{"record":{"id":"07091a117bda6945","repo":"grafana/k6","slug":"104-07091a","errorCode":"104","errorMessage":"'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'","messagePattern":"'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmd/root.go","lineNumber":600,"sourceCode":"\n// hasCloudSecretSource returns true if the 'cloud' secret source type appears in sources.\nfunc hasCloudSecretSource(sources []string) bool {\n\tfor _, s := range sources {\n\t\tt, _, _ := strings.Cut(s, \"=\")\n\t\tif strings.TrimSpace(t) == \"cloud\" {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\n// validateNoCloudSecretSource returns an error if sources contains 'cloud', which is not\n// a valid value for --secret-source. Cloud secrets are automatically available for\n// 'k6 cloud run --local-execution' and do not require explicit configuration.\nfunc validateNoCloudSecretSource(sources []string) error {\n\tif hasCloudSecretSource(sources) {\n\t\treturn errext.WithExitCodeIfNone(\n\t\t\tfmt.Errorf(\"'cloud' is not a valid value for --secret-source; \"+\n\t\t\t\t\"cloud secrets are automatically available for 'k6 cloud run --local-execution'\"),\n\t\t\texitcodes.InvalidConfig,\n\t\t)\n\t}\n\treturn nil\n}\n\nfunc extractNameAndDefault(config string) (name string, isDefault bool, remaining string) {\n\tlist := strings.Split(config, \",\")\n\tremainingArray := make([]string, 0, len(list))\n\tfor _, kv := range list {\n\t\tif kv == \"default\" {\n\t\t\tisDefault = true\n\t\t\tcontinue\n\t\t}\n\t\tk, v, _ := strings.Cut(kv, \"=\")\n\t\tif k == \"name\" {\n\t\t\tname = v","sourceCodeStart":582,"sourceCodeEnd":618,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/cmd/root.go#L582-L618","documentation":"k6 rejects --secret-source=cloud because cloud secrets are not fetched through the generic secret-source mechanism. Cloud secrets are injected automatically when a test runs via 'k6 cloud run --local-execution', so listing 'cloud' as a secret source is always a configuration mistake. validateNoCloudSecretSource detects any 'cloud' entry during flag validation and k6 exits with code 104 (InvalidConfig).","triggerScenarios":"Running any command with --secret-source=cloud, e.g. 'k6 run --secret-source=cloud script.js', or combining it with other sources (--secret-source=file,path --secret-source=cloud). hasCloudSecretSource() scans the parsed sources list and any 'cloud' entry triggers the error.","commonSituations":"Users migrate from cloud execution to local runs and copy the cloud secret configuration along; CI scripts reuse one --secret-source list for both 'k6 run' and 'k6 cloud run --local-execution'; users assume cloud secrets need explicit enabling like file or mock sources.","solutions":["Remove --secret-source=cloud from the command; cloud secrets are available automatically","If you need cloud secrets with local execution, run 'k6 cloud run --local-execution script.js', which fetches them without any --secret-source flag","For purely local testing without cloud access, use '--secret-source=mock=name=value' or '--secret-source=file=...' instead"],"exampleFix":"# before\nk6 run --secret-source=cloud script.js\n# after\nk6 cloud run --local-execution script.js","handlingStrategy":"validation","validationCode":"# Reject 'cloud' in the sources list before invoking k6\nfor s in \"${SOURCES[@]}\"; do\n  if [ \"${s%%=*}\" = \"cloud\" ]; then\n    echo \"--secret-source=cloud is not allowed; use 'k6 cloud run --local-execution'\" >&2\n    exit 2\n  fi\ndone\nk6 run --secret-source=\"${SOURCES[0]}\" script.js","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Maintain separate flag sets per mode: --secret-source lists for 'k6 run', no secret-source flag for 'k6 cloud run --local-execution'","Document in CI templates that cloud secrets require no flag","Treat exit code 104 as a configuration error and stop the pipeline immediately"],"tags":["cli","configuration","secrets","cloud","exit-code-104"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}