private Cluster getCluster(long clusterId) throws AmbariRuntimeException {
    try {
      return clusters.get().getCluster(clusterId);
    } catch (AmbariException e) {
      throw new AmbariRuntimeException("Cannot load cluster: " + clusterId, e);
    }
  }
This encryptor encrypts the sensitive data in config updates sent to ambari-agent.
Decryption happens on the agent side.
ambari-server/src/main/java/org/apache/ambari/server/security/encryption/AgentConfigUpdateEncryptor.java