Ankur Mhatre
4b6cefa60a
Companion repository for the ankurm.com article. Every transcript in docs/output/ was produced by running this project; scripts/run-all.sh regenerates all of them. Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 / Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
102 lines
3.1 KiB
Plaintext
102 lines
3.1 KiB
Plaintext
### profile: mgmtport
|
|
### management.server.port: 9001 / management.server.address: 127.0.0.1 / base-path: /manage
|
|
|
|
--- the application port no longer serves Actuator at all ---
|
|
GET :8080/actuator/health 401
|
|
GET :8080/manage/health 401
|
|
GET :8080/orders/count 200
|
|
|
|
--- the management port serves it on the new base path ---
|
|
GET :9001/manage/health 503
|
|
GET :9001/actuator/health 404
|
|
GET :9001/orders/count 404
|
|
|
|
Note the last line. The management context has its own DispatcherServlet and does NOT
|
|
see application controllers. That is the isolation you are paying for.
|
|
|
|
--- what the management context reports about itself ---
|
|
$ curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag
|
|
{
|
|
"activeProfiles": [
|
|
"mgmtport"
|
|
],
|
|
"serverPort": "8080",
|
|
"managementPort": "9001",
|
|
"managementBasePath": "/manage",
|
|
"exposureInclude": "*",
|
|
"exposureExclude": "(none)",
|
|
"healthShowDetails": "never",
|
|
"exposedWebEndpointCount": 14,
|
|
"exposedWebEndpoints": {
|
|
"beans": [
|
|
"GET beans"
|
|
],
|
|
"conditions": [
|
|
"GET conditions"
|
|
],
|
|
"configprops": [
|
|
"GET configprops",
|
|
"GET configprops/{prefix}"
|
|
],
|
|
"diag": [
|
|
"GET diag"
|
|
],
|
|
"env": [
|
|
"GET env",
|
|
"GET env/{toMatch}"
|
|
],
|
|
"health": [
|
|
"GET health",
|
|
"GET health/{*path}"
|
|
],
|
|
"info": [
|
|
"GET info"
|
|
],
|
|
"loggers": [
|
|
"GET loggers",
|
|
"GET loggers/{name}",
|
|
"POST loggers/{name}"
|
|
],
|
|
"mappings": [
|
|
"GET mappings"
|
|
],
|
|
"metrics": [
|
|
"GET metrics",
|
|
"GET metrics/{requiredMetricName}"
|
|
],
|
|
"prometheus": [
|
|
"GET prometheus"
|
|
],
|
|
"sbom": [
|
|
"GET sbom",
|
|
"GET sbom/{id}"
|
|
],
|
|
"scheduledtasks": [
|
|
"GET scheduledtasks"
|
|
],
|
|
"threaddump": [
|
|
"GET threaddump",
|
|
"GET threaddump"
|
|
]
|
|
},
|
|
"healthContributors": [
|
|
"db (DataSourceHealthIndicator)",
|
|
"diskSpace (DiskSpaceHealthIndicator)",
|
|
"externalApi (ExternalApiHealthIndicator)",
|
|
"kafka (KafkaHealthIndicator)",
|
|
"livenessState (LivenessStateHealthIndicator)",
|
|
"ordersDatabase (OrdersDatabaseHealthIndicator)",
|
|
"ping (PingHealthIndicator)",
|
|
"readinessState (ReadinessStateHealthIndicator)",
|
|
"ssl (SslHealthIndicator)"
|
|
]
|
|
}
|
|
|
|
--- listening sockets ---
|
|
$ ss -ltn | grep -E ':(8080|9001)'
|
|
LISTEN 0 100 *:8080 *:*
|
|
LISTEN 0 100 [::ffff:127.0.0.1]:9001 *:*
|
|
|
|
9001 is bound to 127.0.0.1 only. 8080 is bound to *. An ingress that forwards to 8080
|
|
cannot reach Actuator no matter how the security rules are written.
|