Cluster and failure-domain design
Node roles, quorum, resource reserves and maintainability for a single site, HA or multiple locations.
Storage & data
ZFS, Ceph, CSI, storage classes and databases with clear performance and recovery strategies.
Proxmox CephManaged ProxmoxNetwork & load balancing
VLANs, bridges, CNI, MetalLB or external load balancers, DNS, TLS and segmentation.
Automated provisioning
Talos, k3s or RKE2 on Proxmox VMs; provisioning with Terraform/OpenTofu, Ansible and cloud-init plus declarative cluster configuration.
Backup & disaster recovery
PBS, etcd, persistent volumes and application-consistent backups with documented restore paths.
Unified observability
Hardware, hypervisor, nodes, Kubernetes and workloads in a coordinated monitoring and alerting model.
Kubernetes on Proxmox: private cloud architecture and operations
Proxmox provides compute, virtualization, storage and infrastructure HA. Kubernetes standardizes deployments and the lifecycle of modern applications. WZ-IT designs and operates both layers as one system.
Sovereign platform
Kubernetes nodes as Proxmox VMs, VMs and containers side by side
Proxmox provides compute, storage and networking for virtual machines, LXC and dedicated Kubernetes nodes. This becomes an application platform for containerized, horizontally scalable or consistently delivered workloads.
Proxmox foundation
Clusters, nodes, ZFS or Ceph, network segments, Proxmox Backup Server and infrastructure monitoring.
Kubernetes layer
Control plane, worker pools, CNI, ingress, storage classes, registry and platform services.
Mixed workloads
Legacy VMs, databases, appliances and containerized applications can coexist in their appropriate operating models.
Separate recovery layers
Proxmox protects the VM layer. Kubernetes resources, persistent data and applications receive complementary backup and recovery procedures with tested restores.
Scope
What a production Proxmox Kubernetes platform includes
The concrete stack follows the target design. What matters is the clean separation and integration of infrastructure, cluster and application.
In addition to the cluster, applications need defined processes for delivery, access, observability, recovery and technical ownership.
Delivery
GitOps, CI/CD, separate environments, approvals and reproducible rollbacks.
Network
CNI, network policies, ingress or gateway, DNS, TLS and private access.
Security
OIDC, RBAC, secrets, image validation, policies and traceable changes.
Observability
Metrics, logs, traces, alerting and SLOs for platform and applications.
Backup & restore
Cluster state, persistent data, restore tests and a documented recovery path.
Lifecycle
Updates, CVE assessment, capacity, costs and an agreed operating model.
Architecture path
From hardware and network to the application platform
The layers are designed separately but validated together. This keeps failure domains, capacities and responsibilities understandable.
Sizing
Size workloads, availability, growth and failure domains.Proxmox design
Define compute, storage, network, HA, quorum and backup architecture.Cluster build
Provision Kubernetes nodes automatically and install the platform baseline.Workload onboarding
Bring applications, data and access paths onto the platform with control.Lifecycle
Coordinate, monitor and document upgrades across both layers.Starting pointOngoing operations
Two layers, one operation
Operate Proxmox and Kubernetes together
Proxmox and Kubernetes have different lifecycles. We coordinate maintenance, capacity, backup and incident response across both levels without mixing their responsibilities.
Availability is designed through failure domains, quorum, storage, networking and recovery objectives · Control plane, workers and stateful services are placed deliberately · VM and container workloads can be modernized incrementally
Frequently asked questions
Clear answers on architecture, delivery, responsibilities and ongoing operations.
- Yes, when compute, storage, network, failure domains and lifecycle are sized appropriately. Proxmox provides the virtualization and infrastructure layer; Kubernetes runs on top as its own platform with explicit resource and availability requirements.
- Both can make sense. VMs offer flexible provisioning, isolation and easier hardware maintenance. Bare metal can fit specialized performance, GPU or network requirements. We decide based on workloads and operating goals.
- Not necessarily. Ceph is useful with suitable node counts, networks and HA requirements. For smaller platforms, ZFS, replicated storage or external storage systems can be the simpler and better solution.
- No. PBS protects the infrastructure and VM layer. Kubernetes state, persistent data and application-consistent backups are also required. Recovery has to be designed and tested across all layers (Kubernetes backup and restore).
- Yes. We review resources, networking, storage, quorum, backup and operating condition and design the Kubernetes layer on that basis. If the foundation is insufficient, it is stabilized before the cluster is built.
- VMs separate the kernels and lifecycles of Proxmox and Kubernetes. LXC shares the host kernel and introduces additional dependencies and permissions. VMs are the starting point for our platform planning. Details: Kubernetes on Proxmox.
- All three are part of our service. Talos uses an API-managed operating system; deployment is covered by the Talos documentation for Proxmox. k3s uses a compact stack, and RKE2 a hardened Kubernetes stack on conventional Linux. Requirements and the operating model guide the choice: distribution comparison; running Talos on Proxmox is described in Talos Linux on Proxmox, the basic question in Do we need Kubernetes?.
Knowledge base
In-depth guides for this building block
Knowledge base
One platform. Six entry points.
Select infrastructure and operating model deliberately
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
- Secure your Proxmox & backup setup
- Virtualize with Managed Proxmox
- Build a high-availability Proxmox cluster
- Modernize your infrastructure - sovereign
- Plan a sovereign open-source stack
- Integrate a local AI solution
- Modernize your legacy software
- Cut cloud cost - up to −81%
- Design an open-source AI architecture
- Get collaboration fully managed
- Ship your prototype to production
- Connect sites and clusters securely
Enquiry
What should your Proxmox Kubernetes platform look like?
Whether you have an existing Proxmox cluster or need a new private-cloud foundation, we assess architecture, capacity and operating model.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.