From 0db0ee06a10676b140d3c2497807aa5adb8cb718 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=91=A8=E6=B6=9B?= Date: Fri, 18 Sep 2026 23:39:09 +0800 Subject: [PATCH] feat: expose private Prometheus scrape endpoint --- .../opensabre/authorization/config/WebSecurityConfig.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java b/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java index 0f53217..2ccef72 100644 --- a/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java +++ b/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java @@ -74,6 +74,10 @@ public SecurityFilterChain defaultSecurityFilterChain( .permitAll() .requestMatchers("/actuator/internalTokenKeyStatus") .permitAll() + // The management port is private to the deployment network. Only the + // aggregate scrape endpoint is exposed to Prometheus without a user token. + .requestMatchers("/actuator/prometheus") + .permitAll() .requestMatchers(ActuatorMonitoringAccess.metricPathArray()) .hasAuthority(ActuatorMonitoringAccess.AUTHORITY) .requestMatchers(