hashicorp/nomad · error

invalid name %q. Must match regex %s

Error message

invalid name %q. Must match regex %s

What it means

WorkloadIdentity.Validate returns this error when the identity's Name does not match the validIdentityName regular expression. Workload identity names must be DNS-like alphanumeric names (letters, digits, hyphens), so the error includes both the offending name and the required regex.

Source

Thrown at nomad/structs/workload_id.go:459

	// The default identity is only valid for use with Nomad itself.
	if wi.Name == WorkloadIdentityDefaultName {
		wi.Audience = []string{IdentityDefaultAud}
	}

	if wi.ChangeSignal != "" {
		wi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)
	}
}

func (wi *WorkloadIdentity) Validate() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

	var mErr multierror.Error

	if !validIdentityName.MatchString(wi.Name) {
		err := fmt.Errorf("invalid name %q. Must match regex %s", wi.Name, validIdentityName)
		mErr.Errors = append(mErr.Errors, err)
	}

	for i, aud := range wi.Audience {
		if aud == "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("an empty string is an invalid audience (%d)", i+1))
		}
	}

	switch wi.ChangeMode {
	case "", WIChangeModeNoop, WIChangeModeRestart:
		// Treat "" as noop. Make sure signal isn't set.
		if wi.ChangeSignal != "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("can only use change_signal=%q with change_mode=%q",
				wi.ChangeSignal, WIChangeModeSignal))
		}
	case WIChangeModeSignal:
		if wi.ChangeSignal == "" {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Rename the workload identity to match the regex (lowercase alphanumerics and hyphens, e.g. "my-identity").
2. Copy the regex shown in the error and test your name against it.
3. Strip or replace invalid characters like '_' or '/' programmatically before submission.

Example fix

// before
identity { name = "cache_service" }
// after
identity { name = "cache-service" }

var validIdentityName = regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`)
if !validIdentityName.MatchString(wi.Name) {
    return fmt.Errorf("invalid identity name %q", wi.Name)
}

func isValidIdentityName(name string) bool {
    return regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`).MatchString(name)
}

When it happens

Trigger: Validate() on a WorkloadIdentity whose Name fails validIdentityName.MatchString — e.g. names containing underscores, spaces, dots, uppercase, or being empty.

Common situations: Naming identities with characters copied from service names or paths ('my_service', 'api/v1'); empty name fields in templated job specs; case-sensitivity assumptions.

Related errors

• Missing task name
• Task cannot be named "alloc"
• Task name cannot include slashes
• Task name cannot include null characters
• no identities to sign

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/abf3d7be9e46d21e. Report an issue: GitHub.