104

104

Error message

'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'

What it means

k6 rejects --secret-source=cloud because cloud secrets are not fetched through the generic secret-source mechanism. Cloud secrets are injected automatically when a test runs via 'k6 cloud run --local-execution', so listing 'cloud' as a secret source is always a configuration mistake. validateNoCloudSecretSource detects any 'cloud' entry during flag validation and k6 exits with code 104 (InvalidConfig).

Source

Thrown at internal/cmd/root.go:600

// hasCloudSecretSource returns true if the 'cloud' secret source type appears in sources.
func hasCloudSecretSource(sources []string) bool {
	for _, s := range sources {
		t, _, _ := strings.Cut(s, "=")
		if strings.TrimSpace(t) == "cloud" {
			return true
		}
	}
	return false
}

// validateNoCloudSecretSource returns an error if sources contains 'cloud', which is not
// a valid value for --secret-source. Cloud secrets are automatically available for
// 'k6 cloud run --local-execution' and do not require explicit configuration.
func validateNoCloudSecretSource(sources []string) error {
	if hasCloudSecretSource(sources) {
		return errext.WithExitCodeIfNone(
			fmt.Errorf("'cloud' is not a valid value for --secret-source; "+
				"cloud secrets are automatically available for 'k6 cloud run --local-execution'"),
			exitcodes.InvalidConfig,
		)
	}
	return nil
}

func extractNameAndDefault(config string) (name string, isDefault bool, remaining string) {
	list := strings.Split(config, ",")
	remainingArray := make([]string, 0, len(list))
	for _, kv := range list {
		if kv == "default" {
			isDefault = true
			continue
		}
		k, v, _ := strings.Cut(kv, "=")
		if k == "name" {
			name = v

View on GitHub (pinned to 93accf6570)

Solutions

Remove --secret-source=cloud from the command; cloud secrets are available automatically
If you need cloud secrets with local execution, run 'k6 cloud run --local-execution script.js', which fetches them without any --secret-source flag
For purely local testing without cloud access, use '--secret-source=mock=name=value' or '--secret-source=file=...' instead

Example fix

# before
k6 run --secret-source=cloud script.js
# after
k6 cloud run --local-execution script.js

Defensive patterns

Strategy: validation

Validate before calling

# Reject 'cloud' in the sources list before invoking k6
for s in "${SOURCES[@]}"; do
  if [ "${s%%=*}" = "cloud" ]; then
    echo "--secret-source=cloud is not allowed; use 'k6 cloud run --local-execution'" >&2
    exit 2
  fi
done
k6 run --secret-source="${SOURCES[0]}" script.js

Prevention

Maintain separate flag sets per mode: --secret-source lists for 'k6 run', no secret-source flag for 'k6 cloud run --local-execution'
Document in CI templates that cloud secrets require no flag
Treat exit code 104 as a configuration error and stop the pipeline immediately

When it happens

Trigger: Running any command with --secret-source=cloud, e.g. 'k6 run --secret-source=cloud script.js', or combining it with other sources (--secret-source=file,path --secret-source=cloud). hasCloudSecretSource() scans the parsed sources list and any 'cloud' entry triggers the error.

Common situations: Users migrate from cloud execution to local runs and copy the cloud secret configuration along; CI scripts reuse one --secret-source list for both 'k6 run' and 'k6 cloud run --local-execution'; users assume cloud secrets need explicit enabling like file or mock sources.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/07091a117bda6945. Report an issue: GitHub.