Provide more control over access to endpoint operations

This commit reworks the support for enabling and disabling endpoints,
replacing the on/off support that it provided with a finer-grained
access model that supports only allowing read-only access to endpoint
operations in addition to disabling an endpoint (access of none) and
fully enabling it (access of unrestricted).

The following properties are deprecated:

- management.endpoints.enabled-by-default
- management.endpoint.<id>.enabled

Their replacements are:

- management.endpoints.access.default
- management.endpoint.<id>.access

Similarly, the enableByDefault attribute on @Endpoint has been
deprecated with a new defaultAccess attribute replacing it.

Additionally, a new property has been introduced that allows an
operator to control the level of access to Actuator endpoints
that is permitted:

- management.endpoints.access.max-permitted

This property caps any access that may has been configured for
an endpoint. For example, if
management.endpoints.access.max-permitted is set to read-only and
management.endpoint.loggers.access is set to unrestricted, only
read-only access to the loggers endpoint will be allowed.

Closes gh-39046

spring-boot-project/spring-boot-docs/src/docs/antora/modules/ROOT/pages/redirect.adoc

@@ -737,8 +737,8 @@
 * xref:reference:actuator/enabling.adoc#actuator.enabling[#actuator.enabling]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints[#actuator.endpoints]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.caching[#actuator.endpoints.caching]
+* xref:reference:actuator/endpoints.adoc#actuator.endpoints.controlling-access[#actuator.endpoints.enabling]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.cors[#actuator.endpoints.cors]
-* xref:reference:actuator/endpoints.adoc#actuator.endpoints.enabling[#actuator.endpoints.enabling]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.exposing[#actuator.endpoints.exposing]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.health[#actuator.endpoints.health]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.health.auto-configured-health-indicators[#actuator.endpoints.health.auto-configured-health-indicators]
@@ -773,6 +773,7 @@
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.kubernetes-probes.external-state[#actuator.endpoints.kubernetes-probes.external-state]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.kubernetes-probes.lifecycle[#actuator.endpoints.kubernetes-probes.lifecycle]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.sanitization[#howto-sanitize-sensitive-values]
+* xref:reference:actuator/endpoints.adoc#actuator.endpoints.controlling-access[#actuator.endpoints.enabling]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.sanitization[#actuator.endpoints.sanitization]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.sanitization[#howto-sanitize-sensible-values]
 * xref:reference:actuator/endpoints.adoc#actuator.endpoints.sbom[#actuator.endpoints.sbom]

spring-boot-project/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc

@@ -5,8 +5,8 @@ Actuator endpoints let you monitor and interact with your application.
 Spring Boot includes a number of built-in endpoints and lets you add your own.
 For example, the `health` endpoint provides basic application health information.
 
-You can xref:actuator/endpoints.adoc#actuator.endpoints.enabling[enable or disable] each individual endpoint and xref:actuator/endpoints.adoc#actuator.endpoints.exposing[expose them (make them remotely accessible) over HTTP or JMX].
-An endpoint is considered to be available when it is both enabled and exposed.
+You can xref:actuator/endpoints.adoc#actuator.endpoints.controlling-access[control access] to each individual endpoint and xref:actuator/endpoints.adoc#actuator.endpoints.exposing[expose them (make them remotely accessible) over HTTP or JMX].
+An endpoint is considered to be available when access to it is permitted and it is exposed.
 The built-in endpoints are auto-configured only when they are available.
 Most applications choose exposure over HTTP, where the ID of the endpoint and a prefix of `/actuator` is mapped to a URL.
 For example, by default, the `health` endpoint is mapped to `/actuator/health`.
@@ -117,38 +117,52 @@ If your application is a web application (Spring MVC, Spring WebFlux, or Jersey)
 
 
 
-[[actuator.endpoints.enabling]]
-== Enabling Endpoints
+[[actuator.endpoints.controlling-access]]
+== Controlling Access to Endpoints
 
-By default, all endpoints except for `shutdown` are enabled.
-To configure the enablement of an endpoint, use its `management.endpoint.<id>.enabled` property.
-The following example enables the `shutdown` endpoint:
+By default, access to all endpoints except for `shutdown` is unrestricted.
+To configure the permitted access to an endpoint, use its `management.endpoint.<id>.access` property.
+The following example allows unrestricted access to the `shutdown` endpoint:
 
 [configprops,yaml]
 ----
 management:
   endpoint:
     shutdown:
-      enabled: true
+      access: unrestricted
 ----
 
-If you prefer endpoint enablement to be opt-in rather than opt-out, set the configprop:management.endpoints.enabled-by-default[] property to `false` and use individual endpoint `enabled` properties to opt back in.
-The following example enables the `info` endpoint and disables all other endpoints:
+If you prefer access to be opt-in rather than opt-out, set the configprop:management.endpoints.access.default[] property to `disabled` and use individual endpoint `access` properties to opt back in.
+The following example allows read-only access to the `loggers` endpoint and disables all other endpoints:
 
 [configprops,yaml]
 ----
 management:
   endpoints:
-    enabled-by-default: false
+    access:
+      default: disabled
   endpoint:
-    info:
-      enabled: true
+    loggers:
+      access: read-only
 ----
 
-NOTE: Disabled endpoints are removed entirely from the application context.
+NOTE: Inaccessible endpoints are removed entirely from the application context.
 If you want to change only the technologies over which an endpoint is exposed, use the xref:actuator/endpoints.adoc#actuator.endpoints.exposing[`include` and `exclude` properties] instead.
 
 
+[[actuator.endpoints.controlling-access.limiting]]
+=== Limiting Access
+
+Application-wide endpoint access can be limited using the configprop:management.endpoints.access.max-permitted[] property.
+This property takes precedence over the default access or an individual endpoint's access level.
+Set it to `none` to make all endpoints inaccessible.
+Set it to `read-only` to only allow read access to endpoints.
+
+For `@Endpoint`, `@JmxEndpoint`, and `@WebEndpoint`, read access equates to the endpoint methods annotated with `@ReadEndpoint`.
+For `@ControllerEndpoint` and `@RestControllerEndpoint`, read access equates to request mappings that can handle `GET` and `HEAD` requests.
+For `@ServletEndpoint`, read access equates to `GET` and `HEAD` requests.
+
+
 
 [[actuator.endpoints.exposing]]
 == Exposing Endpoints