Unauthenticated access to actuator endpoints

Data Services
1

To enable readiness and liveness probes in Kubernetes we need to make the actuator endpoint /actuator/health accessible without authentication.

We got it working, but in doing so we found a lot of places, where something similar can be configured. And we could not figure out the differences.

Here are the configs we found:

The default Spring config:

management:
    endpoints:
        enabled-by-default: false
        web.exposure.include: '*'
    endpoint:
        info.enabled: true
        health.enabled: true

mgm.services:

mgm.services:
    rest:
        actuatorSecurity.secured:
            info: false
            health: false

mgm.uaa.authentication.unsecured-urls:

mgm.uaa.authentication:
    unsecured-urls: /actuator/health,/actuator/health/*,/actuator/info

mgm.uaa.authentication.anonymous:

see GetA12 Login

mgm.uaa.authentication:
    anonymous:
        access-urls: /config # Behind this url we have the client configuration
        enabled: true

What are the differences between all of those? And what is the correct way of achieving this?

Thanks in advance!

2

We had the same issue with the upgrade to 2021.02.

First of all you need to enable the endpoints and clear the exposure exclude.

Here the keys:

# Actuator endpoints
management.endpoint.health.enabled=true
management.endpoint.info.enabled=true
management.endpoints.web.exposure.exclude=
mgm.uaa.authentication.unsecuredUrls=/actuator/health,/actuator/info

Source <INTERNAL_LINK>

3

There are 2 additional data services ticket for improved documentation and configuration [A12S-1767]<INTERNAL_LINK> [A12S-1777]<INTERNAL_LINK>

4

Thanks for the answers! We got it working already, but were unsure what all those settings are doing. And why mgm.uaa.authentication comes with multiple config keys that seem to configure this. Also there is the config in mgm.services (which I assume is not used anymore, when running with UAA?). Can you tell me what these two configs do?

mgm.services:
    rest:
        actuatorSecurity.secured:
            info: false
            health: false

mgm.uaa.authentication:
    anonymous:
        access-urls: /config
        enabled: true

Thanks in advance :slight_smile: