The full picture
- Defaults are already conservative: only
healthis web-exposed out of the box — the incidents come from teams settinginclude=*to 'see everything' and shipping it. - Separate management port (
management.server.port=8081): the app port faces the LB/ingress; the management port faces only kube-probes and Prometheus — network policy does the authorization work. - The dangerous ones:
heapdump(full memory — credentials included),env/configprops(config values; Boot 3 masks by default — keepshow-values: never),shutdown(disabled by default; leave it),loggersPOST (handy in incidents, audit who can call it). - Underrated gems:
conditions(why auto-config did/didn't apply),startup(startup step timeline withBufferingApplicationStartup),scheduledtasks,mappings.
management:
server:
port: 8081 # cluster-internal only
endpoints:
web:
exposure:
include: health,info,prometheus,loggers
endpoint:
health:
probes.enabled: true # /health/liveness, /health/readiness
show-details: when-authorized
env:
show-values: never # belt AND suspenders (not exposed anyway)