Ankur Mhatre
4b6cefa60a
Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
58 lines
2.4 KiB
Markdown
58 lines
2.4 KiB
Markdown
[← README](../README.md) · **01 · What Actuator actually exposes** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)
|
|
|
|
# 01 — What Actuator actually exposes
|
|
|
|
Add the starter, configure nothing, and ask the application what it publishes.
|
|
|
|
```xml
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-actuator</artifactId>
|
|
</dependency>
|
|
```
|
|
|
|
The answer, from [`../docs/output/01-default-exposure.txt`](output/01-default-exposure.txt):
|
|
|
|
```json
|
|
{"_links":{"self":{...},"health":{...},"health-path":{...}}}
|
|
```
|
|
|
|
One endpoint. `GET /actuator/env` returns **404**, not 403 — it was discovered, it exists as a
|
|
JMX endpoint, and it is simply not mapped onto HTTP.
|
|
|
|
That distinction matters more than it looks:
|
|
|
|
- **Discovery** — Actuator finds every `@Endpoint` bean on the classpath.
|
|
- **Access** (`management.endpoint.<id>.access`) — whether the endpoint may be operated at all.
|
|
Defaults to `unrestricted` for everything except `heapdump` and `shutdown`.
|
|
- **Exposure** (`management.endpoints.web.exposure.include`) — whether it is mapped onto HTTP.
|
|
Defaults to `health` only.
|
|
|
|
All three have to line up. A 404 from an Actuator path tells you nothing about whether the
|
|
endpoint is enabled, and people read it as "it's off" when it is often "it's on, over JMX".
|
|
|
|
## The default health body
|
|
|
|
```json
|
|
{"groups":["liveness","readiness"],"status":"DOWN"}
|
|
```
|
|
|
|
Two things to notice.
|
|
|
|
**The groups are there by default.** In Spring Boot 3 the liveness and readiness probes only
|
|
appeared when you asked for them or when Boot detected Kubernetes. In Boot 4 they are enabled
|
|
out of the box — see [chapter 02](02-boot-4-changes.md).
|
|
|
|
**`show-details` defaults to `never`**, so even an authenticated caller sees a bare status. That
|
|
is a sensible default and almost everyone overrides it to `always` without thinking about who
|
|
can reach the endpoint. [Chapter 04](04-securing-actuator.md) covers the middle option.
|
|
|
|
**The status is `DOWN`** because this repository registers a Kafka indicator and there is no
|
|
broker. One custom indicator that touches a third party is all it takes to turn the default
|
|
`/actuator/health` red — and that URL is what most Kubernetes manifests point their readiness
|
|
*and* liveness probes at. [Chapter 07](07-groups-and-probes.md) is about not doing that.
|
|
|
|
---
|
|
|
|
[← README](../README.md) · **01** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)
|