<p>I am playing around with Spring Cloud Data Flow. I have successfully deployed SCDF on Kubernetes using the related <a href="https://docs.spring.io/spring-cloud-dataflow-server-kubernetes/docs/1.5.0.RELEASE/reference/htmlsingle/#_available_applications" rel="nofollow noreferrer">documentation</a>. When registering the <a href="http://repo.spring.io/libs-release-local/org/springframework/cloud/stream/app/spring-cloud-stream-app-descriptor/Celsius.SR3/spring-cloud-stream-app-descriptor-Celsius.SR3.stream-apps-kafka-10-docker" rel="nofollow noreferrer">1.5.x based starter apps</a>, everything is working as expected, no further configuration of the starter apps during the deployment of a stream definition is needed. </p>

<p>When using the <a href="http://repo.spring.io/libs-release/org/springframework/cloud/stream/app/spring-cloud-stream-app-descriptor/Darwin.RELEASE/spring-cloud-stream-app-descriptor-Darwin.RELEASE.stream-apps-kafka-10-docker" rel="nofollow noreferrer">2.x based starter apps</a>, there are some changes introduced by the switch to Spring Boot 2.0 that need to be accommodated for, e.g. the actuator endpoints changed. For reference, here are the properties that I provide during the deployment of the stream:</p>

<pre><code>app.*.management.endpoints.web.exposure.include=health,info,binders
deployer.*.cpu=2
deployer.*.memory=4096
deployer.http.count=2
deployer.*.kubernetes.livenessProbePath=/actuator/health
deployer.*.kubernetes.readinessProbePath=/actuator/info
</code></pre>

<p>However, the readiness probe fails since the <code>health</code> and the <code>info</code> endpoint now seem to be protected by default. Therefore, the pods end up in crashloops since from the Kubernetes perspective they get never ready.</p>

<p>I worked around the situation by following the guide on <a href="https://docs.spring.io/spring-cloud-stream-app-starters/docs/Darwin.RELEASE/reference/htmlsingle/#_patching_pre_built_applications" rel="nofollow noreferrer">patching the starter apps</a> that my stream definition relies on (e.g. <code>throughput</code> sink) like this:</p>

<pre><code>@SpringBootApplication
@Import({org.springframework.cloud.stream.app.throughput.sink.ThroughputSinkConfiguration.class})
public class DemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }

    @Configuration
    protected static class ThroughputSinkSecurityConfiguration extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll();
        }

    }
}
</code></pre>

<p>Is there a way to specify this kind of security configuration via flags or properties? Shouldn't such a <code>WebSecurityConfigurerAdapter</code> be there by default to make the <code>health</code> and <code>info</code> endpoints accessible for Kubernetes?</p>

omoser
<p>I would suggest to look into the situation from the other angle and provide credential from the Kubernetes to get access to your secured Microservice.</p>

<p>The problem of the current status-quo that all the resources has to be protected. </p>

<p>You can generate your own static password and store it in the <code>application.properties</code> do not reconfigure Kubernetes for each application restart: <a href="https://docs.spring.io/spring-boot/docs/2.0.3.RELEASE/reference/htmlsingle/#boot-features-security" rel="nofollow noreferrer">https://docs.spring.io/spring-boot/docs/2.0.3.RELEASE/reference/htmlsingle/#boot-features-security</a></p>
