private Set<String> getPasswordProperties(Cluster cluster, String configType) {
    //in case of normal configuration change on the UI - or via the API - the current and desired stacks are equal
    //in case of an upgrade they are different; in this case we want to get password properties from the desired stack
    if (cluster.getCurrentStackVersion().equals(cluster.getDesiredStackVersion())) {
      return getPasswordProperties(cluster, cluster.getCurrentStackVersion(), configType);
    } else {
      return getPasswordProperties(cluster, cluster.getDesiredStackVersion(), configType);
    }
  }
A common base class for various encryptor implementations
ambari-server/src/main/java/org/apache/ambari/server/security/encryption/PropertiesEncryptor.java