During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/node/Node.java
resourceWatcherService,
                    scriptService,
                    xContentRegistry,
                    environment,
                    nodeEnvironment,
                    namedWriteableRegistry,
                    clusterModule.getIndexNameExpressionResolver(),
                    repositoriesServiceReference::get,
                    telemetryProvider,
                    clusterModule.getAllocationService(),
                    indicesService
                )
            ).toList();
            List<ReservedClusterStateHandler<?>> reservedStateHandlers = new ArrayList<>();
            
            reservedStateHandlers.add(new ReservedClusterSettingsAction(settingsModule.getClusterSettings()));
            var templateService = new MetadataIndexTemplateService(
                clusterService,
                metadataCreateIndexService,
                indicesService,
                settingsModule.getIndexScopedSettings(),
                xContentRegistry,
                systemIndices,
                indexSettingProviders
            );
            reservedStateHandlers.add(new ReservedComposableIndexTemplateAction(templateService, settingsModule.getIndexScopedSettings()));
            
            List<? extends ReservedClusterStateHandlerProvider> pluginHandlers = pluginsService.loadServiceProviders(
                ReservedClusterStateHandlerProvider.class
            );