{"record":{"id":"2ad2360192c1eeb2","repo":"grafana/k6","slug":"cloud-secrets-not-configured-no-secrets-configura-2ad236","errorCode":null,"errorMessage":"cloud secrets not configured: no secrets configuration available. Make sure you're using 'k6 cloud run --local-execution' and the cloud API returned secrets configuration","messagePattern":"cloud secrets not configured: no secrets configuration available\\. Make sure you're using 'k6 cloud run --local-execution' and the cloud API returned secrets configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/secretsource/cloud/cloud.go","lineNumber":86,"sourceCode":"}\n\n// Description returns a description of this secret source.\nfunc (cs *SecretSource) Description() string {\n\treturn \"Grafana Cloud k6 secret source\"\n}\n\n// notConfiguredError explains why no secrets configuration is available. When a test run is\n// reused via the K6_CLOUD_PUSH_REF_ID env var, CreateTestRun is skipped (see #5814) so the\n// config can't come from its response and must instead be supplied via the K6_CLOUD_SECRETS_*\n// env vars; otherwise the generic 'k6 cloud run --local-execution' guidance applies (#6050).\nfunc (cs *SecretSource) notConfiguredError() error {\n\tconst prefix = \"cloud secrets not configured: no secrets configuration available. \"\n\tif cs.params.Environment[\"K6_CLOUD_PUSH_REF_ID\"] != \"\" {\n\t\treturn errors.New(prefix +\n\t\t\t\"When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set \" +\n\t\t\t\"K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets\")\n\t}\n\treturn errors.New(prefix +\n\t\t\"Make sure you're using 'k6 cloud run --local-execution' and the cloud API \" +\n\t\t\"returned secrets configuration\")\n}\n\n// ensureInitialized builds (or rebuilds) the URL source from configPtr.\nfunc (cs *SecretSource) ensureInitialized() (secretsource.Source, error) {\n\tcs.mu.Lock()\n\tdefer cs.mu.Unlock()\n\n\tcurrent := cs.configPtr.Load()\n\n\t// Re-use the cached source if the config pointer is unchanged.\n\tif cs.activeCfg == current && (cs.urlSource != nil || cs.initErr != nil) {\n\t\treturn cs.urlSource, cs.initErr\n\t}\n\n\t// (Re-)initialize for the new config.\n\tcs.activeCfg = current","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/secretsource/cloud/cloud.go#L68-L104","documentation":"The default 'not configured' error from the Grafana Cloud k6 secret source when no push ref id is set and no secrets configuration arrived. The expected source of this configuration is the CreateTestRun API response during 'k6 cloud run --local-execution'; if the run is local-only ('k6 run') the cloud API is never called and the secret source has nothing to serve.","triggerScenarios":"Calling secret('name') in a plain 'k6 run' invocation without any cloud execution; running 'k6 cloud run' in a mode where the API response lacked secrets configuration; the cloud API not returning a secrets block for the test; a network/auth issue earlier that silently skipped config retrieval.","commonSituations":"Scripts with secret() calls run locally for debugging; CI that runs the same script both locally and in the cloud, failing only locally; tenants where the secrets feature is not enabled so the API response omits the config.","solutions":["Run via 'k6 cloud run --local-execution' so CreateTestRun returns the secrets configuration","For local dev, gate secret usage: fall back to env vars (__ENV) when cloud secrets are unavailable","Verify the cloud API actually returned secrets configuration for the test (check k6 debug logs / cloud UI test settings)"],"exampleFix":"// before\nconst apiKey = secret('api_key'); // fails on plain `k6 run`\n\n// after\nconst apiKey = __ENV.K6_CLOUD_RUN ? secret('api_key') : __ENV.API_KEY;\n// or always run with: k6 cloud run --local-execution script.js","handlingStrategy":"fallback","validationCode":"# Before running, decide the mode explicitly:\nif grep -q \"secret(\" script.js; then\n  # secrets require cloud execution context\n  exec k6 cloud run --local-execution script.js\nfi\nexec k6 run script.js","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default scripts that use secret() to 'k6 cloud run --local-execution' in your task runner","Provide a local env-var fallback for every cloud secret used in dev","Alert on this error in CI so accidental plain 'k6 run' of cloud scripts is caught"],"tags":["k6","cloud","secrets","local-execution","config"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}