Talos on Proxmox

The last three pages explained the pieces separately. This one builds them into a single cluster: a 3-host Proxmox cluster running 3 Talos control planes and 3 workers, Cilium as the CNI, the Proxmox CCM supplying topology, and the Proxmox CSI plugin turning PVCs into hypervisor disks. Work through the checklist and watch the architecture fill in. Each step comes with the snippet you would actually run.

The reference build

0/8 checked

Image Factory

schematic: qemu-guest-agent

Terraform

bpg/proxmox + siderolabs/talos

talosctl

patches · VIP 10.0.0.10

VIP 10.0.0.10:6443 ○

Proxmox cluster cluster-1 (region)

pve1zone

101 cp-1

111 worker-1

local-lvm

pve2zone

102 cp-2

112 worker-2

local-lvm

pve3zone

103 cp-3

113 worker-3

local-lvm

step 1

Build an Image Factory schematic

factory.talos.dev

Appears: a schematic ID that names your exact image: Talos version + system extensions.

Talos has no package manager, so anything extra is baked into the image as a system extension. On Proxmox you want siderolabs/qemu-guest-agent, which lets Proxmox see IPs and shut VMs down cleanly. Add siderolabs/iscsi-tools and siderolabs/util-linux-tools only if you plan to run Longhorn. Proxmox CSI needs neither, because its disks arrive as plain SCSI devices. The same ID gives you both the boot ISO and the installer image used for installs and upgrades.

schematic.yaml → schematic ID

cat > schematic.yaml <<'EOF'
customization:
  systemExtensions:
    officialExtensions:
      - siderolabs/qemu-guest-agent
      # - siderolabs/iscsi-tools        # only for Longhorn
      # - siderolabs/util-linux-tools   # only for Longhorn
EOF
curl -X POST --data-binary @schematic.yaml https://factory.talos.dev/schematics
# {"id":"ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515"}   (qemu-guest-agent only)

# boot ISO      https://factory.talos.dev/image/<id>/<version>/metal-amd64.iso
# installer     factory.talos.dev/installer/<id>:<version>

dependencies

The order matters

Each step unblocks the next. Nodes are NotReady until a CNI runs. Ordinary pods stay off the nodes until the CCM removes the uninitialized taint, which is why the CCM chart and Cilium tolerate it. CSI can't place local volumes until nodes have zone labels.

	Blocked until…	Symptom if skipped
Cilium	bootstrap (API reachable via KubePrism)	Nodes NotReady, CoreDNS Pending
Proxmox CCM	CNI up (or run it with useDaemonSet=true on hostNetwork)	Pods Pending: untolerated taint node.cloudprovider.kubernetes.io/uninitialized
Proxmox CSI	zone/region labels from the CCM	CreateVolume fails: zone must be provided (local storage)
PVC	StorageClass + node plugin registered (CSINode)	PVC Pending forever under WaitForFirstConsumer

anti-affinity

Don't put all your etcd in one basket

Three control planes only buy fault tolerance if they fail independently. Pick a placement, then power off Proxmox hosts.

Spread your control planes across Proxmox hosts

pve1

cp-1etcd

cp-2etcd

cp-3etcd

pve2

pve3

Move a control plane:cp-1cp-2cp-3

etcd members up

3/3

quorum (need 2)

yes

kube-apiserver

serving

worst 1-host loss

0/3 left

Healthy

Power off a host to see what this placement survives.

The same arithmetic applies to Proxmox itself: corosync needs a majority of hosts, so a 3-host Proxmox cluster survives one host failure. In Terraform, pin each control plane with node_name. If you use Proxmox HA, configure its placement (HA groups, or affinity rules in newer releases) so a failover doesn't stack two control planes on one host.

Variations you'll meet

The nocloud image lets Proxmox's cloud-init drive hand Talos its IP and hostname, instead of DHCP plus per-node patches.
Talos can carry the CCM, CSI and Cilium itself through cluster.inlineManifests / cluster.externalCloudProvider.manifests so a fresh cluster comes up complete without a post-bootstrap Helm step.
For Ceph-backed Proxmox, point a second StorageClass at the RBD pool. Its volumes only pin the region, so pods can fail over across hosts.

why it mattersEvery layer comes from a declaration: an Image Factory schematic, Terraform VMs and Talos patches. You can rebuild the cluster from Git instead of from memory.
why it mattersPin VMs to Proxmox hosts on purpose: one control plane per host for etcd quorum, and stable zones for the CCM labels and local CSI disks.
why it mattersCCM before CSI. Topology labels are the contract between Kubernetes and Proxmox, and storage placement depends on them.