Egeria 5.3
Overview
Egeria is an open source project from the Linux Foundation AI & Data foundation for open metadata and governance. It provides open standards and runtime services for sharing metadata about data assets across the tools, catalogues and platforms an organisation runs. Its OMAG Server Platform hosts one or more logical metadata servers, each exposing REST APIs for cataloguing assets, tracking lineage, classifying data and coordinating governance.
This SecureAnyCloud image runs the official Egeria OMAG Server Platform 5.3 (org.odpi.egeria:platform-chassis-spring, Apache-2.0) on OpenJDK 17 as a single Java process, verified against a sha256 checksum at build time. A working in-memory Metadata Access Store server named active-metadata-store is configured and activated automatically. The appliance serves live open metadata as soon as it boots, including the full Open Metadata type system and the Open Metadata Repository Services (OMRS) REST API.
Egeria's platform authentication is intentionally minimal, so an nginx reverse proxy fronts the API and enforces per-VM HTTP Basic authentication. Nothing is exposed without a credential that is unique to your machine.
What you get:
- Egeria OMAG Server Platform 5.3 (
platform-chassis-spring, Apache-2.0), sha256-pinned, plus the sha256-pinned connector library it loads (file configuration store, in-memory repository, audit log) - Headless OpenJDK 17 JRE, the Java baseline the upstream project targets
- The
egeria-platform.servicesystemd unit, which starts the OMAG Server Platform on boot as the unprivilegedegeria:egeriasystem user - The
egeria-activate.servicesystemd unit, which activates the configuredactive-metadata-storeserver on every boot, idempotently and fault-tolerantly - The
egeria-firstboot.servicesystemd oneshot, which generates a per-VM HTTP credential and a per-VM TLS certificate before the service is exposed - The OMAG Server Platform REST API bound to loopback only (
127.0.0.1:9443), with nginx fronting it on:443using HTTP Basic authentication - The interactive Swagger UI at
/swagger-ui/index.html, rendering the running platform's REST API - An unauthenticated, nginx-native
/healthzendpoint (HTTP 200) wired to the platform origin for load balancer and probe checks - Server configuration documents and platform logs on a dedicated 20 GiB Azure data disk mounted at
/var/lib/egeria, so server definitions survive independently of the OS disk - Ubuntu 24.04 LTS base with the latest security patches applied at build time and unattended security updates enabled
- Azure Linux Agent for cloud integration and SSH key injection
- 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA
Architecture
The OMAG Server Platform listens on 127.0.0.1:9443 only and is never exposed directly to the network. nginx terminates :443 with a per-VM self-signed certificate and reverse-proxies to the loopback platform. The Azure Network Security Group opens only ports 22, 80 and 443, and port 80 redirects to 443.
This keeps the metadata API and Swagger UI behind a single, authenticated nginx front door.
Deploy the image
Launch the Egeria 5.3 on Ubuntu 24.04 LTS by SecureAnyCloud image from the Azure Marketplace on a Standard_B2s (or larger) VM. Open inbound ports 22 (SSH), 80 (HTTP) and 443 (HTTPS) in the Network Security Group. The 20 GiB data disk that carries the server configuration is provisioned automatically from the image.
When the VM is running, connect over SSH as azureuser with the SSH key you selected at launch:
ssh azureuser@<public-ip>Confirm the services are running
The platform, the server activator and nginx start automatically on boot. Confirm that all three are active:
systemctl is-active egeria-platform.service egeria-activate.service nginx.serviceThe command should print active for each unit. For the full status view, run:
systemctl --no-pager status egeria-platform.service egeria-activate.service nginx.serviceRetrieve the per-VM credential
The image contains no default password. On first boot the appliance generates a unique HTTP Basic credential (user admin) and writes it, with the service URLs, to a root-only file. Read the file with sudo:
sudo cat /var/lib/sac/secrets/sac-credentials.txtThe file lists EGERIA_URL, EGERIA_SWAGGER_URL, the configured EGERIA_SERVER, the API user id, and the admin credential for the Swagger UI and REST API.
Open the Swagger UI
In your browser, open the Swagger UI at https://<public-ip>/swagger-ui/index.html. The appliance uses a per-VM self-signed certificate, so accept the browser's certificate prompt. Then sign in with user admin and the password from Step 3.
The Swagger UI renders the full REST API of the running platform, Egeria's Open Metadata and Governance (OMAG) Server Platform version 5.3.
Explore the metadata REST API
Scroll the Swagger UI to browse the platform, administration, repository and access-service operations. Expand any group, then select Try it out to call an operation live against the running server.
Verify the configured metadata server
From the VM, confirm that the platform is serving and the active-metadata-store server is active. The commands use -k because the loopback listener presents the appliance's self-signed certificate, and they read the per-VM credential straight from the credentials file.
First, check the health endpoint:
curl -ks https://127.0.0.1/healthzThis prints the platform origin string, which confirms that Egeria is up. Next, list the active servers through the authenticated front door:
PASS=$(sudo grep '^EGERIA_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -ks -u "admin:${PASS}" \
https://127.0.0.1/open-metadata/platform-services/users/garygeeke/server-platform/servers/activeThe response lists active-metadata-store in its serverList. This confirms that the configured metadata server is running the Open Metadata Repository Services (OMRS).
The same response, viewed through the browser's authenticated session:
Query the open metadata type system
The running server loads Egeria's full Open Metadata type system into its in-memory repository. Retrieve the type count to confirm that live metadata is being served:
PASS=$(sudo grep '^EGERIA_PASSWORD=' /var/lib/sac/secrets/sac-credentials.txt | cut -d= -f2-)
curl -ks -u "admin:${PASS}" \
https://127.0.0.1/servers/active-metadata-store/open-metadata/repository-services/users/garygeeke/types/all \
| python3 -c 'import sys,json; print("open metadata typeDefs loaded:", len(json.load(sys.stdin).get("typeDefs", [])))'You can explore and call every metadata, administration and repository operation from the Swagger UI.
Where the data lives
The platform's working directory, its server configuration documents and its logs live on the dedicated 20 GiB Azure data disk mounted at /var/lib/egeria. Confirm the mount and list the configuration:
findmnt /var/lib/egeria ls /var/lib/egeria/data/servers/active-metadata-store/config/The configuration document for active-metadata-store lets the platform re-activate the server automatically on every reboot. The in-memory repository content is deliberately non-persistent. It is rebuilt from the loaded type system each time the server starts.
Managing the service
Restart the platform. The configured server is re-activated automatically:
sudo systemctl restart egeria-platform.serviceStop or start the platform:
sudo systemctl stop egeria-platform.service
sudo systemctl start egeria-platform.serviceView the platform logs:
journalctl -u egeria-platform.service --no-pager | tail -50Security notes
- No default credential. The image ships with no HTTP password and no TLS private key. On first boot the appliance generates a per-VM
admincredential and a per-VM self-signed TLS certificate, and only then exposes nginx on:443. - Loopback only. The OMAG Server Platform binds
127.0.0.1:9443. The only network-reachable entry point is nginx, which enforces HTTP Basic authentication on every path except the unauthenticated/healthzprobe. - Least privilege. The platform runs as the unprivileged
egeriasystem user withNoNewPrivileges,ProtectSystemandPrivateTmphardening. - Rotate the credential. Replace the
admincredential at any time withsudo htpasswd -B /etc/nginx/.htpasswd admin, then runsudo systemctl reload nginx. - Use a trusted certificate. For production, replace the per-VM self-signed certificate at
/etc/nginx/ssl/egeria.crtand/etc/nginx/ssl/egeria.keywith a CA-issued certificate, then reload nginx.
Troubleshooting
- Swagger UI or API returns 401. The HTTP Basic credential is missing. Use user
adminand the password from/var/lib/sac/secrets/sac-credentials.txt. active-metadata-storeis not listed as active. Checksystemctl status egeria-activate.serviceandjournalctl -u egeria-activate.service. The activator waits for the platform and then starts the server.- Certificate warning in the browser. This is expected, because the appliance uses a per-VM self-signed certificate. Replace it with a CA-issued certificate for production (see Security notes).
- Platform slow to answer right after boot. The Spring Boot platform takes a few seconds to initialise.
curl -ks https://127.0.0.1/healthzreturns the origin string once it is ready.
Support
Every SecureAnyCloud image comes with 24/7 support and a guaranteed 24-hour response SLA. For help with this image, contact SecureAnyCloud support through the Azure Marketplace listing.
Deploy on Azure
Launch Egeria 5.3 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.
View this image
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com