Spring Boot Actuator lets you look inside a running application instead of guessing how it is behaving. Its endpoints report information such as health, metrics, configuration properties, logging levels, and request counts. They are available through HTTP and, with the exception of the heap dump endpoint, as JMX MBeans. section 15.0 section 15.1
<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-actuator</artifactId> </dependency>
Add this starter dependency to a Spring Boot Maven project to enable Actuator’s out-of-the-box endpoints. section 15.1
Start with two questions: What application is this, and is it healthy? An HTTP GET to /actuator/info returns application information; by default, its response may be just {}. Properties prefixed with info supply values for that response. An HTTP GET to /actuator/health returns a health status, such as {"status":"UP"}. section 15.2.1
Add support contact information
Put `info.contact.email: support@tacocloud.com` in application.yml. The /actuator/info response then includes that email under contact. To request more than the basic health status, set `management.endpoint.health.show-details: always`; the detailed response can include MongoDB and disk-space health. section 15.2.1
Most endpoints are disabled by default; use `management.endpoints.web.exposure.include` and `management.endpoints.web.exposure.exclude` to choose which web endpoints to expose. Treat that choice carefully: endpoints such as /env and /loggers can change a running application’s configuration. section 15.5
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.requestMatcher(EndpointRequest.toAnyEndpoint())
.authorizeRequests()
.anyRequest().hasRole("ADMIN")
.and()
.httpBasic();
}
Actuator does not secure its own endpoints. This Spring Security configuration requires ROLE_ADMIN for requests matched by `EndpointRequest.toAnyEndpoint()`, avoiding a hardcoded /actuator/** path that could become wrong if the base path changes. section 15.4
