Provide a property to disable the `/actuator` discovery page

[zromano]

If I include spring-boot-starter-actuator there is no way for me to disable the discovery page (/actuator).

I would like to utilize other features of the actuator, such as metrics, but I do not want to be forced into exposing this endpoint.

I can disable all other endpoints with the following:

management:
  endpoints:
    enabled-by-default: false

I would think this would also disable the /actuator endpoint.

[wilkinsona]

Disabling the endpoints by default has no effect as /actuator isn't an endpoint. Instead, it provides links to everything that is an endpoint.

There's no property to allow you to disable it at the moment, but it is possible to do so by defining your own bean. For example, if you're using the Servlet web stack and Spring MVC, you'd define a bean that's a copy-paste of the webEndpointServletHandlerMapping bean defined in WebMvcEndpointManagementContextConfiguration, but with shouldRegisterLinksMapping hard-coded to false. This is quite a few lines of code, and would look something like the following:

@Bean
@ConditionalOnMissingBean
public WebMvcEndpointHandlerMapping webEndpointServletHandlerMapping(WebEndpointsSupplier webEndpointsSupplier,
        ServletEndpointsSupplier servletEndpointsSupplier, ControllerEndpointsSupplier controllerEndpointsSupplier,
        EndpointMediaTypes endpointMediaTypes, CorsEndpointProperties corsProperties,
        WebEndpointProperties webEndpointProperties, Environment environment) {
    List<ExposableEndpoint<?>> allEndpoints = new ArrayList<>();
    Collection<ExposableWebEndpoint> webEndpoints = webEndpointsSupplier.getEndpoints();
    allEndpoints.addAll(webEndpoints);
    allEndpoints.addAll(servletEndpointsSupplier.getEndpoints());
    allEndpoints.addAll(controllerEndpointsSupplier.getEndpoints());
    String basePath = webEndpointProperties.getBasePath();
    EndpointMapping endpointMapping = new EndpointMapping(basePath);
    boolean shouldRegisterLinksMapping = StringUtils.hasText(basePath)
            || ManagementPortType.get(environment).equals(ManagementPortType.DIFFERENT);
    return new WebMvcEndpointHandlerMapping(endpointMapping, webEndpoints, endpointMediaTypes,
            corsProperties.toCorsConfiguration(), new EndpointLinksResolver(allEndpoints, basePath),
            shouldRegisterLinksMapping);
}

We can consider adding a property to avoid the need for copy-paste.

[zromano]

@wilkinsona Thanks for the solution. With that said, I'd love if it were as easy as setting a property 🙂

I think that if all of the endpoints are disabled then /actuator should be disabled, as it no longer provides any information.

[philwebb]

We're going to add a property so that the links can be easily switched off.