cloud secrets not configured: no secrets configuration avail

Error message

cloud secrets not configured: no secrets configuration available. When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets

What it means

Returned by the Grafana Cloud k6 secret source when no secrets configuration was ever provided and K6_CLOUD_PUSH_REF_ID is set. When a run is reused via push ref id, CreateTestRun is skipped (issue #5814), so the secrets config cannot come from the API response and must be supplied via K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT.

Source

Thrown at internal/secretsource/cloud/cloud.go:82

// SetConfig stores the cloud secrets configuration. Called from createCloudTest once the
// CreateTestRun API response is available, before any VU goroutine can call Get().
func (cs *SecretSource) SetConfig(c *Config) {
	cs.configPtr.Store(c)
}

// Description returns a description of this secret source.
func (cs *SecretSource) Description() string {
	return "Grafana Cloud k6 secret source"
}

// notConfiguredError explains why no secrets configuration is available. When a test run is
// reused via the K6_CLOUD_PUSH_REF_ID env var, CreateTestRun is skipped (see #5814) so the
// config can't come from its response and must instead be supplied via the K6_CLOUD_SECRETS_*
// env vars; otherwise the generic 'k6 cloud run --local-execution' guidance applies (#6050).
func (cs *SecretSource) notConfiguredError() error {
	const prefix = "cloud secrets not configured: no secrets configuration available. "
	if cs.params.Environment["K6_CLOUD_PUSH_REF_ID"] != "" {
		return errors.New(prefix +
			"When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set " +
			"K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets")
	}
	return errors.New(prefix +
		"Make sure you're using 'k6 cloud run --local-execution' and the cloud API " +
		"returned secrets configuration")
}

// ensureInitialized builds (or rebuilds) the URL source from configPtr.
func (cs *SecretSource) ensureInitialized() (secretsource.Source, error) {
	cs.mu.Lock()
	defer cs.mu.Unlock()

	current := cs.configPtr.Load()

	// Re-use the cached source if the config pointer is unchanged.
	if cs.activeCfg == current && (cs.urlSource != nil || cs.initErr != nil) {
		return cs.urlSource, cs.initErr

View on GitHub (pinned to 93accf6570)

Solutions

Export both K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT alongside K6_CLOUD_PUSH_REF_ID
If secrets are not needed in this run, remove the secret() calls from the script so the cloud secret source is never consulted
Have the provisioning service that owns the run also emit the secrets env vars into the execution environment

Example fix

# before
export K6_CLOUD_PUSH_REF_ID=123456
k6 run script.js   # script uses secret('api_key') -> error

# after
export K6_CLOUD_PUSH_REF_ID=123456
export K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN
export K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets
k6 run script.js

Defensive patterns

Strategy: validation

Validate before calling

if [ -n "${K6_CLOUD_PUSH_REF_ID:-}" ] && grep -q "secret(" script.js; then
  : "${K6_CLOUD_SECRETS_TOKEN:?required when reusing a run via K6_CLOUD_PUSH_REF_ID}"
  : "${K6_CLOUD_SECRETS_ENDPOINT:?required when reusing a run via K6_CLOUD_PUSH_REF_ID}"
fi

Prevention

Have the provisioning service emit the full secrets env block together with the push ref id
Keep a CI matrix check: run reuse-mode jobs with and without secrets to catch missing env early
Document that push-ref-id reuse skips CreateTestRun, so nothing can come from the API response

When it happens

Trigger: Running with K6_CLOUD_PUSH_REF_ID=<id> and a script that calls secret('name') (or otherwise activates the cloud secret source) while K6_CLOUD_SECRETS_TOKEN / K6_CLOUD_SECRETS_ENDPOINT are not exported; CI jobs that previously ran 'k6 cloud run --local-execution' and were switched to push-ref-id mode without carrying over the secrets env vars.

Common situations: Teams reusing a pre-provisioned test run from another service (e.g. a scheduler that creates the run and hands k6 only the ref id); drift between provisioning pipeline env and execution pipeline env; local reproductions of cloud runs where the developer only exported the push ref id.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/3215d065a2cfcac5. Report an issue: GitHub.