observabilityPractitioner

Secrets Management in Grafana Cloud k6: Secure Your Performance Tests

5 min read Grafana Blog

Practitioner — Hands-on experience recommended

In today's world, performance testing often involves sensitive information like API tokens or credentials. The challenge is ensuring that these secrets are not exposed in your code or version control systems. Grafana Cloud k6 addresses this problem with its secrets management feature, which allows you to securely store and use sensitive values in your load tests. This capability is crucial for maintaining security while ensuring that your tests can be reused across different environments without modification.

Secrets management in Grafana Cloud k6 works by storing sensitive values centrally and injecting them into your tests at runtime. This means you can keep your scripts clean and free from hardcoded secrets. A key design principle is that secret values are write-only in the UI; once created, they cannot be read back or displayed. This minimizes the risk of accidental exposure. For example, you can retrieve a secret like an API token using the secrets.get method in your test scripts, ensuring that sensitive information remains secure throughout the testing process.

In production, remember that editing a secret does not reveal its current value; you must provide a new value to replace the existing one. Additionally, if a secret is accidentally logged, it will be redacted automatically, preventing exposure in your logs. Secrets management in Grafana Cloud k6 is currently available in public preview, so you can start leveraging this feature to enhance your performance testing security today.

Key takeaways

→Utilize secrets management to securely store sensitive values in your load tests.
→Remember that secret values are write-only in the UI; they cannot be read back after creation.
→Inject secrets at runtime to keep your scripts clean and avoid accidental leaks.
→Be aware that editing a secret requires providing a new value, not revealing the old one.
→Ensure that accidentally logged secrets are automatically redacted in your logs.

Why it matters

In production, protecting sensitive data during performance testing is non-negotiable. Secrets management helps prevent leaks and maintains compliance with security standards.

Code examples

JavaScript

1import check from "k6";
2import http from 'k6/http';
3import secrets from 'k6/secrets';
4
5export default async function main () {
6    const apiToken = await secrets.get('api-token');
7    const headers = {
8        Authorization: `Bearer ${apiToken}`,
9    };
10    console.log("Headers: " + JSON.stringify(headers))
11
12     let res = http.get('https://example.com/api', {headers: headers});
13     check(res, { "get executions status is 200": (res) => res.status === 200 });
14}