During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/internalClusterTest/java/org/elasticsearch/action/admin/cluster/desirednodes/TransportDesiredNodesActionsIT.java
UpdateDesiredNodesResponse dryRunResponse = updateDesiredNodes(
            randomDryRunUpdateDesiredNodesRequest(Version.CURRENT, Settings.EMPTY)
        );
        assertThat(dryRunResponse.dryRun(), is(equalTo(true)));
        assertEquals(getLatestDesiredNodes(), desiredNodes);
    }
    public void testSettingsAreValidatedWithDryRun() {
        var exception = expectThrows(
            IllegalArgumentException.class,
            () -> updateDesiredNodes(
                randomDryRunUpdateDesiredNodesRequest(
                    Version.CURRENT,
                    Settings.builder().put(SETTING_HTTP_TCP_KEEP_IDLE.getKey(), Integer.MIN_VALUE).build()
                )
            )
        );
        assertThat(exception.getMessage(), containsString("contain invalid settings"));
    }
    public void testUpdateDesiredNodesIsIdempotent() {
        final var updateDesiredNodesRequest = randomUpdateDesiredNodesRequest();
        updateDesiredNodes(updateDesiredNodesRequest);
        final List<DesiredNode> desiredNodesList = new ArrayList<>(updateDesiredNodesRequest.getNodes());
        if (randomBoolean()) {
            Collections.shuffle(desiredNodesList, random());
        }
        final var equivalentUpdateRequest = new UpdateDesiredNodesRequest(
            updateDesiredNodesRequest.getHistoryID(),
            updateDesiredNodesRequest.getVersion(),
            desiredNodesList,
            false