Prepare Appliance Nodes on Proxmox

Create the Appliance targets using the boot artifact and network values displayed by Management. These steps begin at Prepare and boot the signed Talos media in Install the Appliance. For Management, choose the ISO VM or Docker Compose.

Use the boot media and checksums for the selected release.

Before you begin

Use a Proxmox account with permission to upload ISO images and create and configure the required VMs. Have the selected signed noCloud ISO, its verified checksum and the node plan available. Allocate the resources for each Appliance node.

Create each VM

  1. Upload the verified noCloud ISO under Storage > ISO Images > Upload.

  2. Select Create VM for each planned node. Set its name and select the uploaded ISO. Do not start it yet.

  3. On System, select q35 for Machine and OVMF (UEFI) for BIOS. Add an EFI Disk on persistent storage.

    Leave Pre-Enroll keys disabled. This allows the signed ISO to enroll its Secure Boot keys on first boot.

  4. Set Cores and Memory (MiB) using the recommended appliance node allocations.

  5. Under Hardware > Processors > Edit, set Type to x86-64-v2-AES or host. The physical host must support AES instructions and the guest CPU must expose the aes flag.

  6. Under Hardware > Add > TPM, select TPM State v2.0 and store its state on persistent storage.

  7. Add the OS disk. Under Hardware > Add > Hard Disk, add the separate Database and Data disks. Use the recommended capacity for each role from the same hardware requirements table.

  8. Connect net0 to the bridge for the shared node subnet and keep the adapter connected.

  9. If you selected the QEMU guest-agent service in Management, enable Options > QEMU Guest Agent > Use QEMU Guest Agent.

    If you enable the service only in Management, the VM cannot establish the required QEMU guest-agent connection. It restarts every hour.

Keep the EFI and TPM state disks separate from the three installation disk roles. Retain both with the VM’s installed disks when backing up, restoring or moving the VM. Do not clone an already installed Appliance to create new targets.

Configure Networking and Boot

  1. Under Hardware, confirm that the downloaded noCloud ISO is attached as a CD/DVD drive. Attach it if needed.

  2. Select Add > CloudInit Drive and choose its storage.

  3. Open Cloud-Init. Set DNS servers and the IP Config for net0 using that node’s values on the Management page: static IPv4 address and prefix, gateway and DNS servers.

  4. Select Regenerate Image.

  5. Under Options > Boot Order, put the intended OS disk first and the noCloud CD/DVD drive after it. Start the VM.

  6. On a fresh VM, OVMF starts in setup mode. The signed ISO automatically enrolls its embedded keys and enables Secure Boot. Confirm SECUREBOOT: True in the Talos dashboard before discovery.

  7. Repeat for every node, using each node’s own address and identity.

On the first boot, the OS disk is empty, so the VM continues to the ISO. After installation, the installed OS disk remains first. This boot order differs from the Management ISO VM, which always boots its Management ISO.

Verify and Continue

Confirm that all targets boot into maintenance mode with Secure Boot enabled and show their intended network addresses. Return to Management and select Start target discovery. Compare the observed VM identities before confirming targets or disks.

If discovery does not find a target, inspect the VM console, Cloud-Init values, generated image, network bridge and boot order. If Management rejects resources or boot mode, correct the VM configuration before retrying discovery. Continue with Confirm targets and install.

For background on first-boot enrollment, see the Talos Secure Boot documentation.