Spring Boot Actuator — Spring Boot: From Basics to Production

Actuator adds production endpoints: /actuator/health (with liveness and readiness groups for Kubernetes), /actuator/info, /actuator/metrics, /actuator/prometheus and more. Only health is exposed over HTTP by default; expose others deliberately, ideally on a separate management port not reachable from the internet, and secure them.

@Component
class PaymentProviderHealth implements HealthIndicator {
    private final PaymentGateway gateway;
    PaymentProviderHealth(PaymentGateway gateway) { this.gateway = gateway; }

    @Override
    public Health health() {
        return gateway.ping() ? Health.up().build() : Health.down().withDetail("provider", "unreachable").build();
    }
}

management:
  server:
    port: 8081                       # internal only
  endpoints:
    web:
      exposure:
        include: health,info,prometheus
  endpoint:
    health:
      probes:
        enabled: true                # /actuator/health/liveness and /readiness
      show-details: when-authorized

Common pitfalls

Exposing all endpoints publicly (include: "*") — env, heapdump and others leak secrets.
Liveness checks that depend on external services (restart storms).
Health indicators that are slow and time out probes.

Key points

health/info/metrics/prometheus
Separate, secured management port
Liveness local, readiness for dependencies

Further reading: Spring Boot: Actuator endpoints

Practice questions

Why is exposing /actuator/env or /actuator/heapdump publicly dangerous?

Answer

They can reveal configuration values, credentials and in-memory data such as tokens and personal information.

What's the difference between the liveness and readiness health groups?

Answer

Liveness indicates whether the app should be restarted (internal state broken); readiness indicates whether it can accept traffic (e.g., dependencies available, warm-up done).