elastic/elasticsearch · error · IllegalArgumentException

Unknown secure settings source [${source}]

Error message

Unknown secure settings source [${source}]

What it means

Thrown by ServerCli.secureSettingsLoader when the `es.secure_settings.source` system property is set to a value other than the two supported sources (`keystore` or `file_settings`). The property is typically injected via CLI_JAVA_OPTS by the launcher scripts to select which SecureSettingsLoader implementation bootstraps the node's secrets. An unknown value means the node cannot decide how to load secure settings, so it fails fast with an IllegalArgumentException rather than silently running with no secrets.

Source

Thrown at distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/ServerCli.java:310

        envVars.remove("ES_JAVA_OPTS");
        return envVars;
    }

    protected static byte[] serializeServerArgs(ServerArgs args) throws IOException {
        try (BytesStreamOutput out = new BytesStreamOutput()) {
            args.writeTo(out);
            return BytesReference.toBytes(out.bytes());
        }
    }

    // protected to allow tests to override
    protected SecureSettingsLoader secureSettingsLoader(ProcessInfo processInfo) {
        // The SecureSettingsLoader is configured by a CLI sys prop `es.secure_settings.source` via `CLI_JAVA_OPTS`
        String source = processInfo.sysprops().getOrDefault("es.secure_settings.source", "keystore");
        return switch (source) {
            case "keystore" -> new KeyStoreLoader();
            case "file_settings" -> new FileSettingsClusterSecretsLoader();
            default -> throw new IllegalArgumentException("Unknown secure settings source [" + source + "]");
        };
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Check the effective value: `echo $ES_JAVA_OPTS` and any jvm.options files for `es.secure_settings.source`.
2. Set the property to either `keystore` (default, reads the ES keystore) or `file_settings` (reads cluster secrets from the file-based settings).
3. Remove the property entirely to fall back to the default `keystore` loader.
4. If you genuinely need a custom source, subclass ServerCli and override secureSettingsLoader(ProcessInfo) in a custom distribution.

Example fix

// before
export ES_JAVA_OPTS="-Des.secure_settings.source=env"
// after
export ES_JAVA_OPTS="-Des.secure_settings.source=file_settings"
// or simply omit it to use the default keystore loader

static final Set<String> VALID_SOURCES = Set.of("keystore", "file_settings");
String src = System.getProperty("es.secure_settings.source", "keystore");
if (!VALID_SOURCES.contains(src)) {
    throw new IllegalArgumentException("Unsupported es.secure_settings.source=" + src + "; valid: " + VALID_SOURCES);
}

static boolean isValidSecureSettingsSource(String s) {
    return s != null && (s.equals("keystore") || s.equals("file_settings"));
}

try {
    SecureSettingsLoader loader = cli.secureSettingsLoader(processInfo);
} catch (IllegalArgumentException e) {
    // surface the supported values to the operator, fall back to default keystore if appropriate
    log.error("Invalid es.secure_settings.source; supported: keystore, file_settings", e);
    throw e;
}

When it happens

Trigger: Setting `-Des.secure_settings.source=auto`, `env`, `vault`, or any other unsupported identifier via ES_JAVA_OPTS, jvm.options, or a custom launcher script. Also occurs on downgrade: a config using `file_settings` run by an older binary that only knows `keystore`.

Common situations: Typo in the source name. Copying a config from a newer Elasticsearch version that supports `file_settings` into an older installation. Custom Docker images that hardcode an unsupported source. Misreading docs that only list `keystore` and `file_settings` as valid.

Related errors

• CONFIG
• USAGE
• CONFIG
• Directory for entitlement bridge jar does not exist: ${dir}
• Failed to parse value [{}] as only [true] or [false] are all

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/da8f3bea2703c381. Report an issue: GitHub.