workspace'; a secret_suffix with uppercase or special chars; very long workspace names that push the combined name over 253 chars; Terraform workspace names that default to hostnames/branches with disallowed characters.","solutions":["Rename the workspace to use only lowercase alphanumeric characters and hyphens.","Set secret_suffix in the backend config to a DNS-1123-compliant value (lowercase, alphanumeric, '-').","Keep the combined 'tfstate-<workspace>-<suffix>' length under 253 characters."],"exampleFix":"// before\nbackend \"kubernetes\" {\n  secret_suffix = \"MyApp_Prod\"\n}\n// workspace selected: \"Prod Env\"\n\n// after\nbackend \"kubernetes\" {\n  secret_suffix = \"myapp-prod\"\n}\n// terraform workspace select prod-env","handlingStrategy":"validation","validationCode":"import \"k8s.io/apimachinery/pkg/util/validation\"\n\nsecretName := \"tfstate-\" + workspace + \"-\" + suffix\nif errs := validation.IsDNS1123Subdomain(secretName); len(errs) > 0 {\n    return fmt.Errorf(\"workspace/suffix produces invalid k8s secret name %q: %s\", secretName, strings.Join(errs, \", \"))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Restrict workspace names and secret_suffix to lowercase alphanumeric and hyphens only.","Run validation.IsDNS1123Subdomain on the constructed name before applying.","Keep combined name length (with 'tfstate-' prefix and '-part-N' suffix) under 253 chars."],"tags":["backend","kubernetes","naming","validation","configuration"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}