During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/test/java/org/elasticsearch/action/admin/cluster/desirednodes/TransportUpdateDesiredNodesActionTests.java
final var latestDesiredNodes = TransportUpdateDesiredNodesAction.updateDesiredNodes(null, updateDesiredNodesRequest);
        final UpdateDesiredNodesRequest request = new UpdateDesiredNodesRequest(
            latestDesiredNodes.historyID(),
            latestDesiredNodes.version(),
            randomList(1, 10, DesiredNodesTestCase::randomDesiredNode),
            false
        );
        IllegalArgumentException exception = expectThrows(
            IllegalArgumentException.class,
            () -> TransportUpdateDesiredNodesAction.updateDesiredNodes(latestDesiredNodes, request)
        );
        assertThat(exception.getMessage(), containsString("already exists with a different definition"));
    }
    public void testBackwardUpdatesFails() {
        final var updateDesiredNodesRequest = randomUpdateDesiredNodesRequest();
        final var latestDesiredNodes = TransportUpdateDesiredNodesAction.updateDesiredNodes(null, updateDesiredNodesRequest);
        final UpdateDesiredNodesRequest request = new UpdateDesiredNodesRequest(
            latestDesiredNodes.historyID(),
            latestDesiredNodes.version() - 1,
            List.copyOf(latestDesiredNodes.nodes().stream().map(DesiredNodeWithStatus::desiredNode).toList()),
            false
        );
        VersionConflictException exception = expectThrows(
            VersionConflictException.class,
            () -> TransportUpdateDesiredNodesAction.updateDesiredNodes(latestDesiredNodes, request)
        );
        assertThat(exception.getMessage(), containsString("has been superseded by version"));
    }
}