asmhatre/spring-boot-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Browse Source 
Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
This commit is contained in:
Ankur Mhatre
2026-09-04 10:40:04 +05:30
commit 4b6cefa60a
64 changed files with 3195 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
scripts/demo-management-port.sh Executable file
View File

@@ -0,0 +1,34 @@
#!/usr/bin/env bash
# Actuator on its own port and path.
set -uo pipefail
cd "$(dirname "$0")/.."
OUT=docs/output/06-management-port.txt
{
echo "### profile: mgmtport"
echo "### management.server.port: 9001 / management.server.address: 127.0.0.1 / base-path: /manage"
echo
echo "--- the application port no longer serves Actuator at all ---"
printf ' %-52s %s\n' "GET :8080/actuator/health" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/actuator/health)"
printf ' %-52s %s\n' "GET :8080/manage/health" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/manage/health)"
printf ' %-52s %s\n' "GET :8080/orders/count" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:8080/orders/count)"
echo
echo "--- the management port serves it on the new base path ---"
printf ' %-52s %s\n' "GET :9001/manage/health" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/manage/health)"
printf ' %-52s %s\n' "GET :9001/actuator/health" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/actuator/health)"
printf ' %-52s %s\n' "GET :9001/orders/count" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/orders/count)"
echo
echo " Note the last line. The management context has its own DispatcherServlet and does NOT"
echo " see application controllers. That is the isolation you are paying for."
echo
echo "--- what the management context reports about itself ---"
echo "\$ curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag"
curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag | python3 -m json.tool
echo
echo "--- listening sockets ---"
echo "\$ ss -ltn | grep -E ':(8080|9001)'"
ss -ltn 2>/dev/null | grep -E ':(8080|9001)' || netstat -ltn 2>/dev/null | grep -E ':(8080|9001)'
echo
echo " 9001 is bound to 127.0.0.1 only. 8080 is bound to *. An ingress that forwards to 8080"
echo " cannot reach Actuator no matter how the security rules are written."
} > "$OUT" 2>&1
echo "wrote $OUT"