Ankur Mhatre
958b401f0f
Adds spring-boot-startup-time/, the companion project for BLOG-618: a runnable Spring Boot 4.1.1 application on JDK 25 that installs BufferingApplicationStartup and FlightRecorderApplicationStartup behind a system property, and a /diag/startup endpoint that computes step self time -- the number /actuator/startup does not give you and the one that names the actual culprits. Captured under docs/output/: the step tree sorted both ways, the same startup as JFR events, a +5000-class experiment putting 0.11 ms per scanned class on the classpath scan tax, the silent truncation a 2048-step buffer performs, and JDK 25 AOT cache timings (6.93 s to 4.82 s). Post body and metadata live in post/. Moves the existing Actuator project into actuator-in-production/ so the repository holds one directory per article; the root README is now an index.
46 lines
1.9 KiB
Bash
Executable File
46 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The authorisation matrix produced by SecuredActuatorConfig.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
OUT=docs/output/05-secured-matrix.txt
|
|
B=http://localhost:8080/actuator
|
|
probe() { # $1 label, $2 path, $3 curl auth args...
|
|
local label="$1" path="$2"; shift 2
|
|
printf ' %-46s %s\n' "$label" "$(curl -s -o /dev/null -w '%{http_code}' "$@" "$B/$path")"
|
|
}
|
|
{
|
|
echo "### profile: secured (SecuredActuatorConfig + application-secured.yaml)"
|
|
echo "### exposure is \"*\" - the security chain, not the exposure list, is what protects it"
|
|
echo
|
|
echo "ANONYMOUS"
|
|
probe "GET /actuator/health" health
|
|
probe "GET /actuator/info" info
|
|
probe "GET /actuator/env" env
|
|
probe "GET /actuator/beans" beans
|
|
probe "GET /actuator/threaddump" threaddump
|
|
probe "GET /actuator (the links index)" ""
|
|
echo
|
|
echo "AUTHENTICATED as ops (ROLE_ACTUATOR)"
|
|
probe "GET /actuator/health" health -u ops:ops-password
|
|
probe "GET /actuator/env" env -u ops:ops-password
|
|
probe "GET /actuator/beans" beans -u ops:ops-password
|
|
probe "GET /actuator/threaddump" threaddump -u ops:ops-password
|
|
echo
|
|
echo "WRONG PASSWORD"
|
|
probe "GET /actuator/env" env -u ops:wrong
|
|
echo
|
|
echo "--- health body, anonymous (show-details: when-authorized) ---"
|
|
curl -s "$B/health" | python3 -m json.tool
|
|
echo
|
|
echo "--- health body, authenticated as ROLE_ACTUATOR ---"
|
|
curl -s -u ops:ops-password "$B/health" | python3 -m json.tool
|
|
echo
|
|
echo " Same endpoint, same status code, different body. An anonymous prober learns that the"
|
|
echo " service is unhealthy but not WHICH dependency is unhealthy."
|
|
echo
|
|
echo "--- the business endpoint is untouched by the actuator chain ---"
|
|
printf ' %-46s %s\n' "GET /orders/count (anonymous)" \
|
|
"$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/orders/count)"
|
|
} > "$OUT" 2>&1
|
|
echo "wrote $OUT"
|