dapr/dapr · error

a lowercase RFC 1123 label must consist of lower case alphan

Error message

a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?')

What it means

Emitted by isDNS1123Label (adapted from k8s.io/apimachinery) and wrapped by ValidateKubernetesAppID as "invalid app id (input: '%s', service: '%s')". On Kubernetes the app id gets a '-dapr' suffix to form the Service name (serviceName()), so the combined string must be a lowercase RFC 1123 label: only a-z, 0-9 and internal '-', must start and end alphanumeric, and at most 63 chars total — which caps the raw app id at 58 chars.

Source

Thrown at pkg/validation/validation.go:86

	return errors.Join(errs...)
}

// The function was adapted from: https://github.com/kubernetes/apimachinery/blob/fc49b38c19f02a58ebc476347e622142f19820b9/pkg/util/validation/validation.go
func regexError(msg string, fmt string, examples ...string) error {
	if len(examples) == 0 {
		return errors.New(msg + " (regex used for validation is '" + fmt + "')")
	}
	msg += " (e.g. "
	var msgSb77 strings.Builder
	for i := range examples {
		if i > 0 {
			msgSb77.WriteString(" or ")
		}
		msgSb77.WriteString("'" + examples[i] + "', ")
	}
	msg += msgSb77.String()
	msg += "regex used for validation is '" + fmt + "')"
	return errors.New(msg)
}

View on GitHub (pinned to 74ad417027)

Solutions

1. Lowercase the id and replace '_' and other symbols with '-'
2. Shorten the id to 58 characters or fewer so the '-dapr' suffix stays within the 63-char Service name limit
3. Make sure the first and last characters are alphanumeric (no leading/trailing '-')
4. Unit-test ids against ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ plus the 58-char length cap before applying manifests

Example fix

# before
dapr.io/app-id: "My_Order_Processing_Service_v2"
# after
dapr.io/app-id: "my-order-processing-v2"

var dns1123 = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)

func validKubernetesAppID(appID string) error {
	if appID == "" {
		return errors.New("app-id is empty")
	}
	// serviceName(appID) appends "-dapr" (5 chars), capping appID at 58.
	if len(appID) > 58 || !dns1123.MatchString(appID) {
		return fmt.Errorf("app-id %q must be a lowercase RFC 1123 label of at most 58 chars", appID)
	}
	return nil
}

func isDNS1123AppID(s string) bool {
	return len(s) <= 58 && dns1123.MatchString(s)
}

When it happens

Trigger: ValidateKubernetesAppID with values like 'MyApp' (uppercase), 'my_app' (underscore), '-app' or 'app-' (leading/trailing dash), or any id longer than 58 characters because appID + '-dapr' exceeds dns1123LabelMaxLength (63).

Common situations: Long Helm release-prefixed app ids, uppercase team/product names used as ids, underscore-based naming conventions, or ids accepted by other platforms but invalid as Kubernetes Service names.

Related errors

• value for the dapr.io/app-id annotation is empty
• parameter app-id cannot be empty
• parameter app-id cannot contain dots
• failed to parse Kubernetes token: %s
• namespace mismatch; received namespace: %s

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/bf4ac15a32601e73. Report an issue: GitHub.