Health, observability and diagnosis

Exist, expose and authorize

An endpoint can exist in the context without being exposed on the web. Web and JMX lists are independent; exclude takes precedence over include. Only health is exposed by default in this version. Choosing health and info defines an available surface, not a complete access policy.

With Spring Security and no custom chain, Boot supplies automatic protection for actuators beyond health. When you define SecurityFilterChain, that auto-configuration backs off and the application controls the rules. Also review probe paths added to the main port; do not assume an old rule already covers them.

Health and public detail

The health result aggregates configured contributors. A database indicator can check whether it obtains a connection; that does not establish that every business query is fast or a migration compatible. Record which indicators contribute before using UP as a release condition.

show-details controls available detail. The excerpt uses never, reducing public information. Endpoints such as env and configprops can contain sensitive data and have their own sanitization rules. Do not replace minimization with broad exposure to simplify investigation; provide explicitly scoped operational access.

The probe must fit the decision

Liveness informs an instance-restart decision. Including a shared database can restart every instance when the database fails without repairing the dependency. Readiness informs traffic acceptance; choosing external dependencies must consider the functional contract and degraded modes.

An optional dependency with a fallback should not unnecessarily remove all capacity. An essential shared dependency requires an explicit decision: remove traffic or handle failure at another level. Neither choice removes the need to observe customer impact.

Cover the connector serving clients

A separate management port uses infrastructure that can remain functional when the main connector is saturated or unavailable. Thus, obtaining health UP on port 9091 does not automatically contradict client failure on port 8080. The requests do not necessarily traverse the same infrastructure.

add-additional-paths exposes /livez and /readyz on the main port. This adds connector coverage but can still exclude a gateway, external TLS, functional authorization or a data operation. Acceptance must connect probes to the path actually affected by the incident.

Aggregation with controlled cardinality

Micrometer Observation supports metrics and traces from observations. Low-cardinality tags enter both; high-cardinality tags enter traces only. To compare duration by operation and region, choose stable names and bounded sets instead of creating a series per request id.

Cardinality does not replace a data policy. A secret remains unsuitable for a trace. MVC instrumentation normally produces http.server.requests; some handled exceptions do not automatically appear in the exception tag. Absence of that tag is not proof that no functional error occurred.

Correlation across threads

An observation can lose continuity when execution moves to another thread. With this version’s auto-configured Async executor, propagation requires spring.task.execution.propagate-context. A ThreadLocal on the original thread does not establish that its value will be available in asynchronous work.

First identify the boundary and executor used. A manually configured executor can require its own integration with context propagation; do not automatically attribute Boot support to it. Observability propagation also does not mean propagating a JDBC transaction across threads.

Retain useful evidence

Actuator can publish authentication success/failure and access-denied events through its auditing mechanism. An AuditEventRepository can retain those events. The in-memory implementation has limited capabilities and is intended for development; it does not establish durability after restart or sharing across instances.

For a production requirement, define appropriate storage, access control, retention and correlation. Distinguish security events from business outcomes: successful authentication does not prove a reservation committed. The timeline must identify the observed effect and what remains unknown.

Common pitfalls

Exposing every actuator for convenience; including shared dependencies in liveness; confusing UP with all flows recovered; using request ids as metric tags; retaining auditing only in memory.