This commit improves upon the changes made in a8bf9d3 by adding
support for relaxed binding of the endpoints.enabled and
endpoints.<name>.enabled properties. This is achieved by replacing
use of @ConditionalOnExpression (which does not support relaxed
binding) with a custom condition implementation that uses
RelaxedPropertyResolver.
Closes gh-2767
Previously, only invocations of /metricName/ would honour the enabled
property and return a not found (404) response. For endpoints which
support nested paths, access to /metricName/foo would ignore the enabled
flag and return an OK (200) response. Furthermore, there was a comment
in EndpointMvcAdapter that suggested that an endpoint shouldn’t be
called when it is disabled, however this was not the case.
This commit updates EndpointWebMvcAutoConfiguration and
JolokiaAutoConfiguration to only register their MvcEndpoint beans if
the underlying endpoint is enabled. This means that an
EndpointMvcAdapter should not be called if its delegate is disabled,
making the comment described above accurate.
The check for the delegate being enabled has been retained so as not to
rely upon the auto-configurations’ behaviour. The methods which handle
nested paths (MetricsMvcEndpoint.value() and
EnvironmentMvcEndpoint.value()) have been updated to add the same check
for the enablement of their delegate.
Fixes gh-2767
Update SystemPublicMetrics to silently ignore ManagementFactory
NoClassDefFoundErrors which can occur when deploying to Google App
Engine.
Fixes gh-2701
Previously, the response from /health was not cached if the request
was secure, i.e. the user has authenticated, or the endpoint was
configured as not being sensitive.
The commit updates HealthMvcEndpoint to apply the caching logic
all the time. Users that do not want caching can disable it by
configuring the TTL with a value of zero.
Closes gh-2630
Spring Boot's metrics infrastructure requires a Metric to have a
Number value. Coda Hale's ThreadStatesGaugeSet includes a Gauge
named deadlocks with a Set<String> value (each entry in the set is a
description, including stacktrace, of a deadlocked thread). There's
no obvious way to coerce this to a Number, and there's already a
deadlocks.count metric in the set.
This commit updates MetricRegistryMetricReader to ignore the addition
of any Gauge with a non-Number value.
Fixes gh-2593
ee567fa boldy claimed that it had made MetricRegistryMetricReader
thread-safe. It had not. This commit should actually make it thread
safe. I hope.
One notable improvement is that MetricRegistryMetricReader.findAll()
will no longer contain null values if a metric is removed on another
thread during iteration.
names is now a ConcurrentHashMap to allow it to be safely read and
written without holding a lock.
reverse is a LinkedMultiValueMap which is not thread-safe. This could
lead to values being lost when concurrent add calls were made. Access
to reverse is now protected by synchronizing on an internal monitor
object.
Calls to containsKey(key) followed by get(key) have been reworked to
only call get(key), this avoids the possibility of the key being
removed after the contains check but before the get.
Closes gh-2590
MetricRegistryMetricReader’s fields where neither final, nor volatile
but could be accessed on multiple threads. This lead to visibility
problems where the value of a field would unexpectedly be null, causing
an NPE.
This commit updates all of the fields to declare them as final, thereby
ensuring that their values are guaranteed to be visible across different
threads.
Fixes gh-2590
If there is more than one DataSource and the non-primary bean-name is
'datasource' an incorrect metric name is chosen.
The metrics are named datasource.active and not datasource.xxx.active. To
avoid this, the shortening of the bean-name only occurs if the bean-name
is longer than 'datasource'.
See gh-2320
Previously each endpoint was secured for path, path/, and path.*.
This meant that a request to path/foo was not secured. This commit
secures path/** to ensure that requests to a nested endpoint path are
also secured.
Fixes gh-2476
Update InMemoryAuditEventRepository to consider the date when searching
for events. Also switch to a circular buffer implementation and update
the capacity to limit the total number of items rather than limiting
per principal.
Fixes gh-2291
Update AbstractEndpoint to correctly support the `endpoints.enabled`
property. Also fix EnvironmentEnpoint which would previously prevent
the Environment from being set.
Fixes gh-2264
Closes gh-2265
Update WebMvcAutoConfiguration so that the RequestMappingHandlerMapping
bean is @Primary. Prior to this commit a NoUniqueBeanDefinitionException
would be thrown then using the MvcUriComponentsBuilder.
Fixes gh-2237
Update ManagementSecurityAutoConfiguration so that MVC Endpoints that
have Principal arguments are not treated in any special way. This
restores Spring Boot 1.1.x behavior where the 'sensitive' flag is used
to determine access rules.
The HealthMvcEndpoint still uses the Principal (when available) to
determine if full status information can be displayed. It now also
explicitly checks the environment for `endpoints.health.sensitive`
to determine if the user has opted-out and requires complete health
details.
The health MVC endpoint should now work as follows:
* Default configuration - No login is required, full information is only
displayed if a Principal is available.
* endpoints.health.sensitive=true - Login is required, full information
is displayed.
* endpoints.health.sensitive=false - Login is not required, full
information is displayed.
Fixes gh-2211
Add Ordered interface to all EmbeddedServletContainerCustomizers with
a value of 0. Prior to this commit it was difficult for a user to
define a customizer that would be applied before ours, even if they
implemented Ordered or added @Order annotations.
Fixes gh-2123
ManagementSecurityAutoConfiguration fully relies on the presence of a
web environment, yet the configuration class itself was not guarded by
`@ConditionalOnWebApplication` (while nested config where).
This turned out to be a problem for command-line applications using
spring security (i.e. CRaSH integration).
Fixes gh-2112
