Actuator ve Gözlemlenebilirlik — Sağlık, Metrik, İz

1
management:
2
  server:
3
    port: 8081                         # not exposed through the public ingress
4
  endpoints:
5
    web:
6
      exposure:
7
        include: health,info,metrics,prometheus
8
  endpoint:
9
    health:
10
      probes:
11
        enabled: true
12
      show-details: when-authorized
13
      group:
14
        # Liveness: only "is this JVM stuck?". Never external dependencies.
15
        liveness:
16
          include: livenessState
17
        # Readiness: can this pod take traffic right now?
18
        readiness:
19
          include: readinessState,db
20
        # For dashboards and the on-call engineer, not for Kubernetes.
21
        dependencies:
22
          include: db,cardNetwork
23
  metrics:
24
    tags:
25
      application: card-authorization  # every metric carries it; one fixed value
26
  observations:
27
    annotations:
28
      enabled: true                    # makes @Observed work (Boot 3.2+)
29
    key-values:
30
      region: eu-central

1
@Component("cardNetwork")              // the name used in the health groups above
2
class CardNetworkHealth implements HealthIndicator {
3

4
    private final CardNetworkConnection network;   // long-lived link to the card scheme
5

6
    CardNetworkHealth(CardNetworkConnection network) {
7
        this.network = network;
8
    }
9

10
    @Override
11
    public Health health() {
12
        try {
13
            Duration latency = network.echoTest();      // scheme echo message, short timeout
14
            return Health.up().withDetail("latencyMs", latency.toMillis()).build();
15
        } catch (RuntimeException ex) {
16
            return Health.down().withDetail("error", ex.getClass().getSimpleName()).build();
17
        }
18
    }
19
}

1
@Component
2
class AuthorizationMetrics {
3

4
    private final MeterRegistry meters;
5

6
    AuthorizationMetrics(MeterRegistry meters) {
7
        this.meters = meters;
8
    }
9

10
    // Tag values come from enums: a handful of time series, whatever the traffic.
11
    void approved(Channel channel, BigDecimal amount) {       // POS, ECOMMERCE, ATM
12
        meters.counter("card.authorizations", "channel", channel.name(), "result", "APPROVED").increment();
13
        DistributionSummary.builder("card.authorization.amount")
14
                .baseUnit("TRY")
15
                .tag("channel", channel.name())
16
                .register(meters)
17
                .record(amount.doubleValue());   // fine for a histogram; never for the ledger
18
    }
19

20
    void declined(Channel channel, DeclineReason reason) {    // INSUFFICIENT_FUNDS, SUSPECTED_FRAUD, …
21
        // NOT tag("pan", …) or tag("customerId", …): a card number in a metric is a data
22
        // leak, and one time series per card would sink the metrics backend anyway.
23
        meters.counter("card.authorizations", "channel", channel.name(), "result", reason.name()).increment();
24
    }
25
}

1
@Service
2
class AuthorizationService {
3

4
    private final AuthorizationMetrics metrics;
5
    private final CardAccountRepository cards;
6

7
    AuthorizationService(AuthorizationMetrics metrics, CardAccountRepository cards) {
8
        this.metrics = metrics;
9
        this.cards = cards;
10
    }
11

12
    // One annotation, two signals: a timer metric and a span in the trace.
13
    // The merchant's terminal is waiting, so this timer is the number the on-call watches.
14
    @Observed(name = "card.authorize", contextualName = "card.authorize",
15
              lowCardinalityKeyValues = {"flow", "online"})
16
    @Transactional
17
    public AuthorizationResult authorize(AuthorizationRequest request) {
18
        CardAccount card = cards.findByTokenForUpdate(request.cardToken()).orElseThrow();
19
        if (card.available().compareTo(request.amount()) < 0) {
20
            metrics.declined(request.channel(), DeclineReason.INSUFFICIENT_FUNDS);
21
            return AuthorizationResult.declined(DeclineReason.INSUFFICIENT_FUNDS);
22
        }
23
        card.hold(request.amount());                 // blocked until the merchant settles
24
        metrics.approved(request.channel(), request.amount());
25
        return AuthorizationResult.approved(card.nextAuthCode());
26
    }
27
}

1
@Configuration
2
class ManagementSecurity {
3

4
    // Matches only requests to actuator endpoints (on the management port).
5
    @Bean
6
    @Order(0)
7
    SecurityFilterChain actuator(HttpSecurity http) throws Exception {
8
        return http
9
                .securityMatcher(EndpointRequest.toAnyEndpoint())
10
                .authorizeHttpRequests(auth -> auth
11
                        .requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll()
12
                        .anyRequest().hasRole("OPS"))
13
                .httpBasic(Customizer.withDefaults())
14
                .build();
15
    }
16
}