grafana/k6 · error

can't have two secret sources that are default ones, second…

Error message

can't have two secret sources that are default ones, second one was %q

What it means

A secret source becomes the default when its comma-separated config contains the literal key 'default' (e.g. file,default=secrets.txt or mock,default). Only one default is allowed; a second entry containing 'default' fails registration with this error showing the second configuration line. If exactly one source is configured, k6 automatically promotes it to default, so the keyword is unnecessary in that case.

Solutions

1. Keep the 'default' key on exactly one --secret-source entry and remove it from the others
2. If you configure a single source only, drop the 'default' keyword — k6 makes it the default automatically

Example fix

# before
k6 run --secret-source=file,default=a.txt --secret-source=mock,default script.js

# after
k6 run --secret-source=file,default=a.txt --secret-source=mock script.js

# allow at most one entry containing the 'default' key
count=$(printf '%s\n' "$@" | grep -c '(^|,)default(,|=|$)' || true)
if [ "$count" -gt 1 ]; then echo "multiple default secret sources" >&2; exit 1; fi

When it happens

Trigger: --secret-source=file,default=a.txt --secret-source=mock,default; any two entries whose config lists both include 'default' (e.g. file,name=x,default=a --secret-source=url,default=...).

Common situations: Copy-pasting a 'default'-annotated flag into a command that already has one; attempting a fallback chain of secret sources (not supported via multiple defaults).

Related errors

• couldn't parse secret source configuration
• no secret source for type
• secret source for name
• 104
• failed to initialize cloud secret source

AI-assisted analysis of grafana/k6@8d06114777 (2026-08-18). Data as JSON: /api/errors/02a553f04a2cb75b. Report an issue: GitHub.

Appendix: source

Thrown at internal/cmd/root.go:536

		name, isDefault, config := extractNameAndDefault(config)
		if name == "" {
			// Default the name to the source type to avoid an empty-string key.
			name = t
		}
		params.ConfigArgument = config

		secretSource, err := c(params)
		if err != nil {
			return nil, err
		}
		_, alreadRegistered := result[name]
		if alreadRegistered {
			return nil, fmt.Errorf("secret source for name %q already registered before configuration %q", t, line)
		}
		result[name] = secretSource
		if isDefault {
			if _, ok := result["default"]; ok {
				return nil, fmt.Errorf("can't have two secret sources that are default ones, second one was %q", config)
			}
			result["default"] = secretSource
		}
	}

	if len(result) == 1 {
		for _, l := range result {
			result["default"] = l
		}
	}

	// Capture the cloud source instance if it was registered (via local-execution auto-injection
	// or the env-var path below), so createCloudTest can call SetConfig on it later.
	if cs, ok := result["cloud"].(*cloudsecrets.SecretSource); ok {
		gs.CloudSecretSource = cs
	}

	// When  K6_CLOUD_SECRETS_TOKEN + K6_CLOUD_SECRETS_ENDPOINT are injected, create and configure the cloud source

View on GitHub (pinned to 8d06114777)