hashicorp/nomad · error

secret name must match regex %s

Error message

secret name must match regex %s

What it means

Secret block validation error: the secret's name fails the validSecretName regex. Names are used in paths and env wiring, so they must stay within the allowed character set (the regex value is included in the message).

Source

Thrown at nomad/structs/structs.go:10635

		Path:     s.Path,
		Config:   confCopy.(map[string]any),
		Env:      maps.Clone(s.Env),
	}
}

func (s *Secret) Validate() error {
	if s == nil {
		return nil
	}

	var mErr multierror.Error

	if s.Name == "" {
		_ = multierror.Append(&mErr, errors.New("secret name cannot be empty"))
	}

	if !validSecretName.MatchString(s.Name) {
		_ = multierror.Append(&mErr, fmt.Errorf("secret name must match regex %s", validSecretName))
	}

	if s.Provider == "" {
		_ = multierror.Append(&mErr, errors.New("secret provider cannot be empty"))
	}

	if s.Path == "" {
		_ = multierror.Append(&mErr, errors.New("secret path cannot be empty"))
	}

	if s.Provider == "nomad" || s.Provider == "vault" {
		if len(s.Env) > 0 {
			_ = multierror.Append(&mErr, fmt.Errorf("%s provider cannot use the env block", s.Provider))
		}
	} else {
		if len(s.Config) > 0 {
			_ = multierror.Append(&mErr, fmt.Errorf("custom plugin provider %s cannot use the config block", s.Provider))
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Rename the secret using only characters allowed by the regex shown in the message
2. Avoid spaces, slashes, and special characters in secret names

When it happens

Trigger: Thrown at nomad/structs/structs.go:10635 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a2fe45a80f1e7253. Report an issue: GitHub.