Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Provide more control over access to endpoint operations

Browse Source 
This commit reworks the support for enabling and disabling endpoints,
replacing the on/off support that it provided with a finer-grained
access model that supports only allowing read-only access to endpoint
operations in addition to disabling an endpoint (access of none) and
fully enabling it (access of unrestricted).

The following properties are deprecated:

- management.endpoints.enabled-by-default
- management.endpoint.<id>.enabled

Their replacements are:

- management.endpoints.access.default
- management.endpoint.<id>.access

Similarly, the enableByDefault attribute on @Endpoint has been
deprecated with a new defaultAccess attribute replacing it.

Additionally, a new property has been introduced that allows an
operator to control the level of access to Actuator endpoints
that is permitted:

- management.endpoints.access.max-permitted

This property caps any access that may has been configured for
an endpoint. For example, if
management.endpoints.access.max-permitted is set to read-only and
management.endpoint.loggers.access is set to unrestricted, only
read-only access to the loggers endpoint will be allowed.

Closes gh-39046
This commit is contained in:
Andy Wilkinson
2024-10-08 14:12:04 +01:00
parent 4ce91417a7
commit 25082d33e7
84 changed files with 2568 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationprocessor/EndpointMetadataGenerationTests.java
View File

@@ -17,19 +17,24 @@
package org.springframework.boot.configurationprocessor;
import java.time.Duration;
import java.util.Locale;
import org.junit.jupiter.api.Test;
import org.springframework.boot.configurationprocessor.metadata.ConfigurationMetadata;
import org.springframework.boot.configurationprocessor.metadata.Metadata;
import org.springframework.boot.configurationsample.Access;
import org.springframework.boot.configurationsample.endpoint.CamelCaseEndpoint;
import org.springframework.boot.configurationsample.endpoint.CustomPropertiesEndpoint;
import org.springframework.boot.configurationsample.endpoint.DisabledEndpoint;
import org.springframework.boot.configurationsample.endpoint.EnabledEndpoint;
import org.springframework.boot.configurationsample.endpoint.NoAccessEndpoint;
import org.springframework.boot.configurationsample.endpoint.ReadOnlyAccessEndpoint;
import org.springframework.boot.configurationsample.endpoint.SimpleEndpoint;
import org.springframework.boot.configurationsample.endpoint.SimpleEndpoint2;
import org.springframework.boot.configurationsample.endpoint.SimpleEndpoint3;
import org.springframework.boot.configurationsample.endpoint.SpecificEndpoint;
import org.springframework.boot.configurationsample.endpoint.UnrestrictedAccessEndpoint;
import org.springframework.boot.configurationsample.endpoint.incremental.IncrementalEndpoint;
import static org.assertj.core.api.Assertions.assertThat;
@@ -49,16 +54,18 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
ConfigurationMetadata metadata = compile(SimpleEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.simple").fromSource(SimpleEndpoint.class));
assertThat(metadata).has(enabledFlag("simple", true));
assertThat(metadata).has(access("simple", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("simple"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
}
@Test
void disableEndpoint() {
void disabledEndpoint() {
ConfigurationMetadata metadata = compile(DisabledEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.disabled").fromSource(DisabledEndpoint.class));
assertThat(metadata).has(enabledFlag("disabled", false));
assertThat(metadata.getItems()).hasSize(2);
assertThat(metadata).has(access("disabled", Access.NONE));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
@@ -66,7 +73,37 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
ConfigurationMetadata metadata = compile(EnabledEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.enabled").fromSource(EnabledEndpoint.class));
assertThat(metadata).has(enabledFlag("enabled", true));
assertThat(metadata.getItems()).hasSize(2);
assertThat(metadata).has(access("enabled", Access.UNRESTRICTED));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
void noAccessEndpoint() {
ConfigurationMetadata metadata = compile(NoAccessEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.noaccess").fromSource(NoAccessEndpoint.class));
assertThat(metadata).has(enabledFlag("noaccess", false));
assertThat(metadata).has(access("noaccess", Access.NONE));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
void readOnlyAccessEndpoint() {
ConfigurationMetadata metadata = compile(ReadOnlyAccessEndpoint.class);
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.readonlyaccess").fromSource(ReadOnlyAccessEndpoint.class));
assertThat(metadata).has(enabledFlag("readonlyaccess", true));
assertThat(metadata).has(access("readonlyaccess", Access.READ_ONLY));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
void unrestrictedAccessEndpoint() {
ConfigurationMetadata metadata = compile(UnrestrictedAccessEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.unrestrictedaccess")
.fromSource(UnrestrictedAccessEndpoint.class));
assertThat(metadata).has(enabledFlag("unrestrictedaccess", true));
assertThat(metadata).has(access("unrestrictedaccess", Access.UNRESTRICTED));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
@@ -78,8 +115,9 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
.ofType(String.class)
.withDefaultValue("test"));
assertThat(metadata).has(enabledFlag("customprops", true));
assertThat(metadata).has(access("customprops", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("customprops"));
assertThat(metadata.getItems()).hasSize(4);
assertThat(metadata.getItems()).hasSize(5);
}
@Test
@@ -87,8 +125,9 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
ConfigurationMetadata metadata = compile(SpecificEndpoint.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.specific").fromSource(SpecificEndpoint.class));
assertThat(metadata).has(enabledFlag("specific", true));
assertThat(metadata).has(access("specific", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("specific"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
}
@Test
@@ -97,7 +136,8 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.pascal-case").fromSource(CamelCaseEndpoint.class));
assertThat(metadata).has(enabledFlag("PascalCase", "pascal-case", true));
assertThat(metadata.getItems()).hasSize(2);
assertThat(metadata).has(defaultAccess("PascalCase", "pascal-case", Access.UNRESTRICTED));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
@@ -107,16 +147,18 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.incremental").fromSource(IncrementalEndpoint.class));
assertThat(metadata).has(enabledFlag("incremental", true));
assertThat(metadata).has(access("incremental", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("incremental"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
project.replaceText(IncrementalEndpoint.class, "id = \"incremental\"",
"id = \"incremental\", enableByDefault = false");
metadata = project.compile();
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.incremental").fromSource(IncrementalEndpoint.class));
assertThat(metadata).has(enabledFlag("incremental", false));
assertThat(metadata).has(access("incremental", Access.NONE));
assertThat(metadata).has(cacheTtl("incremental"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
}
@Test
@@ -126,14 +168,16 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.incremental").fromSource(IncrementalEndpoint.class));
assertThat(metadata).has(enabledFlag("incremental", true));
assertThat(metadata).has(access("incremental", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("incremental"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
project.replaceText(IncrementalEndpoint.class, "@Nullable String param", "String param");
metadata = project.compile();
assertThat(metadata)
.has(Metadata.withGroup("management.endpoint.incremental").fromSource(IncrementalEndpoint.class));
assertThat(metadata).has(enabledFlag("incremental", true));
assertThat(metadata.getItems()).hasSize(2);
assertThat(metadata).has(access("incremental", Access.UNRESTRICTED));
assertThat(metadata.getItems()).hasSize(3);
}
@Test
@@ -142,14 +186,16 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
ConfigurationMetadata metadata = project.compile();
assertThat(metadata).has(Metadata.withGroup("management.endpoint.specific").fromSource(SpecificEndpoint.class));
assertThat(metadata).has(enabledFlag("specific", true));
assertThat(metadata).has(access("specific", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("specific"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
project.replaceText(SpecificEndpoint.class, "enableByDefault = true", "enableByDefault = false");
metadata = project.compile();
assertThat(metadata).has(Metadata.withGroup("management.endpoint.specific").fromSource(SpecificEndpoint.class));
assertThat(metadata).has(enabledFlag("specific", false));
assertThat(metadata).has(access("specific", Access.NONE));
assertThat(metadata).has(cacheTtl("specific"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
}
@Test
@@ -157,8 +203,9 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
ConfigurationMetadata metadata = compile(SimpleEndpoint.class, SimpleEndpoint2.class);
assertThat(metadata).has(Metadata.withGroup("management.endpoint.simple").fromSource(SimpleEndpoint.class));
assertThat(metadata).has(enabledFlag("simple", "simple", true));
assertThat(metadata).has(defaultAccess("simple", "simple", Access.UNRESTRICTED));
assertThat(metadata).has(cacheTtl("simple"));
assertThat(metadata.getItems()).hasSize(3);
assertThat(metadata.getItems()).hasSize(4);
}
@Test
@@ -170,14 +217,26 @@ class EndpointMetadataGenerationTests extends AbstractMetadataGenerationTests {
"Existing property 'management.endpoint.simple.enabled' from type org.springframework.boot.configurationsample.endpoint.SimpleEndpoint has a conflicting value. Existing value: true, new value from type org.springframework.boot.configurationsample.endpoint.SimpleEndpoint3: false");
}
private Metadata.MetadataItemCondition enabledFlag(String endpointId, Boolean defaultValue) {
return enabledFlag(endpointId, endpointId, defaultValue);
}
private Metadata.MetadataItemCondition enabledFlag(String endpointId, String endpointSuffix, Boolean defaultValue) {
return Metadata.withEnabledFlag("management.endpoint." + endpointSuffix + ".enabled")
.withDefaultValue(defaultValue)
.withDescription(String.format("Whether to enable the %s endpoint.", endpointId));
.withDescription(String.format("Whether to enable the %s endpoint.", endpointId))
.withDeprecation(null, "management.endpoint.%s.access".formatted(endpointSuffix), "3.4.0");
}
private Metadata.MetadataItemCondition enabledFlag(String endpointId, Boolean defaultValue) {
return enabledFlag(endpointId, endpointId, defaultValue);
private Metadata.MetadataItemCondition access(String endpointId, Access defaultValue) {
return defaultAccess(endpointId, endpointId, defaultValue);
}
private Metadata.MetadataItemCondition defaultAccess(String endpointId, String endpointSuffix,
Access defaultValue) {
return Metadata.withAccess("management.endpoint." + endpointSuffix + ".access")
.withDefaultValue(defaultValue.name().toLowerCase(Locale.ENGLISH))
.withDescription("Permitted level of access for the %s endpoint.".formatted(endpointId));
}
private Metadata.MetadataItemCondition cacheTtl(String endpointId) {

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationprocessor/metadata/Metadata.java
View File

@@ -25,6 +25,7 @@ import org.assertj.core.api.Condition;
import org.hamcrest.collection.IsMapContaining;
import org.springframework.boot.configurationprocessor.metadata.ItemMetadata.ItemType;
import org.springframework.boot.configurationsample.Access;
import org.springframework.util.ObjectUtils;
/**
@@ -66,6 +67,10 @@ public final class Metadata {
return withProperty(key).ofType(Boolean.class);
}
public static Metadata.MetadataItemCondition withAccess(String key) {
return withProperty(key).ofType(Access.class);
}
public static MetadataHintCondition withHint(String name) {
return new MetadataHintCondition(name);
}

9
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationprocessor/test/TestConfigurationMetadataAnnotationProcessor.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -74,6 +74,8 @@ public class TestConfigurationMetadataAnnotationProcessor extends ConfigurationM
public static final String NAME_ANNOTATION = "org.springframework.boot.configurationsample.Name";
public static final String ENDPOINT_ACCESS_ENUM = "org.springframework.boot.configurationsample.Access";
public TestConfigurationMetadataAnnotationProcessor() {
}
@@ -123,4 +125,9 @@ public class TestConfigurationMetadataAnnotationProcessor extends ConfigurationM
return NAME_ANNOTATION;
}
@Override
protected String endpointAccessEnum() {
return ENDPOINT_ACCESS_ENUM;
}
}

32
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/Access.java Normal file
View File

@@ -0,0 +1,32 @@
/*
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.configurationsample;
/**
* Permitted level of access to an endpoint.
*
* @author Andy Wilkinson
*/
public enum Access {
NONE,
READ_ONLY,
UNRESTRICTED
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/ControllerEndpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface ControllerEndpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/Endpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface Endpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/JmxEndpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface JmxEndpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/RestControllerEndpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface RestControllerEndpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/ServletEndpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface ServletEndpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

5
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/WebEndpoint.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -35,6 +35,9 @@ public @interface WebEndpoint {
String id() default "";
@Deprecated
boolean enableByDefault() default true;
Access defaultAccess() default Access.UNRESTRICTED;
}

30
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/endpoint/NoAccessEndpoint.java Normal file
View File

@@ -0,0 +1,30 @@
/*
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.configurationsample.endpoint;
import org.springframework.boot.configurationsample.Access;
import org.springframework.boot.configurationsample.Endpoint;
/**
* An endpoint with no permitted access unless configured explicitly.
*
* @author Andy Wilkinson
*/
@Endpoint(id = "noaccess", defaultAccess = Access.NONE)
public class NoAccessEndpoint {
}

30
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/endpoint/ReadOnlyAccessEndpoint.java Normal file
View File

@@ -0,0 +1,30 @@
/*
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.configurationsample.endpoint;
import org.springframework.boot.configurationsample.Access;
import org.springframework.boot.configurationsample.Endpoint;
/**
* An endpoint with read-only access unless configured explicitly.
*
* @author Andy Wilkinson
*/
@Endpoint(id = "readonlyaccess", defaultAccess = Access.READ_ONLY)
public class ReadOnlyAccessEndpoint {
}

29
spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/test/java/org/springframework/boot/configurationsample/endpoint/UnrestrictedAccessEndpoint.java Normal file
View File

@@ -0,0 +1,29 @@
/*
* Copyright 2012-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.configurationsample.endpoint;
import org.springframework.boot.configurationsample.Endpoint;
/**
* An endpoint with unrestricted access unless configured explicitly.
*
* @author Andy Wilkinson
*/
@Endpoint(id = "unrestrictedaccess")
public class UnrestrictedAccessEndpoint {
}