Handling of sensitive data in Cloudera

Cloudera uses Vault to encrypt sensitive data (such as tokens, passwords, and encryption keys).

Cloudera on premises uses the Embedded/External Vault to store user credentials and some critical system data pertaining to the Cloudera Control Plane that includes the machine user password used to create the control plane, the contents of the kubeconfig file which provides admin access to the Kubernetes Control Plane, and the LDAP credentials configured for the Cloudera Embedded Container Service Cluster.

The Cloudera on premises installer can install Vault, but for OpenShift Container Platform environments, typically this is a pre-existing customer-managed external Vault deployment.