elastic/elasticsearch · error · IllegalArgumentException

Bootstrapping cluster secrets in file settings is not suppor

Error message

Bootstrapping cluster secrets in file settings is not supported

What it means

Thrown by FileSettingsClusterSecretsLoader.bootstrap() — an unimplemented operation. The file-settings secrets loader reads cluster_secrets from a settings file but cannot create/bootstrap new ones; auto-configuration of security is only supported for keystore-based secure settings (see supportsSecurityAutoConfiguration() returns false).

Source

Thrown at distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/FileSettingsClusterSecretsLoader.java:54

 */
public class FileSettingsClusterSecretsLoader implements SecureSettingsLoader {

    @Override
    public LoadedSecrets load(Environment environment, Terminal terminal) {
        Path fileSettings = ReservedStateHandler.reservedStateSettingsPath(environment);
        var reservedStateSecrets = readClusterSecrets(fileSettings);
        if (reservedStateSecrets != SecureClusterStateSettings.EMPTY) {
            terminal.println("Using cluster secrets from file settings [" + fileSettings + "]");
            return new LoadedSecrets(reservedStateSecrets, Optional.empty());
        }

        terminal.println("No cluster secrets available from file settings [" + fileSettings + "]");
        return new LoadedSecrets(SecureClusterStateSettings.EMPTY, Optional.empty());
    }

    @Override
    public SecureSettings bootstrap(Environment environment, SecureString password) {
        throw new IllegalArgumentException("Bootstrapping cluster secrets in file settings is not supported");
    }

    @Override
    public boolean supportsSecurityAutoConfiguration() {
        return false;
    }

    /**
     * Reads {@code cluster_secrets} from the provided settings file, returning {@link SecureClusterStateSettings#EMPTY}
     * if it doesn't exist.
     *
     * <p>An example {@code settings.json} might contain the following:
     * <pre>
     * {
     *     "state": {
     *         "cluster_secrets": {
     *             "string_secrets": {
     *                 "secure.setting.key.one": "aaa",

View on GitHub (pinned to db6a809a66)

Solutions

Ensure bootstrap() is only called when supportsSecurityAutoConfiguration() returns true.
If you need to bootstrap security, use the keystore-based SecureSettingsLoader, not the file-settings one.
Provide cluster_secrets in the file settings upfront rather than relying on auto-bootstrap.

Example fix

// before
SecureSettings secrets = loader.bootstrap(env, password); // called unconditionally

// after
if (loader.supportsSecurityAutoConfiguration()) {
    env = autoConfigureSecurity(terminal, options, processInfo, env, password);
    secrets = loader.bootstrap(env, password);
}

Defensive patterns

Strategy: validation

Validate before calling

if (loader.supportsSecurityAutoConfiguration()) {
    SecureSettings secrets = loader.bootstrap(env, password);
} else {
    throw new IllegalStateException("This secure-settings loader does not support bootstrap; use keystore-based loader.");
}

Prevention

Always gate bootstrap() behind supportsSecurityAutoConfiguration().
Use the keystore-based loader when you need auto security configuration.
Provide cluster_secrets in file settings rather than relying on bootstrap.

When it happens

Trigger: ServerCli calls secureSettingsLoader.bootstrap(env, password) when supportsSecurityAutoConfiguration() is true. FileSettingsClusterSecretsLoader returns false for that check, so this path should be unreachable in normal flow — hitting it indicates a logic error where bootstrap() was called despite the loader not supporting it.

Common situations: Custom ServerCli subclass or a code change that bypasses the supportsSecurityAutoConfiguration guard; misconfigured secure-settings loader wiring in a fork.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/8475134ea41232da. Report an issue: GitHub.