{"record":{"id":"50ad6e1e3334a30d","repo":"grafana/k6","slug":"failed-to-initialize-cloud-secret-source-w","errorCode":null,"errorMessage":"failed to initialize cloud secret source: %w","messagePattern":"failed to initialize cloud secret source: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmd/root.go","lineNumber":560,"sourceCode":"\tif len(result) == 1 {\n\t\tfor _, l := range result {\n\t\t\tresult[\"default\"] = l\n\t\t}\n\t}\n\n\t// Capture the cloud source instance if it was registered (via local-execution auto-injection\n\t// or the env-var path below), so createCloudTest can call SetConfig on it later.\n\tif cs, ok := result[\"cloud\"].(*cloudsecrets.SecretSource); ok {\n\t\tgs.CloudSecretSource = cs\n\t}\n\n\t// When  K6_CLOUD_SECRETS_TOKEN + K6_CLOUD_SECRETS_ENDPOINT are injected, create and configure the cloud source\n\t// directly from env vars without a /v1/tests round-trip. Set it as the default source if none was chosen.\n\tif token := gs.Env[\"K6_CLOUD_SECRETS_TOKEN\"]; token != \"\" {\n\t\tif gs.CloudSecretSource == nil {\n\t\t\tcloudSource, err := cloudsecrets.New(baseParams)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to initialize cloud secret source: %w\", err)\n\t\t\t}\n\t\t\tresult[\"cloud\"] = cloudSource\n\t\t\tgs.CloudSecretSource = cloudSource\n\t\t}\n\t\tgs.CloudSecretSource.SetConfig(&cloudsecrets.Config{\n\t\t\tToken:        token,\n\t\t\tEndpoint:     gs.Env[\"K6_CLOUD_SECRETS_ENDPOINT\"],\n\t\t\tResponsePath: gs.Env[\"K6_CLOUD_SECRETS_RESPONSE_PATH\"],\n\t\t})\n\t\tif _, ok := result[\"default\"]; !ok {\n\t\t\tresult[\"default\"] = gs.CloudSecretSource\n\t\t}\n\t}\n\n\treturn result, nil\n}\n\n// isCloudRunWithLocalExecution returns true when the command being executed is","sourceCodeStart":542,"sourceCodeEnd":578,"githubUrl":"https://github.com/grafana/k6/blob/8d06114777191d21ef885d05c5f8aa9e1ed838ae/internal/cmd/root.go#L542-L578","documentation":"When K6_CLOUD_SECRETS_TOKEN is set in the environment and no cloud secret source was registered yet, k6 constructs one with cloudsecrets.New(baseParams). If that constructor fails, the cause is wrapped as 'failed to initialize cloud secret source: <cause>' — the text after the colon is the real reason. The cloud source (and its SetConfig with token/endpoint/response-path) is only wired up after successful construction.","triggerScenarios":"Exporting K6_CLOUD_SECRETS_TOKEN (even accidentally, e.g. from a CI base image or stale shell profile) in an environment where the cloud secret source constructor rejects its params; the wrapped error names the exact parameter/config problem.","commonSituations":"CI images that pre-set all K6_CLOUD_SECRETS_* variables; local shells with leftover exports from a previous cloud experiment; partially migrated configs (token set, endpoint malformed).","solutions":["Read the ': <cause>' suffix — fix whatever the wrapped constructor error names","If you did not intend to use cloud secrets, unset the variables: unset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH","If you do use them, correct the related env vars (token present, endpoint URL well-formed) and rerun","For managed cloud runs prefer 'k6 cloud run --local-execution', which injects the cloud source automatically"],"exampleFix":"# before\nexport K6_CLOUD_SECRETS_TOKEN=tok\nk6 run script.js   # fails to initialize cloud secret source\n\n# after\nunset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH\nk6 run script.js","handlingStrategy":"validation","validationCode":"# preflight: know whether cloud-secret env vars are present\nif [ -n \"${K6_CLOUD_SECRETS_TOKEN:-}\" ]; then\n  echo \"K6_CLOUD_SECRETS_TOKEN is set — cloud secret source will be initialized\" >&2\n  # unset if unintended:\n  # unset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH\nfi\nk6 run script.js","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit CI base images and shell profiles for stray K6_CLOUD_SECRETS_* exports","When enabling cloud secrets on purpose, set token AND endpoint together and test with a smoke script first","Read the wrapped cause after the colon — it names the actual constructor problem"],"tags":["k6","cloud","secrets","environment-variables","config"],"backgroundTag":"credentials-initialization-failed","analyzedSha":"8d06114777191d21ef885d05c5f8aa9e1ed838ae","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":"2026-08-18T03:05:52.393Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}