{"record":{"id":"02a553f04a2cb75b","repo":"grafana/k6","slug":"can-t-have-two-secret-sources-that-are-default-one","errorCode":null,"errorMessage":"can't have two secret sources that are default ones, second one was %q","messagePattern":"can't have two secret sources that are default ones, second one was %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmd/root.go","lineNumber":536,"sourceCode":"\t\tname, isDefault, config := extractNameAndDefault(config)\n\t\tif name == \"\" {\n\t\t\t// Default the name to the source type to avoid an empty-string key.\n\t\t\tname = t\n\t\t}\n\t\tparams.ConfigArgument = config\n\n\t\tsecretSource, err := c(params)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\t_, alreadRegistered := result[name]\n\t\tif alreadRegistered {\n\t\t\treturn nil, fmt.Errorf(\"secret source for name %q already registered before configuration %q\", t, line)\n\t\t}\n\t\tresult[name] = secretSource\n\t\tif isDefault {\n\t\t\tif _, ok := result[\"default\"]; ok {\n\t\t\t\treturn nil, fmt.Errorf(\"can't have two secret sources that are default ones, second one was %q\", config)\n\t\t\t}\n\t\t\tresult[\"default\"] = secretSource\n\t\t}\n\t}\n\n\tif len(result) == 1 {\n\t\tfor _, l := range result {\n\t\t\tresult[\"default\"] = l\n\t\t}\n\t}\n\n\t// Capture the cloud source instance if it was registered (via local-execution auto-injection\n\t// or the env-var path below), so createCloudTest can call SetConfig on it later.\n\tif cs, ok := result[\"cloud\"].(*cloudsecrets.SecretSource); ok {\n\t\tgs.CloudSecretSource = cs\n\t}\n\n\t// When  K6_CLOUD_SECRETS_TOKEN + K6_CLOUD_SECRETS_ENDPOINT are injected, create and configure the cloud source","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/grafana/k6/blob/8d06114777191d21ef885d05c5f8aa9e1ed838ae/internal/cmd/root.go#L518-L554","documentation":"A secret source becomes the default when its comma-separated config contains the literal key 'default' (e.g. file,default=secrets.txt or mock,default). Only one default is allowed; a second entry containing 'default' fails registration with this error showing the second configuration line. If exactly one source is configured, k6 automatically promotes it to default, so the keyword is unnecessary in that case.","triggerScenarios":"--secret-source=file,default=a.txt --secret-source=mock,default; any two entries whose config lists both include 'default' (e.g. file,name=x,default=a --secret-source=url,default=...).","commonSituations":"Copy-pasting a 'default'-annotated flag into a command that already has one; attempting a fallback chain of secret sources (not supported via multiple defaults).","solutions":["Keep the 'default' key on exactly one --secret-source entry and remove it from the others","If you configure a single source only, drop the 'default' keyword — k6 makes it the default automatically"],"exampleFix":"# before\nk6 run --secret-source=file,default=a.txt --secret-source=mock,default script.js\n\n# after\nk6 run --secret-source=file,default=a.txt --secret-source=mock script.js","handlingStrategy":"validation","validationCode":"# allow at most one entry containing the 'default' key\ncount=$(printf '%s\\n' \"$@\" | grep -c '(^|,)default(,|=|$)' || true)\nif [ \"$count\" -gt 1 ]; then echo \"multiple default secret sources\" >&2; exit 1; fi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the 'default' keyword on exactly one entry; with a single source you don't need it at all","Review secret-source config in code review the same way you review default credentials — there should be exactly one default","Prefer explicit name= keys and one deliberate default rather than keyword sprinkling"],"tags":["k6","secrets","secret-source","default","config"],"backgroundTag":"duplicate-config-entry","analyzedSha":"8d06114777191d21ef885d05c5f8aa9e1ed838ae","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":"2026-08-18T03:05:52.393Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}