Prepare Appliance Nodes on VMware

Deploy the Appliance targets using the signed Metal OVA and per-node network values supplied by Management. These steps begin at Prepare and boot the signed Talos media in Install the Appliance. See Tested hypervisors for the tested vSphere version. Management can use the ISO VM or Docker on your own host.

Prerequisites

Use vCenter with a configured default key provider and complete its backup before importing the OVA. A configured vSphere Native Key Provider can supply the keys; an external KMS is not required. Use an account with permission to deploy OVF templates, provision virtual TPMs and change VM settings.

Download the release’s signed Metal OVA and verify its checksum. Keep the Management handoff page open for each node’s network values.

Deploy each Target

  1. In the vSphere web interface, right-click the target inventory location and select Deploy OVF Template. Upload the signed Metal OVA and select thin provisioning to limit initial datastore use. Allow capacity for the disks to grow as the Appliance writes data.

  2. Deploy it once for each planned node and map its network adapter to the shared node subnet. Do not power it on yet.

  3. Open Edit Settings > Virtual Hardware and set CPU and memory to the recommended appliance node allocations. For Memory, select GB.

  4. Under VM Options > Boot Options, verify EFI firmware and enabled Secure Boot. Preserve the OVA’s imported trust.nvram. It contains the firmware trust required to boot the signed image. No separate certificate upload or uefi.secureBoot.dbDefault.file0 setting is required for this OVA.

  5. Under Virtual Hardware > Security Devices, verify that vCenter provisioned a fresh Trusted Platform Module for this VM. If it is missing, keep the VM powered off and use Add New Device > Trusted Platform Module. Save and reopen the settings to verify it before the first boot.

  6. Under VM Options > Advanced > Configuration Parameters, verify both vtpm.crb=TRUE and vtpm.crb.hw=TRUE.

  7. Have the vSphere administrator verify that the guest CPU exposes AES-NI. If EVC is enabled, use a supported mode with AES, such as Intel Westmere or later, or AMD Opteron Generation 4 or later. Check per-VM EVC too. After changing EVC, fully power off the VM and power it on again.

  8. Verify the three SCSI disks:

    SCSI unit Template name Role

    0

    system

    Populated OS installation target with the signed Talos boot image and offline installer cache

    1

    database

    Empty Database disk

    2

    object-data

    Empty Data disk

    Use these three disks when assigning roles in Management. The template ships with the recommended disk capacities. You can adjust them to suit your needs using the Appliance node sizing guidance. Select GB in the vSphere capacity fields. Keep the populated system disk first in the EFI boot order.

  9. Confirm that the first network adapter connects to the intended network and has Connect At Power On enabled.

Each target needs its own fresh TPM identity. Do not clone an installed Appliance to create a new target. Preserve EFI and TPM state with an installed VM’s disks when backing up, restoring or moving it. Replacing either state can make encrypted disks inaccessible.

Set the per-node Network Configuration

  1. Power on the VM from its system disk. No ISO is needed.

  2. Confirm SECUREBOOT: True in the Talos dashboard, then press F3 to open network configuration.

  3. Select the connected interface and enter this node’s hostname, static IPv4 address with prefix, gateway, DNS servers and timeservers from Management. Save the settings.

  4. Repeat for every planned node, using each node’s own network values.

The signed Metal image uses Talos console networking. Do not add GuestInfo network settings. Management installs VMware Tools during installation when selected by the release.

Verify and Continue

Confirm that each target boots into maintenance mode with Secure Boot enabled and the expected address. Return to Management and select Start target discovery. Compare the observed machine identities and wait for each target to be accepted.

For a missing target, check the F3 network settings, virtual network and connected adapter. For a boot or security failure, keep the VM powered off while checking imported NVRAM, Secure Boot, vTPM and both CRB settings. Do not reset EFI or TPM state on an installed encrypted machine. Continue with Confirm targets and install.