{"record":{"id":"07091a117bda6945","repo":"grafana/k6","slug":"104","errorCode":"104","errorMessage":"'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'","messagePattern":"'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmd/root.go","lineNumber":612,"sourceCode":"\n// hasCloudSecretSource returns true if the 'cloud' secret source type appears in sources.\nfunc hasCloudSecretSource(sources []string) bool {\n\tfor _, s := range sources {\n\t\tt, _, _ := strings.Cut(s, \"=\")\n\t\tif strings.TrimSpace(t) == \"cloud\" {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\n// validateNoCloudSecretSource returns an error if sources contains 'cloud', which is not\n// a valid value for --secret-source. Cloud secrets are automatically available for\n// 'k6 cloud run --local-execution' and do not require explicit configuration.\nfunc validateNoCloudSecretSource(sources []string) error {\n\tif hasCloudSecretSource(sources) {\n\t\treturn errext.WithExitCodeIfNone(\n\t\t\tfmt.Errorf(\"'cloud' is not a valid value for --secret-source; \"+\n\t\t\t\t\"cloud secrets are automatically available for 'k6 cloud run --local-execution'\"),\n\t\t\texitcodes.InvalidConfig,\n\t\t)\n\t}\n\treturn nil\n}\n\nfunc extractNameAndDefault(config string) (name string, isDefault bool, remaining string) {\n\tlist := strings.Split(config, \",\")\n\tremainingArray := make([]string, 0, len(list))\n\tfor _, kv := range list {\n\t\tif kv == \"default\" {\n\t\t\tisDefault = true\n\t\t\tcontinue\n\t\t}\n\t\tk, v, _ := strings.Cut(kv, \"=\")\n\t\tif k == \"name\" {\n\t\t\tname = v","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/grafana/k6/blob/8d06114777191d21ef885d05c5f8aa9e1ed838ae/internal/cmd/root.go#L594-L630","documentation":"'cloud' is deliberately not a valid --secret-source value: cloud secrets are injected automatically for 'k6 cloud run --local-execution' (or via K6_CLOUD_SECRETS_* env vars), so asking for it explicitly is always a mistake. validateNoCloudSecretSource rejects the whole command at startup with exit code 104 (InvalidConfig) and points at the correct usage.","triggerScenarios":"k6 run --secret-source=cloud script.js; k6 cloud run --local-execution --secret-source=cloud=... script.js. Any entry whose type is 'cloud' triggers it before any source is constructed.","commonSituations":"Users discovering the cloud secrets feature and assuming they must opt in via the flag; porting a local secret-source setup to cloud runs.","solutions":["Remove --secret-source=cloud from the command","Use 'k6 cloud run --local-execution' — the 'cloud' source is registered and configured automatically","For local runs, inject the cloud source via K6_CLOUD_SECRETS_TOKEN (+ K6_CLOUD_SECRETS_ENDPOINT) instead of the flag"],"exampleFix":"# before\nk6 cloud run --local-execution --secret-source=cloud script.js\n\n# after\nk6 cloud run --local-execution script.js","handlingStrategy":"validation","validationCode":"# reject 'cloud' entries before invoking k6\nfor entry in ${SECRET_SOURCES}; do\n  type=\"${entry%%=*}\"\n  if [ \"$type\" = cloud ]; then\n    echo \"'cloud' is not a valid --secret-source; use: k6 cloud run --local-execution\" >&2; exit 1\n  fi\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember cloud secrets need no flag: they come with 'k6 cloud run --local-execution' or K6_CLOUD_SECRETS_* env vars","Update old runbooks that mention --secret-source=cloud; exit code 104 always means invalid config in k6"],"tags":["k6","cloud","secrets","secret-source","exit-code-104"],"backgroundTag":"invalid-cli-flag-value","analyzedSha":"8d06114777191d21ef885d05c5f8aa9e1ed838ae","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":"2026-08-18T03:05:52.393Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}