WZ-IT designs, implements and operates Kubernetes on Proxmox, including Talos. Distribution, networking and storage are assessed together.
Talos Linux is a Linux operating system for Kubernetes nodes. It is managed declaratively through an API. The regular management workflow uses neither an SSH session nor a package manager. This distinguishes Talos from a general-purpose Linux distribution (system concept).
As of October 2026, referencing Talos documentation v1.14. This article explains the operating model. Installation on Proxmox and automation with OpenTofu have separate guides.
Contents
- API instead of a server shell
- Open source and additional products
- Talos, Kubernetes and Proxmox
- Day-to-day with talosctl
- What operations still require
- When Talos fits
- Sources
API instead of a server shell
talosctl applies machine configurations and retrieves diagnostic data. The Talos API authenticates regular management access using mutual TLS. Credentials and reachable management networks therefore belong in the security design (talosctl).
Immutable does not mean a freely writable base system for manual package installation. Required host extensions belong in a suitable image from the Image Factory. Configuration changes, maintenance and updates remain necessary. Applications are deployed through Kubernetes rather than installed on the host.
Open source and additional products
Talos source code is licensed under MPL-2.0. Licence conditions for modifications and distribution are separate from operating responsibilities and additional vendor products.
Omni is an additional management layer. The documented Proxmox deployment can use the Image Factory and talosctl workflow in the vendor guide. An open-source operating system means neither free support nor maintenance-free operations.
Talos, Kubernetes and Proxmox
| Layer | Responsibility | Does not imply |
|---|---|---|
| Proxmox VE | Provision virtual machines and their resources | Manage Kubernetes workloads |
| Talos Linux | Provide the operating system of Kubernetes nodes | Act as a general-purpose Linux server with arbitrary packages |
| Kubernetes | Orchestrate containerised workloads | Automatically back up application data |
These roles follow the Talos Proxmox guide and Kubernetes components. Talos runs in KVM VMs there. This differs from Proxmox LXC containers sharing the host kernel.
For distribution selection, see k3s vs RKE2 vs Talos. Talos primarily changes node operations; the Kubernetes API remains the application interface above it.
Day-to-day with talosctl
If you look after Linux servers over SSH, you find a counterpart for the familiar tasks in talosctl. The commands run from the admin machine against the Talos API of the nodes:
| Task | Classic Linux | Talos Linux |
|---|---|---|
| Check service state | systemctl status kubelet |
talosctl services --nodes 192.168.10.11 |
| Read service logs | journalctl -u kubelet |
talosctl logs kubelet --nodes 192.168.10.11 |
| Read kernel messages | dmesg |
talosctl dmesg --nodes 192.168.10.11 |
| Change configuration | Edit a file | talosctl edit machineconfig --nodes 192.168.10.11 or talosctl patch machineconfig |
| Reboot | reboot |
talosctl reboot --nodes 192.168.10.11 |
| Additional software | Install a package | Extension in the Image Factory schematic, then talosctl upgrade |
| Cluster health | Individual checks | talosctl health |
| Back up etcd | Script on the host | talosctl etcd snapshot etcd-backup.db |
| Retire a node | Reinstall | talosctl reset --nodes 192.168.10.11 |
The operating system is not patched but replaced: talosctl upgrade writes a new image to the second partition (A/B) and restarts the node; on problems Talos returns to the previous image. talosctl upgrade-k8s upgrades Kubernetes separately. The concrete calls for installation, bootstrap and upgrades are in the guide to installing on Proxmox.
What operations still require
The production notes cover the control plane, API endpoint and operational requirements. Multiple control planes must be spread across independent failure domains. Three VMs on the same Proxmox host do not protect against its failure.
Acceptance includes reachable APIs, a functioning pod network, suitable storage and verified access. A node image is not an application backup. etcd, persistent data and recovery still need a separate backup and restore plan.
When Talos fits
Evaluate Talos when a team wants to maintain machine configuration as code and standardise host changes through an API. If an application needs extra host packages or specific drivers, assess these against image and extension workflows before selecting a distribution. General-purpose Linux with k3s or RKE2 remains a comparison option.
WZ-IT connects Kubernetes on Proxmox with hosts, networking, storage and operating processes. Selection follows the environment's requirements.
