7845be50ef
Resolves https://github.com/spring-cloud/spring-cloud-stream/issues/2932 Spring Boot provides `SanitizingFunction` to allow the applicaitons to clear out sensitive data when using certain actuator endpoints. This feature can be extended to custom endpoints as well. Enable the bindings actuator endpoint to sanitze sensitive data based on user-provided logic in `SantizingFuction` beans in the application.
106 lines
4.6 KiB
Plaintext
106 lines
4.6 KiB
Plaintext
[[binding_visualization_control]]
|
|
= Binding visualization and control
|
|
|
|
Spring Cloud Stream supports visualization and control of the Bindings through Actuator endpoints as well as programmatic way.
|
|
|
|
[[programmatic-way]]
|
|
== Programmatic way
|
|
|
|
Since version 3.1 we expose `org.springframework.cloud.stream.binding.BindingsLifecycleController` which is registered as bean and once
|
|
injected could be used to control the lifecycle of individual bindings
|
|
|
|
For example, looks at the fragment from one of the test cases. As you can see we retrieve `BindingsLifecycleController`
|
|
from spring application context and execute individual methods to control the lifecycle of `echo-in-0` binding..
|
|
|
|
[source,java]
|
|
----
|
|
BindingsLifecycleController bindingsController = context.getBean(BindingsLifecycleController.class);
|
|
Binding binding = bindingsController.queryState("echo-in-0");
|
|
assertThat(binding.isRunning()).isTrue();
|
|
bindingsController.changeState("echo-in-0", State.STOPPED);
|
|
//Alternative way of changing state. For convenience we expose start/stop and pause/resume operations.
|
|
//bindingsController.stop("echo-in-0")
|
|
assertThat(binding.isRunning()).isFalse();
|
|
----
|
|
|
|
[[actuator]]
|
|
== Actuator
|
|
Since actuator and web are optional, you must first add one of the web dependencies as well as add the actuator dependency manually.
|
|
The following example shows how to add the dependency for the Web framework:
|
|
|
|
[source,xml]
|
|
----
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-web</artifactId>
|
|
</dependency>
|
|
----
|
|
|
|
The following example shows how to add the dependency for the WebFlux framework:
|
|
|
|
[source,xml]
|
|
----
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-webflux</artifactId>
|
|
</dependency>
|
|
----
|
|
|
|
You can add the Actuator dependency as follows:
|
|
[source,xml]
|
|
----
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-actuator</artifactId>
|
|
</dependency>
|
|
----
|
|
|
|
NOTE: To run Spring Cloud Stream 2.0 apps in Cloud Foundry, you must add `spring-boot-starter-web` and `spring-boot-starter-actuator` to the classpath. Otherwise, the
|
|
application will not start due to health check failures.
|
|
|
|
You must also enable the `bindings` actuator endpoints by setting the following property: `--management.endpoints.web.exposure.include=bindings`.
|
|
|
|
Once those prerequisites are satisfied. you should see the following in the logs when application start:
|
|
|
|
: Mapped "{[/actuator/bindings/{name}],methods=[POST]. . .
|
|
: Mapped "{[/actuator/bindings],methods=[GET]. . .
|
|
: Mapped "{[/actuator/bindings/{name}],methods=[GET]. . .
|
|
|
|
To visualize the current bindings, access the following URL:
|
|
`http://<host>:<port>/actuator/bindings`
|
|
|
|
Alternative, to see a single binding, access one of the URLs similar to the following:
|
|
`http://<host>:<port>/actuator/bindings/<bindingName>`
|
|
|
|
You can also stop, start, pause, and resume individual bindings by posting to the same URL while providing a `state` argument as JSON, as shown in the following examples:
|
|
|
|
curl -d '{"state":"STOPPED"}' -H "Content-Type: application/json" -X POST http://<host>:<port>/actuator/bindings/myBindingName
|
|
curl -d '{"state":"STARTED"}' -H "Content-Type: application/json" -X POST http://<host>:<port>/actuator/bindings/myBindingName
|
|
curl -d '{"state":"PAUSED"}' -H "Content-Type: application/json" -X POST http://<host>:<port>/actuator/bindings/myBindingName
|
|
curl -d '{"state":"RESUMED"}' -H "Content-Type: application/json" -X POST http://<host>:<port>/actuator/bindings/myBindingName
|
|
|
|
NOTE: `PAUSED` and `RESUMED` work only when the corresponding binder and its underlying technology supports it. Otherwise, you see the warning message in the logs.
|
|
Currently, only Kafka and [Solace](https://github.com/SolaceProducts/solace-spring-cloud/tree/master/solace-spring-cloud-starters/solace-spring-cloud-stream-starter#consumer-bindings-pauseresume) binders supports the `PAUSED` and `RESUMED` states.
|
|
|
|
[[sanitize-sensitive-data]]
|
|
=== Sanitize Sensitive Data
|
|
|
|
When using the binding actuator endpoint, it is sometimes critical to sanitize any sensitive data such as user credentials, information about SSL keys, etc.
|
|
To achieve this, end user applications can provide a `SanitizingFunction` from Spring Boot as a bean in the application.
|
|
Here is an example to scramble the data when providing a value for Apache Kafka's `sasl.jaas.config` property.
|
|
|
|
```
|
|
@Bean
|
|
public SanitizingFunction sanitizingFunction() {
|
|
return sanitizableData -> {
|
|
if (sanitizableData.getKey().equals("sasl.jaas.config")) {
|
|
return sanitizableData.withValue("data-scrambled!!");
|
|
}
|
|
else {
|
|
return sanitizableData;
|
|
}
|
|
};
|
|
}
|
|
```
|
|
|