Interview Prep Zoneby CuriouserLabs

Question 1 of 5 · senior level

What does Spring Boot Actuator give you, and how do you expose it safely in production?

🎤 Say this first

Actuator adds operational endpoints: health (probes), metrics/prometheus (Micrometer), info, env, configprops, beans, conditions, loggers (runtime log-level changes!), threaddump, heapdump. Safety model: expose the minimum over HTTP (management.endpoints.web.exposure.include=health,info,prometheus), run management on a separate port reachable only inside the cluster, secure anything sensitive (env/heapdump can leak secrets), and keep detail levels down for anonymous callers (show-details: when-authorized).

The full picture

  • Defaults are already conservative: only health is web-exposed out of the box — the incidents come from teams setting include=* to 'see everything' and shipping it.
  • Separate management port (management.server.port=8081): the app port faces the LB/ingress; the management port faces only kube-probes and Prometheus — network policy does the authorization work.
  • The dangerous ones: heapdump (full memory — credentials included), env/configprops (config values; Boot 3 masks by default — keep show-values: never), shutdown (disabled by default; leave it), loggers POST (handy in incidents, audit who can call it).
  • Underrated gems: conditions (why auto-config did/didn't apply), startup (startup step timeline with BufferingApplicationStartup), scheduledtasks, mappings.
A production-sane baseline
management:
  server:
    port: 8081                     # cluster-internal only
  endpoints:
    web:
      exposure:
        include: health,info,prometheus,loggers
  endpoint:
    health:
      probes.enabled: true         # /health/liveness, /health/readiness
      show-details: when-authorized
    env:
      show-values: never           # belt AND suspenders (not exposed anyway)

🔄 Likely follow-up questions

  • How do custom endpoints (@Endpoint) work and when would you write one?
  • What does the startup endpoint show and how do you use it to cut boot time?
  • How do you audit runtime log-level changes made via /loggers?