# The entries in elasticsearch-Keystore is causing the elastic cluster to go DOWN
**URL:** https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386
**Category:** Elasticsearch
**Created:** [July 1, 2019, 6:29pm UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386 "2019-07-01T18:29:13Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Giridhar\_kailasam](https://discuss.elastic.co/u/Giridhar_kailasam)
#### Post date: [July 1, 2019, 6:29pm UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/1 "2019-07-01T18:29:14Z")
My undetstanding is, any missing entries (like passwords) in the yml will be retrieved from the keystore.
Having an entry in the keystore should not cause the cluster failure.
Eg: Having a "xpack.security.authc.realms.ldap1.secure\_bind\_password" in the keystore is causing the elasticsearch cluster failure with the error:
" Suppressed: java.lang.IllegalArgumentException: missing realm type [xpack.security.authc.realms.ldap1.type] for realm"
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 2, 2019, 10:13am UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/2 "2019-07-02T10:13:16Z")
Hi,
> My undetstanding is, any missing entries (like passwords) in the yml will be retrieved from the keystore.
Almost. Specific settings ( called secure settings ) can be set in the keystore instead of the `elasticsearch.yml` file. See our [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html)
> [@Giridhar\_kailasam](#):
>
> Having an entry in the keystore should not cause the cluster failure.
>
> Eg: Having a "xpack.security.authc.realms.ldap1.secure\_bind\_password" in the keystore is causing the elasticsearch cluster failure with the error:
The assumption here is that if you have configured
```auto
xpack.security.authc.realms.ldap1.secure_bind_password
```
in your keystore, you'd have an LDAP realm in your `elasticsearch.yml` that is named `ldap1`, because otherwise you wouldn't need to set `xpack.security.authc.realms.ldap1.secure_bind_password`.
Is there any specific use case for you to set a property for a realm that doesn't exist ?
---
### Author:  [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)
#### Post date: [July 2, 2019, 2:01pm UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/3 "2019-07-02T14:01:38Z")
> [@ikakavas](#):
>
> Is there any specific use case for you to set a property for a realm that doesn't exist ?
If we look at this from a large scale deployment standpoint, it is possible that people create various keys in the keystore and expect that the process picks only those necessary for it or those specified in the YAML.
When you are designing a keystore, it should only be constrained to its responsibility of storing keys. Tying the responsibility of being an additional source of truth along with the responsibility of being a keystore, does not sound proper to me (considering the SOLID principles).
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 2, 2019, 2:24pm UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/4 "2019-07-02T14:24:00Z")
There is some ongoing discussion about how we could change the behavior of the keystore with regards to invalid settings that you can keep track of [here](https://github.com/elastic/elasticsearch/issues/43722)
---
### Author:  [@Giridhar\_kailasam](https://discuss.elastic.co/u/Giridhar_kailasam)
#### Post date: [July 3, 2019, 7:40am UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/5 "2019-07-03T07:40:33Z")
> [@ikakavas](#):
>
> Is there any specific use case for you to set a property for a realm that doesn't exist ?
Thank You for the reply.
We were migrating to new LDAP and added the new settings related to that in the yml. We removed the old LDAP settings from the yml. But, I did not remove the old LDAP password entry from the keystore. I did not expect or anticipate the cluster failure due to an entry in keystore.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 31, 2019, 7:40am UTC](https://discuss.elastic.co/t/the-entries-in-elasticsearch-keystore-is-causing-the-elastic-cluster-to-go-down/188386/6 "2019-07-31T07:40:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.