the secret name ${secretName} is invalid, ${errs} This is a

Error message

the secret name ${secretName} is invalid, ${errs}
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.

What it means

A NestedBlock's Nesting field is not one of the recognized NestingMode constants (NestingSingle, NestingGroup, NestingList, NestingSet, NestingMap). The default zero value is nestingModeInvalid, so an unset Nesting field, or a corrupted/out-of-range value, lands in the default switch branch and is rejected.

Source

Thrown at internal/backend/remote-state/kubernetes/client.go:420

	delProp := metav1.DeletePropagationBackground
	delOps := metav1.DeleteOptions{PropagationPolicy: &delProp}
	return c.kubernetesLeaseClient.Delete(context.Background(), name, delOps)
}

func (c *RemoteClient) createSecretName(idx int) (string, error) {
	secretName := strings.Join([]string{tfstateKey, c.workspace, c.nameSuffix}, "-")

	if idx > 0 {
		secretName = fmt.Sprintf("%s-part-%d", secretName, idx)
	}

	errs := validation.IsDNS1123Subdomain(secretName)
	if len(errs) > 0 {
		k8sInfo := `
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.`
		msg := fmt.Sprintf("the secret name %v is invalid, ", secretName)
		return "", errors.New(msg + strings.Join(errs, ",") + k8sInfo)
	}

	return secretName, nil
}

func (c *RemoteClient) createLeaseName() (string, error) {
	n, err := c.createSecretName(0)
	if err != nil {
		return "", err
	}
	return "lock-" + n, nil
}

func compressState(data []byte) ([]byte, error) {
	b := new(bytes.Buffer)
	gz := gzip.NewWriter(b)
	if _, err := gz.Write(data); err != nil {
		return nil, err

View on GitHub (pinned to d32a084675)

Solutions

Set Nesting to one of NestingSingle, NestingGroup, NestingList, NestingSet, or NestingMap.
If the value comes from codegen, ensure the generator always emits a valid constant.
Default to NestingList for typical repeatable blocks.

Example fix

// before
"settings": {
  Block: configschema.Block{Attributes: ...},
  // Nesting omitted -> nestingModeInvalid
},
// after
"settings": {
  Nesting: configschema.NestingList,
  Block: configschema.Block{Attributes: ...},
},

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the Nesting field is a recognized constant.
func validNesting(n configschema.NestingMode) bool {
    switch n {
    case configschema.NestingSingle, configschema.NestingGroup,
        configschema.NestingList, configschema.NestingSet, configschema.NestingMap:
        return true
    }
    return false
}

Type guard

func isValidNesting(n configschema.NestingMode) bool {
    return n >= configschema.NestingSingle && n <= configschema.NestingMap
}

Prevention

Always set the Nesting field explicitly on every NestedBlock.
Default to NestingList for repeatable blocks when unsure.
If generating schemas, assert the produced Nesting is a known constant.

When it happens

Trigger: A NestedBlock literal that omits the Nesting field (defaults to nestingModeInvalid=0), or assigns an int value outside the declared enum. The default case at internal_validate.go:117 fires.

Common situations: Initializing a NestedBlock struct without setting Nesting; casting an arbitrary integer into NestingMode; schema generation that emits a zero nesting mode.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/cecc937d9fb97245. Report an issue: GitHub.