During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/cluster/desirednodes/DesiredNodesSettingsValidator.java
.collect(Collectors.joining(","));
            final String nodeIdsWithFailures = validationErrors.stream()
                .map(DesiredNodeValidationError::externalId)
                .collect(Collectors.joining(","));
            IllegalArgumentException invalidSettingsException = new IllegalArgumentException(
                format(
                    Locale.ROOT,
                    "Nodes with ids [%s] in positions [%s] contain invalid settings",
                    nodeIdsWithFailures,
                    nodeIndicesWithFailures
                )
            );
            for (DesiredNodeValidationError exceptionTuple : validationErrors) {
                invalidSettingsException.addSuppressed(exceptionTuple.exception);
            }
            throw invalidSettingsException;
        }
    }
    private void validate(DesiredNode node) {
        if (node.version().before(Version.CURRENT)) {
            throw new IllegalArgumentException(
                format(
                    Locale.ROOT,
                    "Illegal node version [%s]. Only [%s] or newer versions are supported",
                    node.version(),
                    Build.current().version()
                )
            );
        }