fix: add missing endpoints to the default list of probed endpoints

[cdprete]

This PR adds some missed endpoint IDs to the default list of probed endpoints configured in de.codecentric.boot.admin.server.config.AdminServerProperties#probedEndpoints

[SteKoe]

This is false positive. The listed endpoint IDs are just valid and used for Spring Boot 1.x applications. The comment states it correctly:

For Spring Boot 2.x applications the endpoints should be discovered automatically using the actuator links. For Spring Boot 1.x applications SBA probes for the specified endpoints using an OPTIONS request.

1. EndpointDetector delegates to a ChainingStrategy (configured in AdminServerAutoConfiguration.java:139-148)
2. The chain tries QueryIndexEndpointStrategy first -- this is the Spring Boot >= 2 path (e.g. /actuator). It queries the actuator HATEOAS index at the management URL and extracts endpoint links from the _links response.
3. If that returns empty (e.g. for a Spring Boot 1.x app that has no HAL index), it falls back to ProbeEndpointsStrategy, which individually probes well-known endpoint paths via OPTIONS requests.

The fallback mechanism uses Mono.switchIfEmpty() in ChainingStrategy.java:25, so for a Spring Boot >= 2 app:

• QueryIndexEndpointStrategy succeeds and returns discovered endpoints
• ProbeEndpointsStrategy is never invoked

That's why I am reluctant to merge this PR as it will try to probed for endpoints that do not exist in Spring Boot 1.

[cdprete]

If I remember correctly, the strategy may be configured or somehow mangled to use the probe-based one (e.g.: for security reasons) which then would miss some endpoints.
There was a ticket some months ago proving this (#5062).

The listed endpoint IDs are just valid and used for Spring Boot 1.x applications.

The property is mutable, so if you really want enforce them it should then be read-only.
Maybe its scope should be widen up.

That's why I am reluctant to merge this PR as it will try to probed for endpoints that do not exist in Spring Boot 1.

Of course, up to you.
I just thought it made sense (at least to me).

[SteKoe]

If I remember correctly, the strategy may be configured or somehow mangled to use the probe-based one (e.g.: for security reasons) which then would miss some endpoints.

Good catch! Thanks for pointing this out. Yes, when /actuator is, for whatever reason, blocked, than this fixed setup of possible actuators will help to overcome the missing HAL-response. Thank you :)

[cdprete]

You're welcome. ☺️