Liferay PaaS Experience: Managing Secrets

You manage secrets for your Liferay PaaS environments entirely through Argo CD, with no GCP account, IAM configuration, or gcloud access required. The platform handles the GCP Secret Manager and External Secrets Operator (ESO) wiring and synchronizes secrets into your environments.

To manage secrets, you need Argo CD access to your PaaS Experience environment.

Managed vs. Self-Hosted Secrets

This article covers secrets management on the managed PaaS Experience platform. If your team operates its own GCP project instead, through the Cloud Native Experience (CNE) GCP-ready offering, you manage secrets directly in GCP Secret Manager rather than through Argo CD.

Both paths converge on the same in-cluster contract: an ExternalSecret resource that the External Secrets Operator reconciles into a Kubernetes secret, so Liferay consumes secrets identically either way. Pick based on how much of the underlying GCP layer your team wants to operate:

	Managed (PaaS Experience)	Self-Hosted (CNE GCP-ready)
Who operates the GCP project	Liferay	Your team
Where you manage secrets	Argo CD	GCP Secret Manager (console, gcloud, or Terraform)
GCP account required	No	Yes
JSON payload conventions	Handled internally	You author them
IAM and Workload Identity setup	Handled internally	Your team’s responsibility

See Managing Secrets and Licenses for the self-hosted path.

Supported Secret Types

PaaS Experience supports three secret types. The platform applies the required JSON payload conventions and GCP Secret Manager naming prefixes internally; you don’t hand-craft payloads or remember prefix requirements.

TLS certificates provide a certificate and private key to the cluster. The platform stores them in GCP Secret Manager under the liferay-certificates- prefix and syncs them into a Kubernetes TLS secret.

Liferay licenses provide a Liferay license to the Liferay container. The platform stores them in GCP Secret Manager under the liferay-licenses- prefix.

GitOps credentials give the platform access to your GitOps repository. The platform stores them in GCP Secret Manager as liferay-credentials-gitops.

Managing Secrets in Argo CD

Create, update, and delete secrets through Argo CD’s Secret Manager extension. Secrets are Argo CD resources, visible alongside your applications and configuration, so the same view that shows deployment health also shows secret state.

Each secret is scoped to its environment, so staging secrets can’t reach production and vice versa.

Argo CD records create, update, and delete operations on a secret in its history.

Grafana also includes a read-only Secrets dashboard showing your secrets list and an audit trail of those same operations. See Metrics.

How Secrets Reach the Cluster

When you create or update a secret in Argo CD, the platform synchronizes it to the cluster:

1. The platform stores the secret value in its managed GCP Secret Manager backend, applying the required naming conventions and JSON payload format for you.

2. The External Secrets Operator reads from GCP Secret Manager and renders a Kubernetes secret.

3. Liferay reads the secret at runtime.

Rotating Secrets

To rotate a secret, update its value in Argo CD. The External Secrets Operator polls GCP Secret Manager every hour and refreshes the Kubernetes secret automatically, with no pod restart or manual kubectl intervention required in typical cases. There’s no way to trigger an immediate refresh; a rotated value takes effect on the next poll, up to an hour later.