grafana/k6 · error

104

104

Error message

'cloud' is not a valid value for --secret-source; cloud secrets are automatically available for 'k6 cloud run --local-execution'

What it means

'cloud' is deliberately not a valid --secret-source value: cloud secrets are injected automatically for 'k6 cloud run --local-execution' (or via K6_CLOUD_SECRETS_* env vars), so asking for it explicitly is always a mistake. validateNoCloudSecretSource rejects the whole command at startup with exit code 104 (InvalidConfig) and points at the correct usage.

Solutions

1. Remove --secret-source=cloud from the command
2. Use 'k6 cloud run --local-execution' — the 'cloud' source is registered and configured automatically
3. For local runs, inject the cloud source via K6_CLOUD_SECRETS_TOKEN (+ K6_CLOUD_SECRETS_ENDPOINT) instead of the flag

Example fix

# before
k6 cloud run --local-execution --secret-source=cloud script.js

# after
k6 cloud run --local-execution script.js

# reject 'cloud' entries before invoking k6
for entry in ${SECRET_SOURCES}; do
  type="${entry%%=*}"
  if [ "$type" = cloud ]; then
    echo "'cloud' is not a valid --secret-source; use: k6 cloud run --local-execution" >&2; exit 1
  fi
done

When it happens

Trigger: k6 run --secret-source=cloud script.js; k6 cloud run --local-execution --secret-source=cloud=... script.js. Any entry whose type is 'cloud' triggers it before any source is constructed.

Common situations: Users discovering the cloud secrets feature and assuming they must opt in via the flag; porting a local secret-source setup to cloud runs.

Related errors

• can't have two secret sources that are default ones, second…
• couldn't parse secret source configuration
• failed to initialize cloud secret source
• no secret source for type
• secret source for name

AI-assisted analysis of grafana/k6@8d06114777 (2026-08-18). Data as JSON: /api/errors/07091a117bda6945. Report an issue: GitHub.

Appendix: source

Thrown at internal/cmd/root.go:612

// hasCloudSecretSource returns true if the 'cloud' secret source type appears in sources.
func hasCloudSecretSource(sources []string) bool {
	for _, s := range sources {
		t, _, _ := strings.Cut(s, "=")
		if strings.TrimSpace(t) == "cloud" {
			return true
		}
	}
	return false
}

// validateNoCloudSecretSource returns an error if sources contains 'cloud', which is not
// a valid value for --secret-source. Cloud secrets are automatically available for
// 'k6 cloud run --local-execution' and do not require explicit configuration.
func validateNoCloudSecretSource(sources []string) error {
	if hasCloudSecretSource(sources) {
		return errext.WithExitCodeIfNone(
			fmt.Errorf("'cloud' is not a valid value for --secret-source; "+
				"cloud secrets are automatically available for 'k6 cloud run --local-execution'"),
			exitcodes.InvalidConfig,
		)
	}
	return nil
}

func extractNameAndDefault(config string) (name string, isDefault bool, remaining string) {
	list := strings.Split(config, ",")
	remainingArray := make([]string, 0, len(list))
	for _, kv := range list {
		if kv == "default" {
			isDefault = true
			continue
		}
		k, v, _ := strings.Cut(kv, "=")
		if k == "name" {
			name = v

View on GitHub (pinned to 8d06114777)