### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 25, 2024, 3:59pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/1 "2024-04-25T15:59:22Z")
I am trying to perform the initial installation of a two node Elasticsearch cluster. This is on Ubuntu 22.04 with Elasticsearch version 8.13 installed via RPM.
This is the contents of the file /etc/elasticsearch/elasticsearch.yml on my master node:
```auto
cluster.name: lab
cluster.initial_master_nodes: ["eflow01.mydomain.com"]
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
http.host: 0.0.0.0
http.port: 9200
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
```
The service starts fine on this first node:
```auto
$ sudo systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; disabled; vendor preset: enabled)
Active: active (running) since Thu 2024-04-25 15:52:24 UTC; 3min 24s ago
Docs: https://www.elastic.co
Main PID: 614816 (java)
Tasks: 110 (limit: 19137)
Memory: 8.4G
CPU: 1min 11.150s
CGroup: /system.slice/elasticsearch.service
├─614816 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m -XX:+UseSerialGC -Dcli.name=server -Dcli.script=/usr/share/elasticsearch/bin/elasticsearch -Dcli.libs=lib/tools/server-cli -Des.path.home=/usr/share/elasticsearch -Des.path.conf=/etc/elasticsearch -Des.distribution>
├─614876 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -Djava.security.manager=allow -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -D>
└─614904 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller
Apr 25 15:52:08 eflow01.mydomain.com systemd[1]: Starting Elasticsearch...
Apr 25 15:52:11 eflow01.mydomain.com systemd-entrypoint[614816]: Apr 25, 2024 3:52:11 PM sun.util.locale.provider.LocaleProviderAdapter
Apr 25 15:52:11 eflow01.mydomain.com systemd-entrypoint[614816]: WARNING: COMPAT locale provider will be removed in a future release
Apr 25 15:52:24 eflow01.mydomain.com systemd[1]: Started Elasticsearch.
```
On the second node, I tried using the default configuration file provided by the RPM but that didn't work so this is the version I have present there:
```auto
cluster.name: lab
cluster.initial_master_nodes: ["eflow01.mydomain.com"]
discovery.seed_hosts: eflow01.mydomain.com
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
http.host: 0.0.0.0
http.port: 9200
```
On the second node I attempt to start the service for the first time using this command, providing the enrollment token from the first node:
```auto
$ sudo /usr/share/elasticsearch/bin/elasticsearch --enrollment-token [REDACTED]
ERROR: Skipping security auto configuration because this node is configured to bootstrap or to join a multi-node cluster, which is not supported., with exit code 80
```
Thanks for any help you can provide!
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 25, 2024, 6:53pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/2 "2024-04-25T18:53:43Z")
I guess the main question I have is what should the config file look like on all member (non-master) nodes? I tried the default provided by the Ubuntu RPM and it didn't work, and have tried modifying it in various ways, that doesn't work either.
If I use the factory supplied config file, and then the `command bin/elasticsearch-reconfigure-node` I get an error about it not able to locate the master node.
Could someone please provide a sample config file to use on member nodes?
---
### Author:  [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [April 25, 2024, 8:04pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/3 "2024-04-25T20:04:16Z")
I think you need to delete `cluster.initial_master_nodes`. From [these docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#initial_master_nodes):
> **IMPORTANT** : After the cluster forms successfully for the first time, remove the `cluster.initial_master_nodes` setting from each node’s configuration. Do not use this setting when restarting a cluster or **adding a new node to an existing cluster**.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 25, 2024, 10:30pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/4 "2024-04-25T22:30:12Z")
Do I need to customize the config file at all on the secondary node, or does the command `elasticsearch-reconfigure-node` do that for me? Does the enrollment token have the cluster name and master node name and what not?
Can you please provide sample initial configuration file for a member node?
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 25, 2024, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/5 "2024-04-25T22:59:00Z")
The documentation is very confusing to me, and feels a bit disjointed. My use case is a fresh install of a cluster with two nodes. My assumption is that the first node will be the acting initial master - the first node of a given cluster, and the second one will join as a member.
I have the first node (acting master) setup and working fine, as far as I can tell. However, I cannot get the second node (member node) to join the cluster created by the first.
I am following the installation documentation here:
> **[Install Elasticsearch with RPM | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/rpm.html)**
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 25, 2024, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/6 "2024-04-25T22:59:48Z")
Where I generate an enrollment token on my acting master node, and then supply that to the command elasticsearch-reconfigure-node on my member node. However, that node is not actually joining the cluster, per the log file.
I also see this documentation for adding and removing nodes in your cluster here:
> **[Add and remove nodes in your cluster | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/add-elasticsearch-nodes.html)**
Which has completely different steps.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [April 26, 2024, 12:07am UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/7 "2024-04-26T00:07:16Z")
I am still not able to get this working. If I use the auto-bootstrapping method, do I need the enrollment token at all? It appears if I modify the config file at all on the member node, to enable boot-strapping, then I cannot use the command elasticsearch-reconfigure-node.
I am very confused, can someone please provide a working sample of a master-eligible node configuration file and a member node configuration file and the high-level steps?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [April 26, 2024, 1:28am UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/8 "2024-04-26T01:28:53Z")
You should not be trying to use an enrollment token if you have already configured the node manually. You should just try to start it up.
The enrollment process simply configures the node for you.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 26, 2024, 1:39am UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/9 "2024-04-26T01:39:22Z")
> [@jimmycricket](#):
>
> `ERROR: Skipping security auto configuration because this node is configured to bootstrap or to join a multi-node cluster`
Since you configured `cluster.initial_master_nodes` in the `elasticsearch.yml` file, you cannot use the enrollment token, you just to simple start it with normally or using `systemctl`.
Also, keep in mind that you should also make this second node a data/ingest node only, there is no resilience on a 2 node cluster, so can have only **one** node configured as master.
Try to change the `elasticsearch.yml` of this second node to this one:
```auto
cluster.name: lab
cluster.initial_master_nodes: ["eflow01.mydomain.com"]
discovery.seed_hosts: eflow01.mydomain.com
node.roles: [data, ingest]
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
http.host: 0.0.0.0
http.port: 9200
xpack.security.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
```
Make sure to have all the certificates in the second node as well.
And start it with `systemctl start elasticsearch`.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [May 1, 2024, 11:13pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/10 "2024-05-01T23:13:41Z")
Thanks for the replies all. My immediate question is, how can I validate the 2nd node has joined the cluster properly?
I would like to use the enrollment token method. Here are the steps I am performing:
1. Install elasticsearch on the 2nd node - NOT modifying the elasticsearch.yml configuration file and NOT starting the software
2. Using enrollment token from my master node I run the command `elasticsearch-reconfigure-node --enrollment-token`. This completes successfully.
3. Start the software on the 2nd node using `systemctl`, this completes successfully
4. Attempting to test that the 2nd node has joined the cluster correctly I am running the command `curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:PASSWORD https://localhost:9200`. I am using the password the 2nd node provided me when I installed the software.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [May 1, 2024, 11:15pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/11 "2024-05-01T23:15:16Z")
I am not sure why but I cannot post the full error message I am getting, but basically when I run that curl command it says "unable to authenticate user [elastic] for REST request".
I then try to re-generate the password on the 2nd node and get this error:
> $ sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -s
> ERROR: Failed to determine the health of the cluster. Unexpected http status [503], with exit code 65
I can re-generate the password on the master node and run that curl command successfully. Trying that new password on the 2nd node produces the same error, when trying to hit itself.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [May 1, 2024, 11:29pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/12 "2024-05-01T23:29:53Z")
Ok I found this command, which I can run on the master node:
> $ sudo curl -X GET --cacert /etc/elasticsearch/certs/http\_ca.crt -u elastic:PASSWORD "https : / / localhost:9200/\_cluster/health?pretty"
> {
> "cluster\_name" : "lab",
> "status" : "green",
> "timed\_out" : false,
> "number\_of\_nodes" : 1,
> "number\_of\_data\_nodes" : 1,
> "active\_primary\_shards" : 1,
> "active\_shards" : 1,
> "relocating\_shards" : 0,
> "initializing\_shards" : 0,
> "unassigned\_shards" : 0,
> "delayed\_unassigned\_shards" : 0,
> "number\_of\_pending\_tasks" : 0,
> "number\_of\_in\_flight\_fetch" : 0,
> "task\_max\_waiting\_in\_queue\_millis" : 0,
> "active\_shards\_percent\_as\_number" : 100.0
> }
So it appears that my 2nd node is not actually joining the cluster, even though I provided the proper enrollment token successfully, and restarted the software.
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [May 1, 2024, 11:30pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/13 "2024-05-01T23:30:46Z")
I see these entries in my log file `/var/log/elasticsearch/elasticsearch.log` :
> [REDACTED A BUNCH OF STUFF BECAUSE SITE WONT LET ME POST FOR SOME REASON] failed: remote cluster name [lab] does not match local cluster name [elasticsearch]
Which takes me all the way back round to my prior question, what should the config file look like on the 2nd node? Because apparently the cluster name is not something the enrollment token configures?
---
### Author:  [@jimmycricket](https://discuss.elastic.co/u/jimmycricket)
#### Post date: [May 2, 2024, 2:33am UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/14 "2024-05-02T02:33:10Z")
Also just in case, here is the config file I am using on my master node:
```auto
node.name: eflow01.mydomain.com
node.roles: [master, data]
cluster.name: lab
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
http.host: 0.0.0.0
http.port: 9200
transport.host: 0.0.0.0
transport.port: 9300
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
cluster.initial_master_nodes: eflow01.mydomain.com ## remove this line after initial start
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 2, 2024, 5:11am UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/15 "2024-05-02T05:11:00Z")
It looks like you have not set [discovery.seed\_hosts](https://www.elastic.co/guide/en/elasticsearch/reference/8.13/discovery-hosts-providers.html#built-in-hosts-providers), which is how Elasticsearch identifies which nodes to initially connect to.
---
### Author:  [@sheldon.xie](https://discuss.elastic.co/u/sheldon.xie)
#### Post date: [May 9, 2024, 5:26pm UTC](https://discuss.elastic.co/t/unable-to-install-multi-node-cluster-skipping-security-auto-configuration-because-this-node-is-configured-to-bootstrap-or-to-join-a-multi-node-cluster-which-is-not-supported-with-exit-code-80/358229/16 "2024-05-09T17:26:40Z")
1. Install elasticsearch on node-1
2. Update the elasticsearch.yml for node-1
3. Start elasticsearch node-1
4. Check the health of nodes
5. Run "elasticsearch-create-enrollment-token -s node" on node-1
6. Install elasticsearch on node-2
7. Run the "elasticsearch-reconfigure-node --enrollment-token " command on node-2 with the token from node-1 (Run the `elasticsearch-reconfigure-node` tool _before_ starting elasticsearch)
8. Update the elasticsearch.yml for node-2
9. Start elasticsearch node-2
>
> [@ERROR: Skipping security auto configuration because it appears that the node is not starting up for the first time. The node might already be part of a cluster and this auto setup utility is designed to configure Security for new clusters only](https://discuss.elastic.co/t/error-skipping-security-auto-configuration-because-it-appears-that-the-node-is-not-starting-up-for-the-first-time-the-node-might-already-be-part-of-a-cluster-and-this-auto-setup-utility-is-designed-to-configure-security-for-new-clusters-only/300568/2):
>
> Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable. Instead, paste the text and format it with \ icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. It would be great if you could update your post to solve this. Because, as the message is saying, you have previously starte…
Refer to the above two articles. Pay attention to the configuration of `http.host` and `transport.host` when using multiple network cards."