{"record":{"id":"3215d065a2cfcac5","repo":"grafana/k6","slug":"cloud-secrets-not-configured-no-secrets-configura","errorCode":null,"errorMessage":"cloud secrets not configured: no secrets configuration available. When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets","messagePattern":"cloud secrets not configured: no secrets configuration available\\. When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/secretsource/cloud/cloud.go","lineNumber":82,"sourceCode":"// SetConfig stores the cloud secrets configuration. Called from createCloudTest once the\n// CreateTestRun API response is available, before any VU goroutine can call Get().\nfunc (cs *SecretSource) SetConfig(c *Config) {\n\tcs.configPtr.Store(c)\n}\n\n// Description returns a description of this secret source.\nfunc (cs *SecretSource) Description() string {\n\treturn \"Grafana Cloud k6 secret source\"\n}\n\n// notConfiguredError explains why no secrets configuration is available. When a test run is\n// reused via the K6_CLOUD_PUSH_REF_ID env var, CreateTestRun is skipped (see #5814) so the\n// config can't come from its response and must instead be supplied via the K6_CLOUD_SECRETS_*\n// env vars; otherwise the generic 'k6 cloud run --local-execution' guidance applies (#6050).\nfunc (cs *SecretSource) notConfiguredError() error {\n\tconst prefix = \"cloud secrets not configured: no secrets configuration available. \"\n\tif cs.params.Environment[\"K6_CLOUD_PUSH_REF_ID\"] != \"\" {\n\t\treturn errors.New(prefix +\n\t\t\t\"When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set \" +\n\t\t\t\"K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets\")\n\t}\n\treturn errors.New(prefix +\n\t\t\"Make sure you're using 'k6 cloud run --local-execution' and the cloud API \" +\n\t\t\"returned secrets configuration\")\n}\n\n// ensureInitialized builds (or rebuilds) the URL source from configPtr.\nfunc (cs *SecretSource) ensureInitialized() (secretsource.Source, error) {\n\tcs.mu.Lock()\n\tdefer cs.mu.Unlock()\n\n\tcurrent := cs.configPtr.Load()\n\n\t// Re-use the cached source if the config pointer is unchanged.\n\tif cs.activeCfg == current && (cs.urlSource != nil || cs.initErr != nil) {\n\t\treturn cs.urlSource, cs.initErr","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/secretsource/cloud/cloud.go#L64-L100","documentation":"Returned by the Grafana Cloud k6 secret source when no secrets configuration was ever provided and K6_CLOUD_PUSH_REF_ID is set. When a run is reused via push ref id, CreateTestRun is skipped (issue #5814), so the secrets config cannot come from the API response and must be supplied via K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT.","triggerScenarios":"Running with K6_CLOUD_PUSH_REF_ID=<id> and a script that calls secret('name') (or otherwise activates the cloud secret source) while K6_CLOUD_SECRETS_TOKEN / K6_CLOUD_SECRETS_ENDPOINT are not exported; CI jobs that previously ran 'k6 cloud run --local-execution' and were switched to push-ref-id mode without carrying over the secrets env vars.","commonSituations":"Teams reusing a pre-provisioned test run from another service (e.g. a scheduler that creates the run and hands k6 only the ref id); drift between provisioning pipeline env and execution pipeline env; local reproductions of cloud runs where the developer only exported the push ref id.","solutions":["Export both K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT alongside K6_CLOUD_PUSH_REF_ID","If secrets are not needed in this run, remove the secret() calls from the script so the cloud secret source is never consulted","Have the provisioning service that owns the run also emit the secrets env vars into the execution environment"],"exampleFix":"# before\nexport K6_CLOUD_PUSH_REF_ID=123456\nk6 run script.js   # script uses secret('api_key') -> error\n\n# after\nexport K6_CLOUD_PUSH_REF_ID=123456\nexport K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN\nexport K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets\nk6 run script.js","handlingStrategy":"validation","validationCode":"if [ -n \"${K6_CLOUD_PUSH_REF_ID:-}\" ] && grep -q \"secret(\" script.js; then\n  : \"${K6_CLOUD_SECRETS_TOKEN:?required when reusing a run via K6_CLOUD_PUSH_REF_ID}\"\n  : \"${K6_CLOUD_SECRETS_ENDPOINT:?required when reusing a run via K6_CLOUD_PUSH_REF_ID}\"\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Have the provisioning service emit the full secrets env block together with the push ref id","Keep a CI matrix check: run reuse-mode jobs with and without secrets to catch missing env early","Document that push-ref-id reuse skips CreateTestRun, so nothing can come from the API response"],"tags":["k6","cloud","secrets","push-ref-id","env-vars"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}