During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/cluster/desirednodes/DesiredNodesSettingsValidator.java
private record DesiredNodeValidationError(int position, @Nullable String externalId, RuntimeException exception) {}
    private final ClusterSettings clusterSettings;
    public DesiredNodesSettingsValidator(ClusterSettings clusterSettings) {
        this.clusterSettings = clusterSettings;
    }
    public void validate(List<DesiredNode> nodes) {
        final List<DesiredNodeValidationError> validationErrors = new ArrayList<>();
        for (int i = 0; i < nodes.size(); i++) {
            final DesiredNode node = nodes.get(i);
            try {
                validate(node);
            } catch (IllegalArgumentException e) {
                validationErrors.add(new DesiredNodeValidationError(i, node.externalId(), e));
            }
        }
        if (validationErrors.isEmpty() == false) {
            final String nodeIndicesWithFailures = validationErrors.stream()
                .map(DesiredNodeValidationError::position)
                .map(i -> Integer.toString(i))