SecureAnyCloud
Deployment guide

Knowage

Overview

Knowage is a full open-source business intelligence and analytics suite. It gives an organization one place to model its data and let business users explore it. Capabilities include interactive dashboards (cockpits), pixel-perfect reports, self-service data exploration, charts and data federation across many data sources, all from a single self-hosted Java web application.

People work through the Knowage web interface, where they connect data sources, build datasets, compose cockpits and publish analytical documents to share across the organization. A comprehensive REST API lets other applications drive the same platform.

This image wires the whole stack together and generates a fresh administrator password, a fresh metadata database password and fresh encryption secrets on the VM you launch.

What you get:

  • Knowage Server 9.0.9 Community Edition (core, API, Vue frontend, cockpit, QBE and metadata engines)
  • Apache Tomcat 9.0.x with the OpenJDK 17 runtime
  • PostgreSQL 17 as the metadata database
  • nginx on port 443 with a per-VM self-signed TLS certificate as the only public surface (port 80 redirects to 443)
  • An Ubuntu 24.04 LTS base, fully patched at build time
  • 24/7 SecureAnyCloud support, 24h response SLA

Scope. This is the Community Edition, with no vendor support SLA from the upstream project and no Enterprise-only modules. Knowage is a build-your-own analytics workbench, so a freshly launched image is intentionally empty, waiting for the data sources, datasets and cockpits you create. The metadata database schema, the seeded administrator and the engines are all in place from first boot.

Prerequisites

  • An active Azure subscription
  • An SSH key pair
  • A VNet and subnet to deploy into
  • A network security group you can edit, to restrict who reaches ports 22 and 443

Recommended VM size: Standard_D2s_v3 (2 vCPU / 8 GB). Knowage is a JVM business intelligence server (Tomcat with a 2.5 GB heap) plus PostgreSQL, so 8 GB gives the stack real headroom. The 4 GB sizes are too small for the Tomcat warmup. Treat D2s_v3 as the minimum, and choose a larger size for bigger teams and data volumes.

1

Deploy from the Azure Portal

Search the Azure Marketplace for Knowage, choose the plan and deploy it into your VNet.

In the network security group, allow TCP 22 (SSH) and TCP 443 (the Knowage web interface) from your own networks only.

2

Deploy from the Azure CLI

RG="knowage-prod"; LOCATION="eastus"; VM_NAME="knowage-01" IMAGE_URN="sac1647283583153:knowage-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name kn-vnet --address-prefix 10.106.0.0/16 --subnet-name kn-subnet --subnet-prefix 10.106.1.0/24 az network nsg create -g "$RG" --name kn-nsg az network nsg rule create -g "$RG" --nsg-name kn-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name kn-nsg --name allow-https --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:knowage-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_D2s_v3 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name kn-vnet --subnet kn-subnet --nsg kn-nsg --public-ip-sku Standard
3

Connect via SSH

Connect to the VM as azureuser.

ssh azureuser@<vm-ip>

First boot rotates every secret this image uses, releases the systemd bootstrap gate, then starts Tomcat and nginx. On a Standard_D2s_v3, the web interface is ready a minute or two after the VM reports running.

4

Verify the Services

Run the commands below to confirm that each service is active and to check which ports are listening.

systemctl is-active postgresql knowage-tomcat nginx knowage-firstboot
sudo ss -tlnp | grep -E ':443 |:80 |:8080 |:5432 '

Only nginx is bound to a public address. Tomcat (8080) and PostgreSQL (5432) both listen on loopback. nginx terminates TLS on port 443, and port 80 redirects to it.

5

Retrieve the Administrator Password

List the credentials file and print its contents with the passwords masked.

sudo ls -l /root/knowage-credentials.txt
sudo sed -E 's/^(knowage\.admin\.pass=|knowage\.db\.pass=).*/\1********/' /root/knowage-credentials.txt | grep -vE '^#' | grep -v '^$'

The file is mode 0600 and readable only by root. It contains the site URL, the administrator login (biadmin) and a password unique to this VM. It also holds the metadata database name, user and its own per-VM password. The command above masks the password values, so read the file without the mask to sign in.

6

No Default Login Ships

Knowage seeds a set of well-known default accounts: biadmin, biuser, bidemo, bitest, bidev and public_user. On this image, first boot rotates the biadmin password to a per-VM value and deletes every other seeded default account before the web interface is reachable, so none of the shipped defaults work.

Run the commands below to verify this.

sudo -u postgres psql -d knowage -tAc "SELECT string_agg(user_id,', ' ORDER BY user_id) FROM sbi_user"
sudo -u postgres psql -d knowage -tAc "SELECT count(*) FROM sbi_user WHERE user_id IN ('biuser','bidemo','bitest','bidev','public_user')"
sudo /usr/local/sbin/knowage-roundtrip.sh

The output shows that only biadmin remains and that the count of shipped default accounts is 0. The round trip confirms that the per-VM biadmin password authenticates, while the upstream biadmin/biadmin default and a wrong password are both rejected.

7

Sign In to Knowage

Browse to https://<vm-ip>/ and accept the per-VM self-signed certificate. Sign in as biadmin with the password from /root/knowage-credentials.txt.

The home screen welcomes you to Knowage 9. The left toolbar gives access to administration, the document browser, your workspace and the downloads area.

8

My Workspace

My Workspace is your personal space for the building blocks of analysis. From here you reach your recent items, your repository of analytical documents, My Data (your datasets), My Models and My Analysis (the cockpits and self-service analyses you build).

To build your first analysis, create a data source and a dataset under My Data. Then compose a cockpit under My Analysis and add chart, table and cross-tab widgets bound to that dataset. Published documents are organized in the document browser.

9

The Document Browser

The Document Browser organizes every analytical document (cockpits, reports and dashboards) into folders and functionalities. It also controls who can see and run each one.

10

Server Components

Check the component versions with the commands below. The lists after them show where each component lives and which ports it uses.

java -version grep -m1 'Apache Tomcat Version' /opt/knowage-tomcat/RELEASE-NOTES
sudo -u postgres psql -tAc 'select version()' ls -1 /opt/knowage-tomcat/webapps

Paths:

  • Tomcat (CATALINA_HOME): /opt/knowage-tomcat
  • Knowage web applications: /opt/knowage-tomcat/webapps
  • Tomcat configuration: /opt/knowage-tomcat/conf/server.xml
  • Password encryption secret: /opt/knowage-tomcat/conf/passwordEncryptionSecret
  • PostgreSQL data directory: /var/lib/postgresql
  • nginx site: /etc/nginx/sites-available/sac-knowage
  • TLS certificate: /etc/nginx/tls/knowage.crt
  • Credentials: /root/knowage-credentials.txt (mode 0600)
  • First-boot sentinel: /var/lib/sac/data/knowage-firstboot.done

Ports:

  • 443, all interfaces: nginx TLS, the only public surface
  • 80, all interfaces: nginx, redirects to 443
  • 8080, 127.0.0.1: Apache Tomcat, the Knowage web applications
  • 5432, 127.0.0.1: PostgreSQL, the metadata database
11

Managing the Services

Start the services in dependency order and stop them in reverse. Tomcat does not serve the Knowage web applications until PostgreSQL is up.

sudo systemctl restart knowage-tomcat.service
sudo systemctl status knowage-tomcat.service --no-pager sudo tail -n 40 /opt/knowage-tomcat/logs/catalina.out

Knowage takes roughly one to three minutes to warm up after a restart. Judge readiness by the web interface answering on port 443, not by the contents of the log right after the restart.

12

Security Recommendations

  • Change the administrator password in Knowage after your first sign-in, and store the new value in your own secret manager.
  • Restrict the network security group so that ports 22 and 443 accept traffic only from networks you control.
  • Install a CA-signed certificate. The image ships a per-VM self-signed certificate, so it makes no assumptions about your certificate authority. Replace /etc/nginx/tls/knowage.crt and /etc/nginx/tls/knowage.key with a certificate for your own domain, or put an Application Gateway in front of nginx.
  • Create named user accounts in Knowage instead of sharing the administrator login, and grant roles and permissions per user.
  • Back up both halves together. The PostgreSQL metadata database and the Tomcat tree at /opt/knowage-tomcat are a matched pair.
  • Keep the OS patched with sudo apt-get update && sudo apt-get upgrade, and reboot for kernel updates.
13

Support and Licensing

Knowage Community Edition is published under the GNU Affero General Public License v3 (AGPL-3.0). SecureAnyCloud provides commercial support for the image itself, separately from the upstream project.

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch Knowage on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7. sales@secureanycloud.com

Deploy on Azure

Launch Knowage 9.0.9 Community Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure