[[secure-settings]]
=== Secure settings

Some settings are sensitive, and relying on filesystem permissions to protect
their values is not sufficient. For this use case, {es} provides a
keystore and the <<elasticsearch-keystore,`elasticsearch-keystore` tool>> to
manage the settings in the keystore.

IMPORTANT: Only some settings are designed to be read from the keystore.
Adding unsupported settings to the keystore causes the validation in the
`_nodes/reload_secure_settings` API to fail and if not addressed, will
cause {es} to fail to start. To see whether a setting is supported in the
keystore, look for a "Secure" qualifier in the setting reference.

All the modifications to the keystore take effect only after restarting {es}.

These settings, just like the regular ones in the `elasticsearch.yml` config file,
need to be specified on each node in the cluster. Currently, all secure settings
are node-specific settings that must have the same value on every node.

[discrete]
[[reloadable-secure-settings]]
=== Reloadable secure settings

Just like the settings values in `elasticsearch.yml`, changes to the keystore
contents are not automatically applied to the running {es} node. Re-reading
settings requires a node restart. However, certain secure settings are marked as
*reloadable*. Such settings can be re-read and applied on a running node.

You can define these settings before the node is started, 
or call the <<cluster-nodes-reload-secure-settings,Nodes reload secure settings API>> 
after the settings are defined to apply them to a running node. 

The values of all secure settings, *reloadable* or not, must be identical
across all cluster nodes. After making the desired secure settings changes,
using the `bin/elasticsearch-keystore add` command, call:

[source,console]
----
POST _nodes/reload_secure_settings
{
  "secure_settings_password": "keystore-password" <1>
}
----
// NOTCONSOLE

<1> The password that the {es} keystore is encrypted with.

This API decrypts, re-reads the entire keystore and validates all settings on
every cluster node, but only the *reloadable* secure settings are applied.
Changes to other settings do not go into effect until the next restart. Once
the call returns, the reload has been completed, meaning that all internal data
structures dependent on these settings have been changed. Everything should
look as if the settings had the new value from the start.

When changing multiple *reloadable* secure settings, modify all of them on each
cluster node, then issue a <<cluster-nodes-reload-secure-settings, `reload_secure_settings`>>
call instead of reloading after each modification.

There are reloadable secure settings for:

* <<repository-azure,The Azure repository plugin>>
* {plugins}/discovery-ec2-usage.html#_configuring_ec2_discovery[The EC2 discovery plugin]
* <<repository-gcs,The GCS repository plugin>>
* <<repository-s3,The S3 repository plugin>>
* <<monitoring-settings>>
* <<notification-settings>>
* <<ref-jwt-settings, JWT realm>>
* <<ref-ad-settings, Active Directory realm>>
* <<ref-ldap-settings, LDAP realm>>
* <<remote-cluster-credentials-setting, Remote cluster credentials for the API key based security model>>