hashicorp/terraform · error

the secret name %v is invalid, {validationErrors} This is a

Error message

the secret name %v is invalid, {validationErrors}
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.

What it means

Returned by RemoteClient.createSecretName (internal/backend/remote-state/kubernetes/client.go:420) when validation.IsDNS1123Subdomain(secretName) returns errors. The secret name is built as 'tfstate-<workspace>-<nameSuffix>' (plus '-part-N' for chunked state); Kubernetes requires secret names to be valid DNS subdomains (lowercase alphanumeric or '-', start/end alphanumeric, <=253 chars). The message appends the specific validation errors and a note about naming conventions.

Source

Thrown at internal/backend/remote-state/kubernetes/client.go:420

	delProp := metav1.DeletePropagationBackground
	delOps := metav1.DeleteOptions{PropagationPolicy: &delProp}
	return c.kubernetesLeaseClient.Delete(context.Background(), name, delOps)
}

func (c *RemoteClient) createSecretName(idx int) (string, error) {
	secretName := strings.Join([]string{tfstateKey, c.workspace, c.nameSuffix}, "-")

	if idx > 0 {
		secretName = fmt.Sprintf("%s-part-%d", secretName, idx)
	}

	errs := validation.IsDNS1123Subdomain(secretName)
	if len(errs) > 0 {
		k8sInfo := `
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.`
		msg := fmt.Sprintf("the secret name %v is invalid, ", secretName)
		return "", errors.New(msg + strings.Join(errs, ",") + k8sInfo)
	}

	return secretName, nil
}

func (c *RemoteClient) createLeaseName() (string, error) {
	n, err := c.createSecretName(0)
	if err != nil {
		return "", err
	}
	return "lock-" + n, nil
}

func compressState(data []byte) ([]byte, error) {
	b := new(bytes.Buffer)
	gz := gzip.NewWriter(b)
	if _, err := gz.Write(data); err != nil {
		return nil, err

View on GitHub (pinned to c9def3e214)

Solutions

1. Rename the workspace to use only lowercase alphanumeric characters and hyphens.
2. Set secret_suffix in the backend config to a DNS-1123-compliant value (lowercase, alphanumeric, '-').
3. Keep the combined 'tfstate-<workspace>-<suffix>' length under 253 characters.

Example fix

// before
backend "kubernetes" {
  secret_suffix = "MyApp_Prod"
}
// workspace selected: "Prod Env"

// after
backend "kubernetes" {
  secret_suffix = "myapp-prod"
}
// terraform workspace select prod-env

import "k8s.io/apimachinery/pkg/util/validation"

secretName := "tfstate-" + workspace + "-" + suffix
if errs := validation.IsDNS1123Subdomain(secretName); len(errs) > 0 {
    return fmt.Errorf("workspace/suffix produces invalid k8s secret name %q: %s", secretName, strings.Join(errs, ", "))
}

When it happens

Trigger: Configuring the kubernetes backend with a workspace name or secret suffix (the 'labels'/nameSuffix derived from 'secret_suffix' config) containing uppercase letters, underscores, dots, or other invalid characters; a workspace name exceeding the length budget when combined with the suffix and 'tfstate-' prefix.

Common situations: Workspace names like 'Prod_Env' or 'my.workspace'; a secret_suffix with uppercase or special chars; very long workspace names that push the combined name over 253 chars; Terraform workspace names that default to hostnames/branches with disallowed characters.

Related errors

• missing state name
• default workspace not supported You can create a new workspa
• empty state name
• Attempted to initialize pluggable state with an empty string
• failed to append certs

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a4ca4203c1b8c56c. Report an issue: GitHub.