public static AgentEncryptionKey loadFrom(CredentialStoreService credentialStoreService, boolean createIfNotFound) {
    try {
      if (!credentialStoreService.containsCredential(null, AgentEncryptionKey.ALIAS)) {
        if (createIfNotFound) {
          AgentEncryptionKey encryptionKey = AgentEncryptionKey.random();
          encryptionKey.saveToCredentialStore(credentialStoreService);
          return loadKey(credentialStoreService); // load it again because after saving the key is cleared
        } else {
          throw new AmbariRuntimeException("AgentEncryptionKey with alias: " + ALIAS + " doesn't exist in credential store.");
        }
      } else {
        return loadKey(credentialStoreService);
      }
    } catch (AmbariException e) {
      throw new AmbariRuntimeException("Cannot load agent encryption key: " + e.getMessage(), e);
    }
  }
The encryption key which is used to encrypt sensitive data in agent config updates.
This key is shared with the agent so that it can decrypt the encrypted values.
ambari-server/src/main/java/org/apache/ambari/server/agent/AgentEncryptionKey.java