During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/node/Node.java
return new HealthPeriodicLogger(settings, clusterService, client, healthService);
    }
    private RecoveryPlannerService getRecoveryPlannerService(
        ThreadPool threadPool,
        ClusterService clusterService,
        RepositoriesService repositoryService
    ) {
        final List<RecoveryPlannerService> recoveryPlannerServices = pluginsService.filterPlugins(RecoveryPlannerPlugin.class)
            .stream()
            .map(
                plugin -> plugin.createRecoveryPlannerService(
                    new ShardSnapshotsService(client, repositoryService, threadPool, clusterService)
                )
            )
            .filter(Optional::isPresent)
            .map(Optional::get)
            .toList();
        if (recoveryPlannerServices.isEmpty()) {
            return new PeerOnlyRecoveryPlannerService();
        } else if (recoveryPlannerServices.size() > 1) {
            throw new IllegalStateException("Expected a single RecoveryPlannerService but got: " + recoveryPlannerServices.size());
        }
        return recoveryPlannerServices.get(0);
    }
    private WriteLoadForecaster getWriteLoadForecaster(ThreadPool threadPool, Settings settings, ClusterSettings clusterSettings) {
        final List<ClusterPlugin> clusterPlugins = pluginsService.filterPlugins(ClusterPlugin.class);
        final List<WriteLoadForecaster> writeLoadForecasters = clusterPlugins.stream()
            .flatMap(clusterPlugin -> clusterPlugin.createWriteLoadForecasters(threadPool, settings, clusterSettings).stream())
            .toList();
        if (writeLoadForecasters.isEmpty()) {