{"record":{"id":"8475134ea41232da","repo":"elastic/elasticsearch","slug":"bootstrapping-cluster-secrets-in-file-settings-is","errorCode":null,"errorMessage":"Bootstrapping cluster secrets in file settings is not supported","messagePattern":"Bootstrapping cluster secrets in file settings is not supported","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/FileSettingsClusterSecretsLoader.java","lineNumber":54,"sourceCode":" */\npublic class FileSettingsClusterSecretsLoader implements SecureSettingsLoader {\n\n    @Override\n    public LoadedSecrets load(Environment environment, Terminal terminal) {\n        Path fileSettings = ReservedStateHandler.reservedStateSettingsPath(environment);\n        var reservedStateSecrets = readClusterSecrets(fileSettings);\n        if (reservedStateSecrets != SecureClusterStateSettings.EMPTY) {\n            terminal.println(\"Using cluster secrets from file settings [\" + fileSettings + \"]\");\n            return new LoadedSecrets(reservedStateSecrets, Optional.empty());\n        }\n\n        terminal.println(\"No cluster secrets available from file settings [\" + fileSettings + \"]\");\n        return new LoadedSecrets(SecureClusterStateSettings.EMPTY, Optional.empty());\n    }\n\n    @Override\n    public SecureSettings bootstrap(Environment environment, SecureString password) {\n        throw new IllegalArgumentException(\"Bootstrapping cluster secrets in file settings is not supported\");\n    }\n\n    @Override\n    public boolean supportsSecurityAutoConfiguration() {\n        return false;\n    }\n\n    /**\n     * Reads {@code cluster_secrets} from the provided settings file, returning {@link SecureClusterStateSettings#EMPTY}\n     * if it doesn't exist.\n     *\n     * <p>An example {@code settings.json} might contain the following:\n     * <pre>\n     * {\n     *     \"state\": {\n     *         \"cluster_secrets\": {\n     *             \"string_secrets\": {\n     *                 \"secure.setting.key.one\": \"aaa\",","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/FileSettingsClusterSecretsLoader.java#L36-L72","documentation":"Thrown by FileSettingsClusterSecretsLoader.bootstrap() — an unimplemented operation. The file-settings secrets loader reads cluster_secrets from a settings file but cannot create/bootstrap new ones; auto-configuration of security is only supported for keystore-based secure settings (see supportsSecurityAutoConfiguration() returns false).","triggerScenarios":"ServerCli calls secureSettingsLoader.bootstrap(env, password) when supportsSecurityAutoConfiguration() is true. FileSettingsClusterSecretsLoader returns false for that check, so this path should be unreachable in normal flow — hitting it indicates a logic error where bootstrap() was called despite the loader not supporting it.","commonSituations":"Custom ServerCli subclass or a code change that bypasses the supportsSecurityAutoConfiguration guard; misconfigured secure-settings loader wiring in a fork.","solutions":["Ensure bootstrap() is only called when supportsSecurityAutoConfiguration() returns true.","If you need to bootstrap security, use the keystore-based SecureSettingsLoader, not the file-settings one.","Provide cluster_secrets in the file settings upfront rather than relying on auto-bootstrap."],"exampleFix":"// before\nSecureSettings secrets = loader.bootstrap(env, password); // called unconditionally\n\n// after\nif (loader.supportsSecurityAutoConfiguration()) {\n    env = autoConfigureSecurity(terminal, options, processInfo, env, password);\n    secrets = loader.bootstrap(env, password);\n}","handlingStrategy":"validation","validationCode":"if (loader.supportsSecurityAutoConfiguration()) {\n    SecureSettings secrets = loader.bootstrap(env, password);\n} else {\n    throw new IllegalStateException(\"This secure-settings loader does not support bootstrap; use keystore-based loader.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always gate bootstrap() behind supportsSecurityAutoConfiguration().","Use the keystore-based loader when you need auto security configuration.","Provide cluster_secrets in file settings rather than relying on bootstrap."],"tags":["security","secure-settings","bootstrap","internal"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}