Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
2026-09-04 10:40:04 +05:30
commit 4b6cefa60a
64 changed files with 3195 additions and 0 deletions
--- a/docs/output/05-secured-matrix.txt
+++ b/docs/output/05-secured-matrix.txt
@@ -0,0 +1,106 @@
+### profile: secured    (SecuredActuatorConfig + application-secured.yaml)
+### exposure is "*" - the security chain, not the exposure list, is what protects it
+
+ANONYMOUS
+  GET /actuator/health                           503
+  GET /actuator/info                             200
+  GET /actuator/env                              401
+  GET /actuator/beans                            401
+  GET /actuator/threaddump                       401
+  GET /actuator  (the links index)               401
+
+AUTHENTICATED as ops (ROLE_ACTUATOR)
+  GET /actuator/health                           503
+  GET /actuator/env                              200
+  GET /actuator/beans                            200
+  GET /actuator/threaddump                       200
+
+WRONG PASSWORD
+  GET /actuator/env                              401
+
+--- health body, anonymous (show-details: when-authorized) ---
+{
+    "groups": [
+        "liveness",
+        "readiness"
+    ],
+    "status": "DOWN"
+}
+
+--- health body, authenticated as ROLE_ACTUATOR ---
+{
+    "components": {
+        "db": {
+            "details": {
+                "database": "H2",
+                "validationQuery": "isValid()"
+            },
+            "status": "UP"
+        },
+        "diskSpace": {
+            "details": {
+                "total": 10213466112,
+                "free": 3877920768,
+                "threshold": 10485760,
+                "path": "/tmp/work/spring-boot-demo/.",
+                "exists": true
+            },
+            "status": "UP"
+        },
+        "externalApi": {
+            "details": {
+                "url": "http://localhost:8080/stub/upstream/ping",
+                "response": "pong",
+                "latencyMs": 4,
+                "timeoutMs": 750
+            },
+            "status": "UP"
+        },
+        "kafka": {
+            "details": {
+                "bootstrap": "localhost:9092",
+                "tuned": true,
+                "error": "TimeoutException: Timed out waiting for a node assignment. Call: listNodes",
+                "probeMs": 1500,
+                "budgetMs": 1500
+            },
+            "status": "DOWN"
+        },
+        "livenessState": {
+            "status": "UP"
+        },
+        "ordersDatabase": {
+            "details": {
+                "orders": 3,
+                "queryMs": 0,
+                "slowThresholdMs": 250
+            },
+            "status": "UP"
+        },
+        "ping": {
+            "status": "UP"
+        },
+        "readinessState": {
+            "status": "UP"
+        },
+        "ssl": {
+            "details": {
+                "expiringChains": [],
+                "invalidChains": [],
+                "validChains": []
+            },
+            "status": "UP"
+        }
+    },
+    "groups": [
+        "liveness",
+        "readiness"
+    ],
+    "status": "DOWN"
+}
+
+  Same endpoint, same status code, different body. An anonymous prober learns that the
+  service is unhealthy but not WHICH dependency is unhealthy.
+
+--- the business endpoint is untouched by the actuator chain ---
+  GET /orders/count (anonymous)                  200