Introduction

If a Prometheus endpoint is not showing up in a Spring Boot 2 WebFlux application, the problem is usually dependency setup or actuator exposure, not WebFlux itself. Spring Boot 2 moved monitoring onto Micrometer and changed actuator behavior compared with older Spring Boot releases. That means older blog posts and MVC-era examples often miss the exact pieces a reactive application needs.

Verify the Required Dependencies

For Prometheus scraping in Spring Boot 2, you generally need:

• actuator,
• Micrometer Prometheus registry,
• your chosen WebFlux starter.

Example Maven dependencies:

1<dependencies>
2  <dependency>
3    <groupId>org.springframework.boot</groupId>
4    <artifactId>spring-boot-starter-webflux</artifactId>
5  </dependency>
6
7  <dependency>
8    <groupId>org.springframework.boot</groupId>
9    <artifactId>spring-boot-starter-actuator</artifactId>
10  </dependency>
11
12  <dependency>
13    <groupId>io.micrometer</groupId>
14    <artifactId>micrometer-registry-prometheus</artifactId>
15  </dependency>
16</dependencies>

If the Prometheus registry dependency is missing, the endpoint usually will not be available even if actuator is present.

Expose the Endpoint Explicitly

Actuator endpoints are not all exposed automatically. Configure exposure in application properties:

management.endpoints.web.exposure.include=health,info,prometheus
management.endpoint.prometheus.enabled=true

For many Boot 2 setups, the endpoint path is:

/actuator/prometheus

That is an important detail. Older actuator conventions from Spring Boot 1.x do not apply directly.

WebFlux Does Not Change the Basic Path

WebFlux changes the runtime stack from servlet-based MVC to reactive infrastructure, but Prometheus exposure still depends on actuator and Micrometer configuration. If the endpoint is missing, do not assume WebFlux is incompatible. More often, one of these is true:

• the endpoint is not exposed,
• the registry dependency is missing,
• security blocks access,
• the application is using outdated RC behavior.

Reactive runtime alone is usually not the core issue.

Check Security Configuration

If actuator is present but the endpoint returns unauthorized or forbidden responses, inspect security rules.

For example:

1import org.springframework.context.annotation.Bean;
2import org.springframework.security.config.web.server.ServerHttpSecurity;
3import org.springframework.security.web.server.SecurityWebFilterChain;
4
5@Bean
6SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
7    return http
8        .authorizeExchange(exchanges -> exchanges
9            .pathMatchers("/actuator/prometheus").permitAll()
10            .anyExchange().authenticated()
11        )
12        .build();
13}

Without an explicit rule, the endpoint may exist but still be inaccessible to Prometheus.

Confirm the Endpoint Exists

Check exposed actuator endpoints directly:

curl http://localhost:8080/actuator
curl http://localhost:8080/actuator/prometheus

If /actuator works but prometheus is missing from the payload or links, the issue is almost always exposure or dependency configuration.

If /actuator/prometheus exists but scraping fails, inspect:

• network path,
• security,
• management port settings,
• reverse proxy routing.

RC1-Specific Reality

Spring Boot 2.0.0.RC1 was a release candidate, not the final stable release. If you are debugging behavior in that exact version, upgrading to a stable Spring Boot 2.x release is often the correct engineering fix.

Release candidates can contain actuator or WebFlux integration quirks that disappeared later. That does not help if you are pinned temporarily, but it should change how much time you spend trying to perfect a brittle RC setup.

Practical Debug Sequence

Use this order:

1. verify dependencies,
2. verify endpoint exposure config,
3. test /actuator,
4. test /actuator/prometheus,
5. inspect security and routing,
6. upgrade off RC1 if possible.

This is faster than changing random properties and hoping the endpoint appears.

Common Pitfalls

• Adding actuator without adding the Micrometer Prometheus registry dependency.
• Expecting the endpoint to be exposed automatically without management.endpoints.web.exposure.include.
• Looking for an old pre-Boot-2 metrics path instead of /actuator/prometheus.
• Assuming WebFlux is the incompatibility when the real problem is security or actuator configuration.
• Spending too much time debugging 2.0.0.RC1 behavior instead of upgrading to a stable Spring Boot release.

Summary

• A working Prometheus endpoint in Spring Boot 2 WebFlux usually requires actuator plus micrometer-registry-prometheus.
• The endpoint is typically exposed at /actuator/prometheus.
• You must configure actuator exposure explicitly and check security rules.
• WebFlux is usually not the root cause; missing config is.
• If you are on 2.0.0.RC1, upgrading is often the cleanest long-term fix.