{"record":{"id":"abf3d7be9e46d21e","repo":"hashicorp/nomad","slug":"invalid-name-q-must-match-regex-s-abf3d7","errorCode":null,"errorMessage":"invalid name %q. Must match regex %s","messagePattern":"invalid name %q\\. Must match regex (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":459,"sourceCode":"\t// The default identity is only valid for use with Nomad itself.\n\tif wi.Name == WorkloadIdentityDefaultName {\n\t\twi.Audience = []string{IdentityDefaultAud}\n\t}\n\n\tif wi.ChangeSignal != \"\" {\n\t\twi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)\n\t}\n}\n\nfunc (wi *WorkloadIdentity) Validate() error {\n\tif wi == nil {\n\t\treturn fmt.Errorf(\"must not be nil\")\n\t}\n\n\tvar mErr multierror.Error\n\n\tif !validIdentityName.MatchString(wi.Name) {\n\t\terr := fmt.Errorf(\"invalid name %q. Must match regex %s\", wi.Name, validIdentityName)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\tfor i, aud := range wi.Audience {\n\t\tif aud == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"an empty string is an invalid audience (%d)\", i+1))\n\t\t}\n\t}\n\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.\n\t\tif wi.ChangeSignal != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"can only use change_signal=%q with change_mode=%q\",\n\t\t\t\twi.ChangeSignal, WIChangeModeSignal))\n\t\t}\n\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L441-L477","documentation":"WorkloadIdentity.Validate returns this error when the identity's Name does not match the validIdentityName regular expression. Workload identity names must be DNS-like alphanumeric names (letters, digits, hyphens), so the error includes both the offending name and the required regex.","triggerScenarios":"Validate() on a WorkloadIdentity whose Name fails validIdentityName.MatchString — e.g. names containing underscores, spaces, dots, uppercase, or being empty.","commonSituations":"Naming identities with characters copied from service names or paths ('my_service', 'api/v1'); empty name fields in templated job specs; case-sensitivity assumptions.","solutions":["Rename the workload identity to match the regex (lowercase alphanumerics and hyphens, e.g. \"my-identity\").","Copy the regex shown in the error and test your name against it.","Strip or replace invalid characters like '_' or '/' programmatically before submission."],"exampleFix":"// before\nidentity { name = \"cache_service\" }\n// after\nidentity { name = \"cache-service\" }","handlingStrategy":"validation","validationCode":"var validIdentityName = regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`)\nif !validIdentityName.MatchString(wi.Name) {\n    return fmt.Errorf(\"invalid identity name %q\", wi.Name)\n}","typeGuard":"func isValidIdentityName(name string) bool {\n    return regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`).MatchString(name)\n}","tryCatchPattern":null,"preventionTips":["Use lowercase alphanumeric names with hyphens.","Avoid underscores, dots, slashes and spaces in identity names.","Sanitize generated names before building the identity."],"tags":["nomad","workload-identity","validation","naming"],"backgroundTag":"name-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}