Why bother with Actuator and metrics

If your app is a black box you are lying to yourself and to your ops team. Spring Boot Actuator turns that black box into a slightly less mysterious box that reports health metrics and endpoints. Add Micrometer and you can feed those metrics to Prometheus or other backends for dashboards and alarms that actually work.

What you need first

• Spring Boot application managed with Maven
• Basic familiarity with application properties or YAML
• Optional monitoring backend such as Prometheus

Step 1 Add the Actuator dependency

Drop the actuator starter into your pom.xml under dependencies. No magic. Just one dependency and Spring Boot wires a lot of stuff for you.

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

Step 2 Choose which endpoints to expose

Out of the box Actuator has many endpoints but most should stay hidden in production. Use your application properties to pick the ones you want visible. Keep it minimal unless you enjoy attack surface and noise.

management.endpoints.web.exposure.include=health,info,metrics
management.endpoints.web.base-path=/actuator
management.endpoint.health.show-details=when-authorized

Step 3 Add Micrometer if you want useful metrics

If Prometheus or another metrics system is part of your plan add the Micrometer registry that matches that system. For Prometheus add the registry dependency so the metrics endpoint can be scraped.

<dependency>
  <groupId>io.micrometer</groupId>
  <artifactId>micrometer-registry-prometheus</artifactId>
</dependency>

Now configure any registry properties you need to point the exporter at the right place. The registry starter is lightweight and polite.

Step 4 Test locally without drama

Start the app and check that actuator endpoints respond. Use a browser or a simple HTTP client to hit the actuator path on localhost port 8080 to confirm health and metrics are present. If the health endpoint returns UP you did not break everything yet.

Step 5 Secure the sensitive parts

Operational endpoints can be juicy for attackers. Protect them by adding Spring Security and restricting access to only the roles or IPs that actually need them.

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Then require authentication for the important endpoints and expose only what you must. You can also run management endpoints on a different port if you want to separate traffic.

Quick checklist

• Add spring-boot-starter-actuator to your Maven project
• Selectively expose endpoints via management properties
• Add a Micrometer registry when you need persistent metrics
• Test endpoints locally before you push to production
• Protect metrics and operational endpoints with Spring Security

Final thoughts

Actuator plus Micrometer transforms a plain Spring Boot app into something you can actually monitor without guessing. Keep the exposure tight and the registry configured and your dashboards will stop lying to you. And if a metric ever goes wild you will at least be watching the chaos with context.