opentofu/opentofu · error

the secret name %v is invalid, %s This is a requirement for

Error message

the secret name %v is invalid, %s
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.

What it means

Returned by (*RemoteClient).createSecretName (internal/backend/remote-state/kubernetes/client.go). The state Secret is named by joining tfstateKey, the workspace, and `secret_suffix` with hyphens (tfstate-<workspace>-<suffix>); the result must satisfy validation.IsDNS1123Subdomain — lowercase alphanumerics, '-' and '.', max 253 chars. Any violation (e.g., an underscore in the workspace name, uppercase, excessive length) fails with this message before any Kubernetes API call.

Source

Thrown at internal/backend/remote-state/kubernetes/client.go:335

	if !ok || v != "true" {
		return fmt.Errorf("Lease does does not have %q label", tfstateKey)
	}

	delProp := metav1.DeletePropagationBackground
	delOps := metav1.DeleteOptions{PropagationPolicy: &delProp}
	return c.kubernetesLeaseClient.Delete(ctx, name, delOps)
}

func (c *RemoteClient) createSecretName() (string, error) {
	secretName := strings.Join([]string{tfstateKey, c.workspace, c.nameSuffix}, "-")

	errs := validation.IsDNS1123Subdomain(secretName)
	if len(errs) > 0 {
		k8sInfo := `
This is a requirement for Kubernetes secret names. 
The workspace name and key must adhere to Kubernetes naming conventions.`
		msg := fmt.Sprintf("the secret name %v is invalid, ", secretName)
		return "", errors.New(msg + strings.Join(errs, ",") + k8sInfo)
	}

	return secretName, nil
}

func (c *RemoteClient) createLeaseName() (string, error) {
	n, err := c.createSecretName()
	if err != nil {
		return "", err
	}
	return "lock-" + n, nil
}

func compressState(data []byte) ([]byte, error) {
	b := new(bytes.Buffer)
	gz := gzip.NewWriter(b)
	if _, err := gz.Write(data); err != nil {
		return nil, err

View on GitHub (pinned to 3561785c48)

Solutions

1. Use workspace names containing only lowercase letters, digits, and hyphens
2. Keep tfstate-<workspace>-<secret_suffix> within 253 characters and make secret_suffix DNS-1123 safe too
3. Recreate the state under a compliant name (new workspace + `tofu state push`) if an invalid-named workspace already has state elsewhere

Example fix

# before
tofu workspace new team_env_prod   # underscore breaks DNS-1123

# after
tofu workspace new team-env-prod   # lowercase + hyphens only

import "k8s.io/apimachinery/pkg/util/validation"

func validSecretName(workspace, suffix string) bool {
    errs := validation.IsDNS1123Subdomain("tfstate-" + workspace + "-" + suffix)
    return len(errs) == 0
}

if _, err := b.StateMgr(ctx, ws); err != nil {
    if strings.Contains(err.Error(), "the secret name") && strings.Contains(err.Error(), "is invalid") {
        // workspace or suffix breaks DNS-1123: rename with lowercase/hyphens only
    }
    return err
}

When it happens

Trigger: Selecting or creating a workspace whose name contains '_' or uppercase (tofu permits underscores in workspace names, Kubernetes does not in subdomains), or a workspace+secret_suffix combination exceeding 253 characters or starting/ending with '-'.

Common situations: Teams adopting workspace names like team_env_prod on other backends then switching to kubernetes; very long feature-branch workspace names; secret_suffix values with underscores.

Related errors

• missing state name
• empty state name
• invalid storage account name: Azure requires a storage accou
• invalid storage container name: Azure requires a storage con
• invalid storage container name: Hyphens in a storage contain

AI-assisted analysis of opentofu/opentofu@3561785c48 (2026-08-15). Data as JSON: /api/errors/a34cf5d0d54b88b9. Report an issue: GitHub.