Feat: Setup Spring Boot Actuator with Prometheus and Grafana monitoring - #64
Merged
Conversation
📝 WalkthroughWalkthroughSpring Boot Actuator에 Prometheus 메트릭 노출과 프로필별 접근 제어를 추가했습니다. Prometheus가 로컬 및 운영 API를 수집하도록 구성했습니다. Docker Compose에 Prometheus와 Grafana를 추가했습니다. Changes모니터링 파이프라인
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant DockerCompose
participant Prometheus
participant MomogoAPI
participant Grafana
DockerCompose->>Prometheus: 서비스 시작 및 설정 마운트
DockerCompose->>Grafana: Prometheus 시작 후 서비스 시작
Prometheus->>MomogoAPI: /actuator/prometheus 요청
MomogoAPI-->>Prometheus: Prometheus 메트릭 반환
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
docker-compose.yml (1)
36-36: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win개선: Prometheus와 Grafana 이미지 버전을 고정하세요.
latest는 배포 시점에 따라 다른 이미지를 가져옵니다. Prometheus 설정과 Grafana dashboard의 호환성이 바뀔 수 있습니다. 장애 발생 시 동일한 이미지를 재현하거나 롤백하기도 어렵습니다.검증한 version tag를 사용하세요. 운영 배포에서는 digest 고정도 고려하세요.
권장 형태
- image: prom/prometheus:latest + image: prom/prometheus:<tested-version> - image: grafana/grafana:latest + image: grafana/grafana:<tested-version>배포용 모니터링 스택이라는 PR 목적을 기준으로 판단했습니다.
Also applies to: 47-47
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docker-compose.yml` at line 36, Replace the floating latest image tags for Prometheus and Grafana in the Docker Compose service definitions with explicitly validated version tags, and consider digest pinning for production reproducibility. Update both image entries, preserving the existing service configuration.prometheus/prometheus.yml (1)
13-15: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win개선:
applicationlabel 생성 위치를 하나로 통일하세요.
momogo-api/src/main/resources/application.yaml의management.metrics.tags.application이 이미 애플리케이션 메트릭에application=momogo-api를 추가합니다. 이 파일의 두static_configs도 같은 target label을 추가합니다.Prometheus 기본
honor_labels: false에서는 충돌한 scraped label이exported_application으로 재명명될 수 있습니다. 이 설정은 불필요한 label과 시계열을 만듭니다.애플리케이션 공통 태그를 유지한다면 두
static_configs에서applicationlabel을 삭제하세요. Target label을 사용할 경우에는 애플리케이션 공통 태그를 삭제하세요. 두 방식을 동시에 사용하지 마세요.제공된
application.yaml의 공통 tag 설정과 이 파일의 target label을 교차 확인했습니다.Also applies to: 23-25
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@prometheus/prometheus.yml` around lines 13 - 15, Prometheus의 두 static_configs에서 application target label과 애플리케이션 공통 태그가 중복 정의되지 않도록 정리하세요. application.yaml의 management.metrics.tags.application을 유지하는 경우 prometheus.yml의 각 static_configs에서 application 항목을 삭제하고, 두 scrape 대상 모두 동일한 기존 메트릭 태그를 사용하게 하세요.momogo-core/build.gradle (1)
14-14: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMicrometer registry는 구현 범위만 노출하세요.
micrometer-registry-prometheus가momogo-core의 public API에서 사용되지 않습니다. 이 의존성도implementation으로 두면 actuator와 같은 런타임 구현 의존성과 같은 경계를 가집니다.권장 변경
- api 'io.micrometer:micrometer-registry-prometheus' + implementation 'io.micrometer:micrometer-registry-prometheus'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@momogo-core/build.gradle` at line 14, Change the micrometer-registry-prometheus dependency declaration in momogo-core’s build configuration from api to implementation, keeping it scoped as an internal runtime dependency like the other actuator implementation dependencies.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.yml`:
- Around line 54-55: Replace the hardcoded GF_SECURITY_ADMIN_PASSWORD value with
a required environment or secret-manager variable so Compose fails when it is
unset, while preserving GF_SECURITY_ADMIN_USER. Also document or apply the
deployment procedure for rotating the password or recreating the existing
grafana-data volume, since changing the variable alone may not update an
initialized Grafana instance.
- Around line 38-39: Update the Prometheus and Grafana port mappings in the
Docker Compose services to bind host ports explicitly to 127.0.0.1 instead of
all host interfaces, using the existing 9090 and 3000 container ports.
In `@momogo-api/src/main/java/com/momogo/api/auth/config/SecurityConfig.java`:
- Line 77: Update SecurityConfig so /actuator/prometheus is no longer
unauthenticated; restrict it through an internal management port, dedicated
authentication, or ingress/network ACL, and update the Prometheus scrape
configuration if authentication or access restrictions are introduced. Keep only
the non-sensitive actuator endpoints publicly accessible.
In `@prometheus/prometheus.yml`:
- Around line 17-22: Update the momogo-prod-api scrape configuration to match
the production endpoint: use HTTPS for momogo.kro.kr and add the required TLS
settings while retaining the actuator Prometheus metrics path. If HTTP is
intentionally retained, verify that the endpoint returns HTTP 200 with valid
Prometheus metrics.
---
Nitpick comments:
In `@docker-compose.yml`:
- Line 36: Replace the floating latest image tags for Prometheus and Grafana in
the Docker Compose service definitions with explicitly validated version tags,
and consider digest pinning for production reproducibility. Update both image
entries, preserving the existing service configuration.
In `@momogo-core/build.gradle`:
- Line 14: Change the micrometer-registry-prometheus dependency declaration in
momogo-core’s build configuration from api to implementation, keeping it scoped
as an internal runtime dependency like the other actuator implementation
dependencies.
In `@prometheus/prometheus.yml`:
- Around line 13-15: Prometheus의 두 static_configs에서 application target label과
애플리케이션 공통 태그가 중복 정의되지 않도록 정리하세요. application.yaml의
management.metrics.tags.application을 유지하는 경우 prometheus.yml의 각 static_configs에서
application 항목을 삭제하고, 두 scrape 대상 모두 동일한 기존 메트릭 태그를 사용하게 하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 7094363c-3644-4da3-b2d5-4913933a10f5
📒 Files selected for processing (5)
docker-compose.ymlmomogo-api/src/main/java/com/momogo/api/auth/config/SecurityConfig.javamomogo-api/src/main/resources/application.yamlmomogo-core/build.gradleprometheus/prometheus.yml
idktomorrow
approved these changes
Aug 7, 2026
idktomorrow
left a comment
idktomorrow
left a comment
Collaborator
There was a problem hiding this comment.
이번에는 피카츄가 없겠네요.. LGTM! ❤️
Collaborator
Author
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@momogo-api/src/main/java/com/momogo/api/auth/config/SecurityConfig.java`:
- Line 77: Update the SecurityConfig SecurityFilterChain so HTTP Basic remains
enabled for the production actuator/prometheus authorization flow: remove the
later httpBasic disable configuration, or separate Basic authentication into an
appropriate dedicated chain, while preserving the required METRICS and
SUPER_ADMIN authorization rules.
In `@prometheus/prometheus.yml`:
- Around line 19-21: Remove the basic_auth configuration from the production
Prometheus scrape target for momogo-prod-api and switch its scheme from http to
https. If HTTPS is unavailable, do not retain credentials over HTTP; instead use
the established private-network/VPN path with ACLs plus mTLS or authenticated
internal proxy protection.
- Around line 19-21: Prometheus의 basic_auth 설정에서 지원되지 않는 ${PROMETHEUS_USER} 및
${PROMETHEUS_PASS} 변수 expansion을 제거하세요. username_file과 password_file을 사용해 Docker
secret 파일을 참조하도록 구성하고, 해당 secret이 컨테이너에 마운트되어 실제 scraping 자격 증명이 제공되도록 배포 설정과
일치시키세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 46007550-09ce-45ea-9768-6d6e165a5de0
📒 Files selected for processing (3)
docker-compose.ymlmomogo-api/src/main/java/com/momogo/api/auth/config/SecurityConfig.javaprometheus/prometheus.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- docker-compose.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
작업 내용
user,user-login,notification,problem-ai,room-submit) 특화 시각화 대시보드를 추가host.docker.internal:8080)과 실제 배포 서버(momogo.kro.kr) 지표를 모두 수집할 수 있도록 다중 환경(Multi-Environment) 지표 파이프라인을 구축변경 사항
momogo-core에micrometer-registry-prometheus의존성을 추가하고,application.yaml에 Actuator prometheus 엔드포인트 노출 및 HTTP 응답 속도 백분위수(p95 Latency) 히스토그램 수집을 설정SecurityConfig에/actuator/prometheus엔드포인트를.permitAll()로 추가하여 프로메테우스 스크랩 통신을 허용docker-compose.yml): 프로메테우스(5초 Scrape 주기)와 그라파나 컨테이너를 구성하고,prometheus-data및grafana-data볼륨을 매핑하여 도커 재시작 시에도 수집 지표와 대시보드 설정이 영구 보존되도록 개선MoMoGo대시보드 구축 및 k6 특화 패널 추가: 대시보드 상단에Server Instance드롭다운 필터를 배치하여 로컬과 배포 서버 지표를 완전히 독립시켜 확인할 수 있도록 설정하였으며, k6 부하 테스트 5대 API의p95 Latency,TPS,5xx 서버 에러 수를 추적하는 전용 패널을 시각화체크리스트
참고 사항
docker-compose up -d prometheus grafana실행 후http://localhost:3000(ID:admin, PW:admin)에 접속Server Instance드롭다운에서host.docker.internal:8080(로컬) 또는momogo.kro.kr(배포 서버)를 선택하면 해당 서버의 실시간 지표(CPU, 메모리, 스레드, API 응답속도)로 즉시 전환관련 이슈
Summary by CodeRabbit