What causes "failed to dial: %w" in grafana/k6?

Verify reachability from the same environment: 'nc -vz ' and 'openssl s_client -connect host:port'

failed to dial: %w

Error message

failed to dial: %w

What it means

Client.Dial (internal/cloudapi/insights/client.go:148-155) calls grpc.DialContext against cfg.IngesterHost within ConnectConfig.Timeout; when the connection cannot be established in that window (the config can set WithBlock and FailOnNonTempDialError, client.go:210-216, making failures eager and non-retryable at dial time) the error is wrapped as 'failed to dial'. It means the insights ingester endpoint was unreachable or refused the connection/TLS handshake.

Source

Thrown at internal/cloudapi/insights/client.go:153

func (c *Client) Dial(ctx context.Context) error {
	c.connMu.Lock()
	defer c.connMu.Unlock()

	if c.conn != nil {
		return ErrClientAlreadyInitialized
	}

	opts, err := dialOptionsFromClientConfig(c.cfg)
	if err != nil {
		return fmt.Errorf("failed to create dial options: %w", err)
	}

	ctx, cancel := context.WithTimeout(ctx, c.cfg.ConnectConfig.Timeout)
	defer cancel()

	conn, err := grpc.DialContext(ctx, c.cfg.IngesterHost, opts...) //nolint:staticcheck
	if err != nil {
		return fmt.Errorf("failed to dial: %w", err)
	}

	c.client = ingester.NewIngesterServiceClient(conn)
	c.conn = conn

	return nil
}

// IngestRequestMetadatasBatch ingests a batch of request metadatas.
func (c *Client) IngestRequestMetadatasBatch(ctx context.Context, requestMetadatas RequestMetadatas) error {
	c.connMu.RLock()
	closed := c.conn == nil
	c.connMu.RUnlock()
	if closed {
		return ErrClientClosed
	}

	if len(requestMetadatas) < 1 {

View on GitHub (pinned to 93accf6570)

Solutions

Verify reachability from the same environment: 'nc -vz <ingester-host> <port>' and 'openssl s_client -connect host:port'
Allow egress to the insights ingest endpoint in firewall/proxy policy (or route through the supported private-link setup)
If a custom CA is required, set TLSConfig.CertFile correctly (see error 'failed to load TLS credentials from file')
Increase the connect timeout if the network path legitimately needs longer, and re-run

Example fix

# before - egress blocked, dial times out
k6 cloud run --local-execution script.js   # failed to dial: context deadline exceeded

# after - allow the ingester host, then re-run
# (network policy): allow egress tcp/443 to insights.ingest.grafana.net
k6 cloud run --local-execution script.js

Defensive patterns

Strategy: retry

Validate before calling

# pre-flight from the same environment before the run
getent hosts insights.<your-ingest-host> >/dev/null || echo 'DNS for insights ingester missing'
nc -z -w 5 <ingester-host> 443 || echo 'egress to insights ingester blocked'

Try / catch

if err := client.Dial(ctx); err != nil {
    if strings.Contains(err.Error(), "failed to dial") {
        // network/TLS reachability issue: safe to retry after fixing egress; not a config-format error
    }
}

Prevention

Allowlist the insights ingestion host:443 in CI/Kubernetes egress policy alongside the API host
Keep runner clocks NTP-synced and CA bundles current so TLS handshakes succeed
Size ConnectConfig.Timeout for your real network latency before high-latitude deployments

When it happens

Trigger: DNS resolution failure or blocked egress to the insights ingester host:port; TLS handshake rejected (server requires client CA or TLS1.3 is stripped by a middlebox); ConnectConfig.Timeout too short for a high-latency path; wrong IngesterHost from the cloud runtime config.

Common situations: CI runners or Kubernetes clusters with egress allowlists that miss the insights ingestion domain; corporate TLS-intercepting proxies incompatible with gRPC; slow first-hop satellite links hitting the connect timeout.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/c2a9b0b19e1bacb0. Report an issue: GitHub.