Feature/8077/grafana logging #9290
Conversation
WalkthroughAdds Prometheus metrics support and Spring Boot actuator endpoints: two dependencies were added, actuator endpoints (including prometheus) were exposed in application properties, and security rules were updated to permit access to Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Prometheus
participant Client
participant App
participant Security
Client->>App: HTTP GET /actuator/prometheus
App->>Security: Check security rules for /actuator/prometheus
Security-->>App: Permit (public)
App-->>Client: 200 OK + Prometheus metrics
Prometheus->>App: Scrape /actuator/prometheus (periodic)
App-->>Prometheus: 200 OK + Prometheus metrics
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
core/src/main/java/greencity/config/SecurityConfig.java (1)
144-144: Consider rate limiting for public metrics endpoint.The
/actuator/prometheusendpoint is now publicly accessible, which is correct for Prometheus scraping. However, without rate limiting, this could be abused for reconnaissance or to cause resource exhaustion.Consider implementing rate limiting at the infrastructure level (e.g., API gateway, reverse proxy) or using Spring's RateLimiter for the actuator endpoints to prevent abuse while maintaining accessibility for legitimate monitoring.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
core/pom.xml(1 hunks)core/src/main/java/greencity/config/SecurityConfig.java(1 hunks)core/src/main/resources/application.properties(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2025-04-15T19:56:35.738Z
Learnt from: ChernenkoVitaliy
Repo: ita-social-projects/GreenCity PR: 8330
File: core/src/main/java/greencity/config/SecurityConfig.java:297-297
Timestamp: 2025-04-15T19:56:35.738Z
Learning: In GreenCity's SecurityConfig, endpoints not explicitly listed in authorization rules fall to the catch-all rule ".anyRequest().hasAnyRole(ADMIN)" which restricts access to ADMIN role only.
Applied to files:
core/src/main/java/greencity/config/SecurityConfig.java
📚 Learning: 2025-03-01T10:57:03.720Z
Learnt from: Warded120
Repo: ita-social-projects/GreenCity PR: 8195
File: core/src/main/java/greencity/config/SecurityConfig.java:217-219
Timestamp: 2025-03-01T10:57:03.720Z
Learning: When working with Spring Security configuration, edit existing requestMatchers() instead of creating new ones to avoid permission conflicts, as Spring Security applies the first matching rule when evaluating access restrictions.
Applied to files:
core/src/main/java/greencity/config/SecurityConfig.java
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (2)
core/src/main/java/greencity/config/SecurityConfig.java (1)
144-144: Secure all exposed actuator endpoints explicitly.The
management.endpoints.web.exposure.includeproperty exposeshealth, info, metrics, prometheus, env, threaddump. While/actuator/prometheusis explicitly permitted, the remaining endpoints (env,threaddump,health,info,metrics) fall through to the catch-all rule.anyRequest().permitAll()at line 497, making them publicly accessible without authentication. Theenvandthreaddumpendpoints are particularly sensitive and should be restricted to administrators only.Add explicit security rules for all exposed actuator endpoints:
.requestMatchers("/actuator/prometheus").permitAll() +.requestMatchers("/actuator/health", "/actuator/info", "/actuator/metrics").permitAll() +.requestMatchers("/actuator/**").hasAnyRole(ADMIN)⛔ Skipped due to learnings
Learnt from: ChernenkoVitaliy Repo: ita-social-projects/GreenCity PR: 8330 File: core/src/main/java/greencity/config/SecurityConfig.java:297-297 Timestamp: 2025-04-15T19:56:35.738Z Learning: In GreenCity's SecurityConfig, endpoints not explicitly listed in authorization rules fall to the catch-all rule ".anyRequest().hasAnyRole(ADMIN)" which restricts access to ADMIN role only.Learnt from: Warded120 Repo: ita-social-projects/GreenCity PR: 8195 File: core/src/main/java/greencity/config/SecurityConfig.java:217-219 Timestamp: 2025-03-01T10:57:03.720Z Learning: When working with Spring Security configuration, edit existing requestMatchers() instead of creating new ones to avoid permission conflicts, as Spring Security applies the first matching rule when evaluating access restrictions.core/pom.xml (1)
238-246: LGTM: Dependencies are appropriate for Prometheus metrics.The added dependencies correctly enable Prometheus metrics collection:
micrometer-registry-prometheuswith runtime scope is appropriate for metrics exportspring-boot-starter-actuatorprovides the actuator endpoints infrastructureThe versions are correctly inherited from Spring Boot 3.5.6 (the parent BOM), which is a current and secure version that includes recent security fixes for CVE-2025-41249 and related issues. This dependency management approach is recommended practice.
|
temporarily opened /actuator/prometheus endpoint
Issue
8077
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.