"Safe" (non-cleartext) storage of credentials in password.conf accessed via the /storage/password endpoint is well documented, as well as configuring them using an app-specific setup screen.
What if I want to deploy via Deployment Server? How do I get properly encrypted credentials into password.conf?
The connection is implied. Anywhere you see Splunk storing an encrypted password using the form
$1$ this is Splunk's symmetric password encryption. The content of splunk.secret is used as an encryption key in this scheme.
If your servers all use the same
splunk.secret file, then you can push a pre-encrypted password directly using deployment server. If your servers do not all use the same
splunk.secret, you're hosed.