grafana/k6 · error

no secret sources are configured

Error message

no secret sources are configured

What it means

The secrets manager (secretsource/manager.go:56-59) is built at startup from whatever secret sources the run configuration produced (internal/cmd/root.go:405-412, createSecretSources). Calling Manager.Get - which is what the k6/secrets JS module does - fails with this error when zero sources were configured, i.e. there is no secret backend for this execution at all. It is distinct from UnknownSourceError, which fires when sources exist but the requested name does not.

Source

Thrown at secretsource/manager.go:58

			cache[k] = cache["default"]
			continue
		}
		cache[k] = new(sync.Map)
	}
	sm := &Manager{
		hook:    hook,
		sources: sources,
		cache:   cache,
	}
	return sm, hook, nil
}

// Get is the way to get a secret for the provided source name and key of the secret.
// It can be used with the [DefaultSourceName].
// This automatically starts redacting the secret before returning it.
func (sm *Manager) Get(sourceName, key string) (string, error) {
	if len(sm.cache) == 0 {
		return "", errors.New("no secret sources are configured")
	}
	sourceCache, ok := sm.cache[sourceName]
	if !ok {
		return "", UnknownSourceError(sourceName)
	}
	v, ok := sourceCache.Load(key)
	if ok {
		return v.(string), nil //nolint:forcetypeassert
	}
	source := sm.sources[sourceName]
	value, err := source.Get(key)
	if err != nil {
		return "", err
	}
	sourceCache.Store(key, value)
	sm.hook.add(value)
	return value, err
}

View on GitHub (pinned to 93accf6570)

Solutions

1. Define the secrets in the Grafana Cloud k6 project and run via 'k6 cloud run --local-execution' so the backend provisions a secret source
2. If running locally without cloud, remove or stub the k6/secrets usage (pass values via env vars instead)
3. Update k6 so the secrets module and its cloud provisioning are supported
4. If embedding, register at least one source (e.g. the cloud secrets source) in the map passed to secretsource.NewManager

Example fix

// before - script.js (fails under plain `k6 run`)
import secrets from 'k6/secrets';
export default async function () {
  const token = await secrets.get('api_token');
}

// after - local runs read env, cloud runs read secrets
import secrets from 'k6/secrets';
const token = __ENV.K6_CLOUD_RUN
  ? await secrets.get('api_token')
  : __ENV.API_TOKEN;

// in the k6 script: degrade gracefully when no secret source exists
import secrets from 'k6/secrets';

async function getToken() {
  if (__ENV.K6_CLOUD_RUN) {
    try {
      return await secrets.get('api_token');
    } catch (e) {
      if (String(e).includes('no secret sources are configured')) {
        throw new Error('define secrets in the k6 project and run with --local-execution');
      }
      throw e;
    }
  }
  return __ENV.API_TOKEN;
}

When it happens

Trigger: A script calling k6/secrets.get('key') under plain 'k6 run' with no cloud provisioning; 'k6 cloud run --local-execution' against a project whose backend runtime config returned no secrets endpoint; an embedder constructing secretsource.NewManager with an empty map and then calling Get.

Common situations: Developing locally with 'k6 run' a script written for cloud execution that imports 'k6/secrets'; a Grafana Cloud k6 project where no secrets were defined; running an older k6 that predates the secrets module.

Related errors

• cloud secrets not configured: no secrets configuration avail
• metrics push URL is required
• 104
• Run `k6 cloud login` to authenticate, or check the docs for
• access token not configured

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/b6a7f50386d1dc49. Report an issue: GitHub.