먼저 Actuator를 사용하려면 의존성을 추가해야 해요:

// Gradle
implementation 'org.springframework.boot:spring-boot-starter-actuator'

// Maven
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

# application.properties
# 모든 엔드포인트 비활성화 후 필요한 것만 활성화
management.endpoints.web.exposure.include=health,info
management.endpoints.web.exposure.exclude=env,beans

# application.yml
management:
  endpoints:
    web:
      exposure:
        include: "health,info"
        exclude: "env,beans"

# application.properties
management.endpoints.web.base-path=/management

# application.yml
management:
  endpoints:
    web:
      base-path: "/management"

# application.properties
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=your-password
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=tomcat
server.port=8443

# application.properties
# health 엔드포인트에서 상세 정보 숨기기
management.endpoint.health.show-details=never
# 또는 인증된 사용자에게만 상세 정보 보여주기
management.endpoint.health.show-details=when-authorized

# info 엔드포인트 커스터마이징
info.app.name=MyAwesomeApp
info.app.version=1.0.0
info.app.description=This is my awesome Spring Boot application

# application.properties
# 민감한 엔드포인트 비활성화
management.endpoint.env.enabled=false
management.endpoint.configprops.enabled=false

# 또는 특정 엔드포인트만 활성화
management.endpoints.enabled-by-default=false
management.endpoint.health.enabled=true
management.endpoint.info.enabled=true

# application.properties
# shutdown 엔드포인트 활성화 (필요한 경우에만!)
management.endpoint.shutdown.enabled=true

// Gradle
implementation 'org.springframework.boot:spring-boot-starter-security'

// Maven
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
                .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR_ADMIN")
                .anyRequest().authenticated()
            .and()
            .httpBasic();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("securePassword123!")
            .roles("ACTUATOR_ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@Configuration
@EnableWebSecurity
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
                .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR_ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic(withDefaults());
        
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.builder()
            .username("admin")
            .password("{bcrypt}" + new BCryptPasswordEncoder().encode("securePassword123!"))
            .roles("ACTUATOR_ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@Configuration
@EnableWebSecurity
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
                .requestMatchers(EndpointRequest.toAnyEndpoint()).hasAuthority("SCOPE_actuator.admin")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            );
        
        return http.build();
    }

    private Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<String> scopes = jwt.getClaimAsStringList("scope");
            return scopes.stream()
                .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

@Configuration
@EnableWebSecurity
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers(EndpointRequest.toAnyEndpoint())
                .access(new IpAddressAuthorizationManager("192.168.1.0/24", "10.0.0.0/8"))
                .anyRequest().authenticated()
            )
            .httpBasic(withDefaults());
        
        return http.build();
    }
}

class IpAddressAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {
    private final List<IpAddressMatcher> ipAddressMatchers;

    public IpAddressAuthorizationManager(String... ipAddresses) {
        this.ipAddressMatchers = Arrays.stream(ipAddresses)
            .map(IpAddressMatcher::new)
            .collect(Collectors.toList());
    }

    @Override
    public AuthorizationDecision check(Supplier<Authentication> authentication, RequestAuthorizationContext context) {
        HttpServletRequest request = context.getRequest();
        String remoteAddr = request.getRemoteAddr();
        
        boolean matches = ipAddressMatchers.stream()
            .anyMatch(matcher -> matcher.matches(remoteAddr));
        
        return new AuthorizationDecision(matches);
    }
}

@Component
public class TimeBasedAccessDecisionVoter implements AccessDecisionVoter<Object> {

    @Override
    public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }

    @Override
    public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
        LocalTime now = LocalTime.now();
        
        // 업무 시간: 오전 9시 ~ 오후 6시
        if (now.isAfter(LocalTime.of(9, 0)) && now.isBefore(LocalTime.of(18, 0))) {
            return ACCESS_GRANTED;
        }
        
        return ACCESS_DENIED;
    }
}

# application-dev.properties
management.endpoints.web.exposure.include=*
management.endpoint.health.show-details=always

# 개발 환경용 간단한 보안 설정
spring.security.user.name=dev
spring.security.user.password=dev-password
spring.security.user.roles=ACTUATOR_ADMIN

# application-test.properties
management.endpoints.web.exposure.include=health,info,metrics
management.endpoint.health.show-details=when-authorized

# 테스트 환경용 보안 설정
spring.security.user.name=${TEST_ACTUATOR_USER}
spring.security.user.password=${TEST_ACTUATOR_PASSWORD}
spring.security.user.roles=ACTUATOR_ADMIN

# application-prod.properties
management.endpoints.web.exposure.include=health,info,metrics
management.endpoint.health.show-details=never
management.endpoints.web.base-path=/management/actuator

# 프로덕션 환경에서는 Spring Security 설정 클래스를 통해 더 강력한 보안 적용

# Kubernetes Ingress 설정 예시
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: actuator-ingress
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,192.168.0.0/16"
spec:
  rules:
  - host: actuator.myapp.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp-service
            port:
              number: 8080

# application.properties
management.endpoints.web.exposure.include=prometheus
management.metrics.export.prometheus.enabled=true

# Prometheus 설정 (prometheus.yml)
scrape_configs:
  - job_name: 'spring-boot-app'
    metrics_path: '/actuator/prometheus'
    basic_auth:
      username: 'prometheus'
      password: 'secure-password-here'
    scheme: https
    tls_config:
      insecure_skip_verify: false
    static_configs:
      - targets: ['myapp.example.com:8080']

# Grafana 데이터 소스 설정
{
  "name": "Spring Boot App",
  "type": "prometheus",
  "url": "https://prometheus.example.com",
  "access": "proxy",
  "basicAuth": true,
  "basicAuthUser": "grafana",
  "secureJsonData": {
    "basicAuthPassword": "secure-password-here"
  }
}

# Spring Boot Admin Server 설정
spring.boot.admin.client.url=https://admin.example.com
spring.boot.admin.client.instance.metadata.user.name=${spring.security.user.name}
spring.boot.admin.client.instance.metadata.user.password=${spring.security.user.password}
spring.boot.admin.client.username=admin-server
spring.boot.admin.client.password=secure-admin-password

# Spring Boot Admin Client 설정
spring.boot.admin.client.instance.name=My App
spring.boot.admin.client.instance.prefer-ip=true