Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
2.4 KiB
← README · 01 · What Actuator actually exposes · 02 What changed in Spring Boot 4 →
01 — What Actuator actually exposes
Add the starter, configure nothing, and ask the application what it publishes.
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
The answer, from ../docs/output/01-default-exposure.txt:
{"_links":{"self":{...},"health":{...},"health-path":{...}}}
One endpoint. GET /actuator/env returns 404, not 403 — it was discovered, it exists as a
JMX endpoint, and it is simply not mapped onto HTTP.
That distinction matters more than it looks:
- Discovery — Actuator finds every
@Endpointbean on the classpath. - Access (
management.endpoint.<id>.access) — whether the endpoint may be operated at all. Defaults tounrestrictedfor everything exceptheapdumpandshutdown. - Exposure (
management.endpoints.web.exposure.include) — whether it is mapped onto HTTP. Defaults tohealthonly.
All three have to line up. A 404 from an Actuator path tells you nothing about whether the endpoint is enabled, and people read it as "it's off" when it is often "it's on, over JMX".
The default health body
{"groups":["liveness","readiness"],"status":"DOWN"}
Two things to notice.
The groups are there by default. In Spring Boot 3 the liveness and readiness probes only appeared when you asked for them or when Boot detected Kubernetes. In Boot 4 they are enabled out of the box — see chapter 02.
show-details defaults to never, so even an authenticated caller sees a bare status. That
is a sensible default and almost everyone overrides it to always without thinking about who
can reach the endpoint. Chapter 04 covers the middle option.
The status is DOWN because this repository registers a Kafka indicator and there is no
broker. One custom indicator that touches a third party is all it takes to turn the default
/actuator/health red — and that URL is what most Kubernetes manifests point their readiness
and liveness probes at. Chapter 07 is about not doing that.