First Deployment

Follow this sequence to deploy Management, install Virtual Appliance and initialize ERS. Work from a browser with access to Management and a hypervisor account that can create and configure the required virtual machines.

Eight deployment steps across the hypervisor, Management console and Management browser, ending with verified installation and retained artifacts.
The ISO path moves between the hypervisor, console and browser. For containers, replace its first two steps with the container quick start.

Before you begin

Check the hardware requirements, reserve IP addresses and DNS names and configure the firewall rules. Use the installation introduction to choose the Management deployment and connected or air-gapped preparation path. Installation erases the explicitly selected disks.

Deploy and initialize Management

  1. Choose one Management deployment path:

    • Docker Compose: download the image, prepare the host and persistent volume, configure TLS and start the container.

    • Management ISO VM: create the VM with the ISO and state disk, restrict SSH to approved maintenance sources before first boot, then initialize its host from the console or use unattended ISO installation. SSH defaults to disabled, with no factory host password.

  2. Open the configured Management HTTPS URL. Verify its certificate and sign in as mtg-admin with the password entered during setup.

  3. For the ISO VM, leave SSH disabled unless remote maintenance is required. If needed, configure persistent SSH access after initialization or through explicit unattended settings. Verify the intended policy after reboot before production use.

  4. Under Settings > Bundles, make the intended release bundle Available locally. Follow Bundles and registries for retrieval or browser upload.

Management is ready when its web application is reachable, sign-in succeeds and the intended release is available locally. For ISO deployments, also verify the SSH policy above before production use.

Install the Appliance

  1. Start the installation wizard. Select the release, topology and platform, then enter the network and node settings.

  2. Submit the settings. On Prepare and boot the signed Talos media, download the matching boot artifact and checksum.

  3. Create the appliance targets using the Proxmox or VMware guide. Use the per-node network values supplied by Management.

  4. Return to Management to discover and confirm the targets, assign the three disk roles on each node and approve the destructive installation.

  5. Wait for Verified success for the selected appliance release. Download the artifact bundle and wait for Checksum verified.

  6. Copy that bundle to an access-controlled location outside Management before closing the installation.

Initialize ERS and accept the Deployment

  1. Follow Initialize ERS to configure the application and PKI for the installed appliance.

  2. Complete Post-installation checks, including application access and health.

  3. Set up backups and external retention. Keep the installation artifact bundle and release material with the deployment’s recovery records.

For later sessions, use Reconnect an Appliance. If a step fails, keep the reported stage and available diagnostics and consult Troubleshooting.