{"record":{"id":"b6a7f50386d1dc49","repo":"grafana/k6","slug":"no-secret-sources-are-configured","errorCode":null,"errorMessage":"no secret sources are configured","messagePattern":"no secret sources are configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"secretsource/manager.go","lineNumber":58,"sourceCode":"\t\t\tcache[k] = cache[\"default\"]\n\t\t\tcontinue\n\t\t}\n\t\tcache[k] = new(sync.Map)\n\t}\n\tsm := &Manager{\n\t\thook:    hook,\n\t\tsources: sources,\n\t\tcache:   cache,\n\t}\n\treturn sm, hook, nil\n}\n\n// Get is the way to get a secret for the provided source name and key of the secret.\n// It can be used with the [DefaultSourceName].\n// This automatically starts redacting the secret before returning it.\nfunc (sm *Manager) Get(sourceName, key string) (string, error) {\n\tif len(sm.cache) == 0 {\n\t\treturn \"\", errors.New(\"no secret sources are configured\")\n\t}\n\tsourceCache, ok := sm.cache[sourceName]\n\tif !ok {\n\t\treturn \"\", UnknownSourceError(sourceName)\n\t}\n\tv, ok := sourceCache.Load(key)\n\tif ok {\n\t\treturn v.(string), nil //nolint:forcetypeassert\n\t}\n\tsource := sm.sources[sourceName]\n\tvalue, err := source.Get(key)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tsourceCache.Store(key, value)\n\tsm.hook.add(value)\n\treturn value, err\n}","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/secretsource/manager.go#L40-L76","documentation":"The secrets manager (secretsource/manager.go:56-59) is built at startup from whatever secret sources the run configuration produced (internal/cmd/root.go:405-412, createSecretSources). Calling Manager.Get - which is what the k6/secrets JS module does - fails with this error when zero sources were configured, i.e. there is no secret backend for this execution at all. It is distinct from UnknownSourceError, which fires when sources exist but the requested name does not.","triggerScenarios":"A script calling k6/secrets.get('key') under plain 'k6 run' with no cloud provisioning; 'k6 cloud run --local-execution' against a project whose backend runtime config returned no secrets endpoint; an embedder constructing secretsource.NewManager with an empty map and then calling Get.","commonSituations":"Developing locally with 'k6 run' a script written for cloud execution that imports 'k6/secrets'; a Grafana Cloud k6 project where no secrets were defined; running an older k6 that predates the secrets module.","solutions":["Define the secrets in the Grafana Cloud k6 project and run via 'k6 cloud run --local-execution' so the backend provisions a secret source","If running locally without cloud, remove or stub the k6/secrets usage (pass values via env vars instead)","Update k6 so the secrets module and its cloud provisioning are supported","If embedding, register at least one source (e.g. the cloud secrets source) in the map passed to secretsource.NewManager"],"exampleFix":"// before - script.js (fails under plain `k6 run`)\nimport secrets from 'k6/secrets';\nexport default async function () {\n  const token = await secrets.get('api_token');\n}\n\n// after - local runs read env, cloud runs read secrets\nimport secrets from 'k6/secrets';\nconst token = __ENV.K6_CLOUD_RUN\n  ? await secrets.get('api_token')\n  : __ENV.API_TOKEN;","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// in the k6 script: degrade gracefully when no secret source exists\nimport secrets from 'k6/secrets';\n\nasync function getToken() {\n  if (__ENV.K6_CLOUD_RUN) {\n    try {\n      return await secrets.get('api_token');\n    } catch (e) {\n      if (String(e).includes('no secret sources are configured')) {\n        throw new Error('define secrets in the k6 project and run with --local-execution');\n      }\n      throw e;\n    }\n  }\n  return __ENV.API_TOKEN;\n}","preventionTips":["Reserve k6/secrets for cloud-provisioned runs; use env vars for local runs","Define and verify secrets in the Grafana Cloud k6 project before wiring scripts to them","Distinguish this error from UnknownSourceError - it means zero sources configured, not a wrong source name"],"tags":["secrets","configuration","cloud","local-execution"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}