Enterprise Spring Boot: Modules
The program aims at using Spring Boot well from a small service up to a large, long-lived codebase. Configuration and modularisation, transactions and consistency, security with OAuth2/OIDC, API versioning and observability are studied as one whole. By the end, a participant can assess an existing Spring application and prepare an improvement plan.
01
Configuration and modularisation
Keeping the Spring container and configuration manageable as the codebase grows.
- Bean lifecycle and the auto-configuration mechanism
- @ConfigurationProperties and a profile strategy
- Spring Modulith or package-based module boundaries
- Dependency direction and removing cyclic dependencies
- Writing your own starter
Lab: Split a monolith into modules with clear boundaries and add a test that detects boundary violations automatically.
02
Transactions and consistency
What really happens behind the transaction annotation, and where it misleads.
- Proxy-based @Transactional and the self-invocation trap
- Propagation and rollback rules
- Isolation, optimistic and pessimistic locking
- The risk of external calls inside a transaction
- After-commit events (@TransactionalEventListener)
Lab: Reproduce a scenario where a partially successful operation leaves inconsistent state and fix the transaction boundary.
03
Spring Security, OAuth2 and OIDC
Building token validation and the authorisation model correctly on the resource-server side.
- Security filter chain and ordering
- OAuth2 resource server and JWT validation
- OIDC flows and token types
- Method security (@PreAuthorize) and the authority model
- CORS, CSRF and session policy
- Security testing
Lab: Build a JWT-protected resource server and verify role- and scope-based method security with tests.
04
API design and versioning
Practising how to evolve an API without breaking its consumers.
- Resource modelling and HTTP semantics
- Rules for backward-compatible change
- Comparing versioning approaches
- Error model with RFC 9457 problem details
- Checking against the OWASP API Security Top 10
- OpenAPI and contract tests
Lab: Change an existing endpoint without breaking consumers and prove compatibility with a contract test.
05
Observability
Making system behaviour visible by tying metrics, traces and logs together.
- Micrometer metrics and cardinality
- OpenTelemetry traces and context propagation
- Structured logs and correlation
- Health probes and securing Actuator
- Alerting based on SLIs/SLOs
Lab: Add tracing and metrics to a service and build a dashboard that follows one request from log line to trace.
06
Resilience and performance
Finding out how the system behaves when a dependency degrades and where the bottleneck sits.
- Timeout budgets, retries and backoff
- Circuit breakers and bulkheads (Resilience4j)
- Sizing connection and thread pools
- Caching: what, where and for how long
- Startup and memory tuning
Lab: Simulate a slow dependency and measure in a load test how the service behaves with timeouts and a circuit breaker.
07
Upgrade and migration strategy
Planning a major version change and gradual modernisation of old code with low risk.
- Reading release notes and migration guides
- Inventory of deprecated APIs
- Raising test coverage before the migration
- Staged rollout and a rollback plan
- Dependency compatibility and the Jakarta transition
Lab: Write a Spring Boot major-upgrade plan and risk register for a sample application and carry out its first stage.