Knowage on Ubuntu 24.04 on Azure User Guide

Overview

Knowage is a full open source business intelligence and analytics suite. It gives an organisation one place to model its data and let business users explore it: interactive dashboards (cockpits), pixel perfect reports, self service data exploration, charts and data federation across many data sources, all from a single self hosted Java web application.

People work through the Knowage web interface, where they connect data sources, build datasets, compose cockpits and publish analytical documents to share across the organisation. A comprehensive REST API lets other applications drive the same platform.

This image wires the whole stack together and generates a fresh administrator password, a fresh metadata database password and fresh encryption secrets on the VM you launch.

What is included:

• Knowage Server 9.0.9 Community Edition (core, API, Vue frontend, cockpit, QBE and metadata engines)
• Apache Tomcat 9.0.x with the OpenJDK 17 runtime
• PostgreSQL 17 as the metadata database
• nginx on port 443 with a per VM self signed TLS certificate as the only public surface (port 80 redirects to 443)
• Ubuntu 24.04 LTS base, fully patched at build time
• 24/7 cloudimg support, 24h response SLA

Scope, stated plainly. This is the Community Edition: no vendor support SLA from the upstream project and no Enterprise only modules. Knowage is a build your own analytics workbench, so a freshly launched image is intentionally empty and waiting for the data sources, datasets and cockpits you create. The metadata database schema, the seeded administrator and the engines are all in place from first boot.

Prerequisites

1. An active Azure subscription.
2. An SSH key pair.
3. A VNet and subnet to deploy into.
4. A network security group you can edit, to restrict who reaches ports 22 and 443.

Recommended VM size: Standard_D2s_v3 (2 vCPU / 8 GB). Knowage is a JVM business intelligence server (Tomcat with a 2.5 GB heap) plus PostgreSQL, so 8 GB is where the stack has real headroom rather than merely starting. The 4 GB sizes are too small for the Tomcat warmup. Treat D2s_v3 as the floor and size up for larger teams and data volumes.

Step 1: Deploy from the Azure Portal

Search the Marketplace for Knowage, choose the plan and deploy it into your VNet. In the network security group, allow TCP 22 (SSH) and TCP 443 (the Knowage web interface) from your own networks only.

Step 2: Deploy from the Azure CLI

RG="knowage-prod"; LOCATION="eastus"; VM_NAME="knowage-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/knowage-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name kn-vnet --address-prefix 10.106.0.0/16 --subnet-name kn-subnet --subnet-prefix 10.106.1.0/24
az network nsg create -g "$RG" --name kn-nsg
az network nsg rule create -g "$RG" --nsg-name kn-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name kn-nsg --name allow-https --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_D2s_v3 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name kn-vnet --subnet kn-subnet --nsg kn-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

The first boot rotates every secret this image uses, releases the systemd bootstrap gate, and then starts Tomcat and nginx. On a Standard_D2s_v3 the web interface is ready a minute or two after the VM reports running.

Step 4: Verify the Services

systemctl is-active postgresql knowage-tomcat nginx knowage-firstboot
sudo ss -tlnp | grep -E ':443 |:80 |:8080 |:5432 '

Only nginx is bound to a public address. Tomcat (8080) and PostgreSQL (5432) both listen on loopback, and nginx terminates TLS on port 443 with port 80 redirecting to it.

Step 5: Retrieve the Administrator Password

sudo ls -l /root/knowage-credentials.txt
sudo sed -E 's/^(knowage\.admin\.pass=|knowage\.db\.pass=).*/\1********/' /root/knowage-credentials.txt | grep -vE '^#' | grep -v '^$'

The file is mode 0600 and readable only by root. It contains the site URL, the administrator login (biadmin) and a password unique to this VM, together with the metadata database name, user and its own per VM password. The password values are shown masked above; read the file without the mask to sign in.

Step 6: No Default Login Ships

Knowage seeds a set of well known default accounts (biadmin, biuser, bidemo, bitest, bidev, public_user). On this image the first boot rotates the biadmin password to a per VM value and deletes every other seeded default account before the web interface is ever reachable, so none of the shipped defaults work.

sudo -u postgres psql -d knowage -tAc "SELECT string_agg(user_id,', ' ORDER BY user_id) FROM sbi_user"
sudo -u postgres psql -d knowage -tAc "SELECT count(*) FROM sbi_user WHERE user_id IN ('biuser','bidemo','bitest','bidev','public_user')"
sudo /usr/local/sbin/knowage-roundtrip.sh

Only biadmin remains, the count of shipped default accounts is 0, and the round trip confirms the per VM biadmin password authenticates while the upstream biadmin/biadmin default and a wrong password are both rejected.

Step 7: Sign In to Knowage

Browse to https://<vm-ip>/ and accept the per VM self signed certificate. Sign in as biadmin with the password from /root/knowage-credentials.txt.

The home screen welcomes you to Knowage 9 and the left toolbar gives access to administration, the document browser, your workspace and the downloads area:

Step 8: My Workspace

My Workspace is your personal space for the building blocks of analysis. From here you reach your recent items, your repository of analytical documents, My Data (your datasets), My Models and My Analysis (the cockpits and self service analyses you build):

To build your first analysis: create a data source and a dataset under My Data, then compose a cockpit under My Analysis and add chart, table and cross tab widgets bound to that dataset. Published documents are organised in the document browser below.

Step 9: The Document Browser

The Document Browser organises every analytical document (cockpits, reports and dashboards) into folders and functionalities, and controls who can see and run each one:

Step 10: Server Components

java -version
grep -m1 'Apache Tomcat Version' /opt/knowage-tomcat/RELEASE-NOTES
sudo -u postgres psql -tAc 'select version()'
ls -1 /opt/knowage-tomcat/webapps

Step 11: Managing the Services

Start them in dependency order and stop them in reverse. Tomcat will not serve the Knowage web applications until PostgreSQL is up.

sudo systemctl restart knowage-tomcat.service
sudo systemctl status knowage-tomcat.service --no-pager
sudo tail -n 40 /opt/knowage-tomcat/logs/catalina.out

Knowage takes roughly one to three minutes to warm up after a restart. Judge readiness by the web interface answering on port 443, not by the immediate contents of the log.

Step 12: Security Recommendations

• Change the administrator password from within Knowage after your first sign in, and store the new value in your own secret manager.
• Restrict the network security group so that ports 22 and 443 only accept traffic from networks you control.
• Install a CA signed certificate. The image ships a per VM self signed certificate so it makes no assumptions about your certificate authority. Replace /etc/nginx/tls/knowage.crt and /etc/nginx/tls/knowage.key with a certificate for your own domain, or put an Application Gateway in front of nginx.
• Create named user accounts in Knowage rather than sharing the administrator login, and grant roles and permissions per user.
• Back up both halves together. The PostgreSQL metadata database and the Tomcat tree at /opt/knowage-tomcat are a matched pair.
• Keep the OS patched with sudo apt-get update && sudo apt-get upgrade, and reboot for kernel updates.

Step 13: Support and Licensing

Knowage Community Edition is published under the GNU Affero General Public License v3 (AGPL-3.0). cloudimg provides commercial support for the image itself, separately from the upstream project.

• Email: support@cloudimg.co.uk
• Website: www.cloudimg.co.uk
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch Knowage on Ubuntu 24.04 with 24/7 support from cloudimg.

View on Marketplace

Need Help?

Our support team is available 24/7. support@cloudimg.co.uk