During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/node/Node.java
private final SetOnce<TerminationHandler> terminationHandler = new SetOnce<>();
    
    final NamedWriteableRegistry namedWriteableRegistry;
    final NamedXContentRegistry namedXContentRegistry;
    /**
     * Constructs a node
     *
     * @param environment         the initial environment for this node, which will be added to by plugins
     */
    public Node(Environment environment) {
        this(environment, PluginsService.getPluginsServiceCtor(environment), true);
    }
    /**
     * Constructs a node
     *
     * @param initialEnvironment         the initial environment for this node, which will be added to by plugins
     * @param pluginServiceCtor          a function that takes a {@link Settings} object and returns a {@link PluginsService}
     * @param forbidPrivateIndexSettings whether or not private index settings are forbidden when creating an index; this is used in the
     *                                   test framework for tests that rely on being able to set private settings
     */
    @SuppressWarnings("this-escape")
    protected Node(
        final Environment initialEnvironment,
        final Function<Settings, PluginsService> pluginServiceCtor,
        boolean forbidPrivateIndexSettings
    ) {
        final List<Closeable> resourcesToClose = new ArrayList<>(); 
        boolean success = false;
        try {