<p>I am playing around with Spring Cloud Data Flow. I have successfully deployed SCDF on Kubernetes using the related <a href="https://docs.spring.io/spring-cloud-dataflow-server-kubernetes/docs/1.5.0.RELEASE/reference/htmlsingle/#_available_applications" rel="nofollow noreferrer">documentation</a>. When registering the <a href="http://repo.spring.io/libs-release-local/org/springframework/cloud/stream/app/spring-cloud-stream-app-descriptor/Celsius.SR3/spring-cloud-stream-app-descriptor-Celsius.SR3.stream-apps-kafka-10-docker" rel="nofollow noreferrer">1.5.x based starter apps</a>, everything is working as expected, no further configuration of the starter apps during the deployment of a stream definition is needed. </p>

<p>When using the <a href="http://repo.spring.io/libs-release/org/springframework/cloud/stream/app/spring-cloud-stream-app-descriptor/Darwin.RELEASE/spring-cloud-stream-app-descriptor-Darwin.RELEASE.stream-apps-kafka-10-docker" rel="nofollow noreferrer">2.x based starter apps</a>, there are some changes introduced by the switch to Spring Boot 2.0 that need to be accommodated for, e.g. the actuator endpoints changed. For reference, here are the properties that I provide during the deployment of the stream:</p>

<pre><code>app.*.management.endpoints.web.exposure.include=health,info,binders
deployer.*.cpu=2
deployer.*.memory=4096
deployer.http.count=2
deployer.*.kubernetes.livenessProbePath=/actuator/health
deployer.*.kubernetes.readinessProbePath=/actuator/info
</code></pre>

<p>However, the readiness probe fails since the <code>health</code> and the <code>info</code> endpoint now seem to be protected by default. Therefore, the pods end up in crashloops since from the Kubernetes perspective they get never ready.</p>

<p>I worked around the situation by following the guide on <a href="https://docs.spring.io/spring-cloud-stream-app-starters/docs/Darwin.RELEASE/reference/htmlsingle/#_patching_pre_built_applications" rel="nofollow noreferrer">patching the starter apps</a> that my stream definition relies on (e.g. <code>throughput</code> sink) like this:</p>

<pre><code>@SpringBootApplication
@Import({org.springframework.cloud.stream.app.throughput.sink.ThroughputSinkConfiguration.class})
public class DemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }

    @Configuration
    protected static class ThroughputSinkSecurityConfiguration extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll();
        }

    }
}
</code></pre>

<p>Is there a way to specify this kind of security configuration via flags or properties? Shouldn't such a <code>WebSecurityConfigurerAdapter</code> be there by default to make the <code>health</code> and <code>info</code> endpoints accessible for Kubernetes?</p>

<p>Artem's response is very relevant. I wanted to also share a few other approaches specific to security and OOTB apps.</p>
<ol>
<li><p>In 1.6 SNAPSHOTs, we have recently added support via <a href="https://github.com/spring-cloud/spring-cloud-deployer-kubernetes/issues/236" rel="nofollow noreferrer">spring-cloud/spring-cloud-deployer-kubernetes#236</a> to plug basic-auth realm to interact with secured actuator endpoints. They are applicable to both liveness and readiness probes. Here's the <a href="https://github.com/spring-cloud/spring-cloud-dataflow-server-kubernetes/commit/110abeb97d1130af96b6c099860a85cd1995a7bf" rel="nofollow noreferrer">commit/docs</a> for your reference.</p>
</li>
<li><p>If you don't really want security at all, though not recommended, you can explicitly disable the Security configuration.</p>
</li>
</ol>
<blockquote>
<p>dataflow:&gt;stream create foo -- definition &quot;http | throughput&quot;</p>
<p>dataflow:&gt;stream deploy foo --properties app.*.spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration&quot;</p>
</blockquote>
<p><em>(i.e., all the Apps in the <code>foo</code> stream definition will start with <code>SecurityAutoConfiguration</code> excluded)</em></p>
