What Is application.yml in Spring Boot?
In Spring Boot, externalized configuration is the mechanism that lets you separate environment-specific values — database URLs, ports, credentials, feature flags — from your compiled Java code. The two canonical formats are application.properties (flat key=value pairs) and application.yml (hierarchical YAML). Both live on the classpath, typically under src/main/resources, and are loaded automatically by Spring Boot at startup through the Environment abstraction.
YAML's nested structure mirrors the namespaces of Spring Boot configuration keys. A property like spring.datasource.hikari.maximum-pool-size becomes a clean indented tree, which is much easier to scan when you have dozens or hundreds of keys for a real-world microservice. That's why the YAML format has become the de-facto standard in Spring Boot 3.x, Spring Cloud, Spring Cloud Kubernetes and Spring for GraphQL projects.
Properties vs YAML in Spring Boot
| Aspect | application.properties | application.yml |
|---|---|---|
| Syntax | Flat key=value | Nested, indentation-based |
| Readability for deep hierarchies | Verbose, repetitive prefixes | Clean, grouped, scannable |
| Lists / arrays | Indexed keys (servers[0]=…) | Native YAML lists |
| Multi-document / profiles | Separate application-{profile}.properties only | Profile files and--- document separators in one file |
| Comments | # | # |
| Tooling support | Excellent everywhere | Excellent (IDE plugins, schemas) |
| Risk of bugs | Low — flat keys | Indentation errors break the file |
| Recommended for | Tiny apps, legacy projects | Microservices, cloud-native apps |
Advantages of YAML
- Hierarchy mirrors namespaces — spring.*, management.* and your own @ConfigurationProperties beans group naturally.
- First-class lists and maps — perfect for spring.kafka.bootstrap-servers, CORS allowed origins, scheduler cron lists.
- Multi-document profiles — define all profile overrides in a single application.yml with
---separators and spring.config.activate.on-profile. - Better diffs in code review — adding a single nested key produces a one-line diff instead of a long prefix.
- Ecosystem alignment — Kubernetes manifests, Helm charts, GitHub Actions and Docker Compose are all YAML, so your operators read one syntax end-to-end.
When To Use application.properties
Properties files still make sense in a handful of cases: legacy Spring 2.x projects, internal tools where the config is 5–10 lines and never grows, IDE-driven quick experiments, and override files like application-test.properties that ship inside a JAR for repeatable test runs. Outside those cases, YAML wins for any service that will be promoted across dev → test → staging → prod.
Spring Boot Configuration Best Practices
- Keep secrets out of source control. Use environment variables, Spring Cloud Config, HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets mounted as files.
- Use @ConfigurationProperties for typed binding instead of scattering @Value across the codebase.
- Pin a default profile (spring.profiles.default: local) so misconfigured environments fail loudly.
- Externalize per-environment values via --spring.config.location or SPRING_CONFIG_IMPORT rather than baking them in the JAR.
- Always set HikariCP pool size, connection timeout and max lifetime explicitly in production.
- Enable actuator health, info and metrics endpoints, then expose only what your platform consumes.
- Set logging.level per package; never ship
DEBUGon the root logger to production. - Validate config at startup with @Validated on your properties beans.
Common YAML Mistakes
- Tabs instead of spaces. YAML forbids tabs for indentation. Use two spaces consistently.
- Misaligned children. Sibling keys must share the exact same column.
- Implicit type surprises. Unquoted
yes,no,on,offbecome booleans; quote them if you mean strings. - Leading zeros.
port: 08080is parsed as octal in YAML 1.1 — quote numeric strings. - Duplicate keys. Two top-level
spring:blocks silently overwrite earlier values in many parsers. - Multiline scalars. Use
|(literal) or>(folded) for embedded SQL, JWT secrets or PEM keys.
Common Spring Boot Configuration Errors
- spring.database.url — wrong namespace; the correct key is spring.datasource.url.
- server.servlet.contextPath — camelCase ignored; use server.servlet.context-path.
- spring.jpa.hibernate.ddlAuto — wrong; use spring.jpa.hibernate.ddl-auto.
- Forgetting spring.jpa.database-platform when Spring Boot can't auto-detect the dialect.
- Setting spring.datasource.driver-class-name unnecessarily on Spring Boot 3 — it's auto-detected.
- Using management.endpoints.web.expose instead of management.endpoints.web.exposure.include.
Spring Boot Configuration Examples
MySQL + HikariCP
spring: datasource: url: jdbc:mysql://localhost:3306/demo?useSSL=false&serverTimezone=UTC username: root password: ${DB_PASSWORD} hikari: maximum-pool-size: 20 minimum-idle: 5 idle-timeout: 30000 connection-timeout: 20000 jpa: hibernate: ddl-auto: validate properties: hibernate: dialect: org.hibernate.dialect.MySQL8DialectPostgreSQL
spring: datasource: url: jdbc:postgresql://localhost:5432/demo username: postgres password: ${DB_PASSWORD} jpa: properties: hibernate: dialect: org.hibernate.dialect.PostgreSQLDialectMongoDB
spring: data: mongodb: uri: mongodb://user:pass@localhost:27017/demo?authSource=admin
Redis
spring: data: redis: host: localhost port: 6379 password: ${REDIS_PASSWORD} timeout: 2000ms lettuce: pool: max-active: 16 max-idle: 8Kafka
spring: kafka: bootstrap-servers: localhost:9092 consumer: group-id: demo-group auto-offset-reset: earliest key-deserializer: org.apache.kafka.common.serialization.StringDeserializer value-deserializer: org.apache.kafka.common.serialization.StringDeserializer producer: key-serializer: org.apache.kafka.common.serialization.StringSerializer value-serializer: org.apache.kafka.common.serialization.StringSerializer acks: all
RabbitMQ
spring: rabbitmq: host: localhost port: 5672 username: guest password: guest virtual-host: /
OAuth2 Resource Server (JWT)
spring: security: oauth2: resourceserver: jwt: issuer-uri: https://auth.example.com/realms/demo
JWT App-Level Config
app: jwt: secret: ${JWT_SECRET} expiration-ms: 3600000 issuer: my-serviceProduction Configuration Checklist
- ✅ Externalize all secrets via env vars or a secrets manager.
- ✅ Set explicit HikariCP pool, timeout and max-lifetime values.
- ✅ Enable spring.jpa.open-in-view: false in production.
- ✅ Expose only required actuator endpoints; protect them with Spring Security.
- ✅ Configure structured JSON logging for log aggregation (ELK / Loki / Datadog).
- ✅ Set server.shutdown: graceful and a sane spring.lifecycle.timeout-per-shutdown-phase.
- ✅ Set server.tomcat.max-threads based on benchmarks, not defaults.
- ✅ Pin spring.jpa.hibernate.ddl-auto to
validateornone; neverupdatein prod. - ✅ Enable HTTP/2 and gzip compression where applicable.
- ✅ Add health, liveness and readiness probes for Kubernetes.