Add `@ControllerEndpoint` and `@RestControllerEndpoint` annotations that
can be used to develop a Spring-only request mapped endpoint. Both
Spring MVC and Spring WebFlux are supported.
This feature is primarily for use when deeper Spring integration is
required or when existing Spring Boot 1.5 projects want to migrate to
Spring Boot 2.0 without re-writing existing endpoints. It comes at the
expense of portability, since such endpoints will be missing from
Jersey.
Fixes gh-10257
Refactor several areas of the actuator endpoint code in order to make
future extensions easier. The primary goal is to introduce the concept
of an `ExposableEndpoint` that has technology specific subclasses and
can carry additional data for filters to use. Many other changes have
been made along the way including:
* A new EndpointSupplier interface that allows cleaner separation of
supplying vs discovering endpoints. This allows cleaner class names
and allows for better auto-configuration since a user can choose to
provide their own supplier entirely.
* A `DiscoveredEndpoint` interface that allows the `EndpointFilter`
to be greatly simplified. A filter now doesn't need to know about
discovery concerns unless absolutely necessary.
* Improved naming and package structure. Many technology specific
concerns are now grouped in a better way. Related concerns are
co-located and concepts from one area no longer leakage into another.
* Simplified `HandlerMapping` implementations. Many common concerns have
been pulled up helping to create simpler subclasses.
* Simplified JMX adapters. Many of the intermediary `Info` classes have
been removed. The `DiscoveredJmxOperation` is now responsible for
mapping methods to operations.
* A specific @`HealthEndpointCloudFoundryExtension` for Cloud Foundry.
The extension logic used to create a "full" health endpoint extension
has been made explicit.
Fixes gh-11428
Fixes gh-11581
Previously, a number of Actuator endpoints ignored a context hierarchy
or assumed that it would always be linear. This commit reworks the
affected endpoints so that the no longer assume a linear hierarchy.
A side-effect of a non-linear hierarchy is that there may be multiple
different beans with the same name (in a linear hierarchy, a bean
with the same name as one in an ancestor context, replaces that bean).
The affected endpoints have also been updated so that, when bean names
are used as keys, those keys are grouped by application context. This
prevents a bean in one context from accidentially overwriting a bean
in another context.
Closes gh-11019
Extract functionality from the `RegistrationBean` into a new class
designed to work with dynamic registration. Servet and Filter
registration beans now extend from `DynaimcRegistrationBean`, where as
`ServletListenerRegistrationBean` extends directly from
`RegistrationBean`.
This refactor allows the removal of `ServletListenerRegistrationBean`
deprecated methods.
Fixes gh-11344
This commit moves management.server.context-path to
management.server.servlet.context-path to align with the configuration
key for the application's main context path.
Closes gh-11359
Update ImageBanner to support animated GIFs. Animations rely on ANSI
cursor codes so don't work so well in an IDE. They do, however, work
when running the app from a terminal.
See also commit 47bc5e71ab
Closes gh-11118
Previously, the Health web extension was defined in the management
context and, as a result, it wasn't found when a separate port was
required. The side effect is that anything that the health web extension
does was not active anymore in that case.
This commit makes sure that the extension is always defined as part of
the main context where operations are discovered and merged.
Closes gh-11285
Now that Spring Boot supports Freemarker for both Spring MVC and Spring
WebFlux, the dedicated starter should not pull the Web starter
transitively and let developers manually choose the web stack.
Closes gh-11246
Drop the status endpoint and merge functionality back into the health
endpoint. The `management.endpoint.health.show-details` property can
be used to change if full details, or just the status is displayed.
Fixes gh-11113
Update endpoint code to provide cleaner separation of concerns.
Specifically, the top level endpoint package is no longer aware of
the fact that JMX and HTTP are ultimately used to expose endpoints.
Caching concerns have also been abstracted behind a general purpose
`OperationMethodInvokerAdvisor` interface.
Configuration properties have been refined to further enforce
separation. The `management.endpoint.<name>` prefix provides
configuration for a single endpoint (including enable and cache
time-to-live). These properties are now technology agnostic (they
don't include `web` or `jmx` sub properties).
The `management.endpoints.<technology>` prefix provide exposure specific
configuration. For example, `management.endpoints.web.path-mapping`
allow endpoint URLs to be changed.
Endpoint enabled/disabled logic has been simplified so that endpoints
can't be disabled per exposure technology. Instead a filter based
approach is used to allow refinement of what endpoints are exposed over
a given technology.
Fixes gh-10176
- Modifying dependencies to starter-web with tomcat exclusion plus
alternative servlet container instead of manual dependency on
spring-webmvc as it is the preferrable way to use alternative servlet
container
- Previously RestTemplate with ssl was configured manually in tests - now
it rellies on autoconfiguration - changed this for multi-connector test
and added test to ensure that ssl autoconfiguration is working
- Most samples with alterntative servlet containers used some kind of
service reading property and returning default since it wasn't
configured - removed it, since it is not specific to using alternative
servlet containers.
See gh-10548
Following some changes in the latest snapshot this includes:
- Some updates to oauth2 client auto-config
- Security auto-config no longer relies on GlobalAuthenticationConfigurerAdapter
- Remove reactive security starter
Closes gh-10704
Previously, the custom layout sample did not configure the source
and target for the compiler. This meant that both defaulted to 1.5
which is not supported by Java 9's javac. The oldest support version
is 1.6.
This commit sets the maven.compiler.source and maven.compiler.target
properties to 1.8 (the lowest version support by Boot 2.0) allowing
the sample to build with both Java 8 and Java 9.
See gh-10515
This reverts commit bbca612a57.
StandardJarScanner, which contains the faulty assumption about
URLClassLoader is part of Jasper. Jetty, like Tomcat, uses Jasper for
JSPs so it's also affected.
See gh-10456
This commit adds support for auto-configuration of Spring WS automatic
WSDL and XSD exposure i.e. registration of `WsdlDefinition` and
`XsdDefinition` beans. The bean registration is triggered by configuring
`spring.webservices.wsdl-locations` property which will search the
provided locations for WSDL/XSD files and register appropriate beans.
See gh-9635
This commit removes auto-configuration support for Spring Security
OAuth, paving the way for the introduction of auto-configuration for
Spring Security 5's new OAuth-related features.
Closes gh-10255
This commit improves the Spring Session sample by providing multiple
build profiles that make it possible to easily try out different session
stores. By default, JDBC session store backed by an in-memory embedded H2
database is used.
See gh-10351
This commit only provides dependency management for JUnit Jupiter,
excluding experimental and migration support artifacts. It also removes
dependency management for the platform as it is used by IDEs and build
tools). The `junit-platform.version` is still available though to allow
users to configure their plugin with a supported placeholder for the
version.
Also, given that `junit-vintage-engine`'s version does not match the
JUnit 4 version it supports, we will not add dependency management for
it.
Closes gh-10240
This commit makes the "spring.session.store-type" property optional,
adding an additional check when it is not present that validates only
one supported implementation is available on the classpath.
As Spring Session has been modularized, the chance that multiple
implementations are available on the classpath are lower. When only
one implementation is present, we attempt to auto-configure it. When
more than one implementation is present and no session store is
configured, a NonUniqueSessionRepositoryException is thrown.
Closes gh-9863
Update the security request matchers so that a bean is no longer needed
when the matcher is used. Matchers can now be build by starting from
the `EndpointRequest` or `StaticResourceRequest` classes. For example:
http.authorizeRequests()
.requestMatchers(EndpointRequest.to("status", "info")).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
.requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()
Closes gh-7958
Restructure actuator packages to improve structure. The following
changes have been made:
- Separate actuator and actuator auto-configuration into different
modules.
- Move endpoint code into `spring-boot-actuator`.
- Move `Endpoint` implementations from a single package into
technology specific packages.
- Move `HealthIndicator` implementations from a single package into
technology specific packages.
- As much as possible attempt to mirror the `spring-boot` package
structure and class naming in `spring-boot-actuator` and
`spring-boot-actuator-autoconfigure`.
- Move `DataSourceBuilder` and DataSource meta-data support from
`spring-boot-actuator` to `spring-boot`.
Fixes gh-10261
Spring Framework 5 provides support for JUnit 5. This commit adds
dependency management for JUnit 5 and an upgrade for
spring-boot-sample-junit-jupiter sample.
See gh-10240
This commit adds a strategy interface to specific if a given DataSource
has its schema managed. The Hibernate auto-configuration uses it to set
it to "none" if a mechanism to initialize the DataSource is
found and "create-drop" otherwise.
Both Flyway and Liquibase implements that strategy interface and
register it in the context accordingly.
Closes gh-9262
Since the autoconfig totally backs off in the presence
of a WebSecurityConfigurerAdapter, there is no need to
order them ahead of/after the one provided by Spring Boot.
See gh-7958
This commit combines security autoconfigurations for
management endpoints and the rest of the application. By default,
if Spring Security is on the classpath, it turns on @EnableWebSecurity.
In the presence of another WebSecurityConfigurerAdapter this backs off
completely. A default AuthenticationManager is also provided with a user
and generated password. This can be turned off by specifying a bean of
type AuthenticationManager, AuthenticationProvider or UserDetailsService.
Closes gh-7958
This commit moves CORS properties out of the endpoints namespace as they
do not refer to a "cors" endpoint but rather to the CORS configuration
of all endpoints.
Closes gh-10053
This commit migrates the Actuator onto the new endpoint infrastruture.
In addition to the existing support for accessing the endpoints via
JMX and HTTP using Spring MVC, support for access via HTTP using
Jersey and WebFlux has been added. This includes using a separate
management port where we now spin up an additional, appropriately
configured servlet or reactive web server to expose the management
context on a different HTTP port to the main application.
Closes gh-2921
Closes gh-5389
Closes gh-9796
This commit replaces the Acuator's support for hypermedia with a
single endpoint that returns HAL-formatted links to all of the
available endpoints. This is done without requiring Spring HATEOAS
to be on the classpath in a similar manner to the existing
CloudFoundry discovery endpoint.
Closes gh-9901
Kim Rudolph
Phillip Webb
Andy Wilkinson
Madhura Bhave
Johnny Lim
Stephane Nicoll
Eddú Meléndez
Brian Clozel
Spring Buildmaster
Vedran Pavic
Ivan Sopov
jfarcand
Jon Schneider