What it is: Actuator adds production-ready endpoints for monitoring and managing an application, added with spring-boot-starter-actuator.
Useful endpoints:
- /actuator/health: liveness and readiness, with health indicators for the database, disk, message brokers and custom checks. Kubernetes probes use /actuator/health/liveness and /actuator/health/readiness.
- /actuator/metrics and /actuator/prometheus: Micrometer metrics (JVM memory, GC, HTTP latency, connection pools) for Prometheus and Grafana.
- /actuator/info: build and git information.
- /actuator/loggers: change log levels at runtime, which is very useful during incidents.
What to keep closed in production:
- env, configprops, heapdump, threaddump and beans can expose secrets or internals.
Securing it:
- Expose only what you need: management.endpoints.web.exposure.include=health,info,prometheus.
- Serve management endpoints on a separate port (management.server.port) that is reachable only inside the cluster.
- Protect anything sensitive with Spring Security.
- Set management.endpoint.health.show-details=when-authorized.