Deploy Talos Linux on a VPS

Talos is an immutable, API-managed OS purpose-built for Kubernetes — no SSH, no shell, no package manager. On a generic KVM VPS (no cloud-init/metadata service, no PXE), the practical path is: boot the Talos ISO, install to disk, manage entirely via talosctl over the network.

Assumptions

RamNode KVM VPS via SolusVM 2, with console access and the ability to mount a custom ISO for install/reinstall
A public IP already assigned to the VM (Talos will use DHCP by default unless you supply a static network config)
talosctl installed on your local workstation or jump host — not on the VPS itself (there is no shell to install anything into on Talos)

1. Install talosctl locally (on your workstation/jump host, not the VPS)

shell

curl -sL https://talos.dev/install | sh
talosctl version --client

2. Get the Talos ISO onto the VPS

RamNode's SolusVM 2 KVM nodes support custom ISO installs/reinstalls (same path used for the SolusVM1→2 KVM migrations). Two options:

Option A — SolusVM 2 custom ISO upload (preferred):

Download the latest Talos metal ISO locally: https://github.com/siderolabs/talos/releases → metal-amd64.iso
In SolusVM 2 (legacy.ramnode.com), reinstall the VM using a custom ISO upload, pointing at the Talos ISO.
Boot the VM into the ISO (not to disk yet — Talos boots into a maintenance/ephemeral mode from the ISO until you install it).

Option B — if custom ISO upload isn't available for that node, use the SolusVM console to attach the ISO via virtual media if the KVM host supports it, same effect.

3. Boot into maintenance mode and get the node's address

Once booted from ISO, Talos comes up with DHCP on eth0 and exposes the apid gRPC API on port 50000. From the SolusVM VNC console, Ctrl+Alt+F2-style output isn't applicable (no login), but the console will print the DHCP-assigned IP on the Talos banner. Note that IP — call it <node-ip>.

Confirm reachability from your jump host:

shell

talosctl -n <node-ip> version --insecure

(--insecure is expected pre-install — the node has no cert identity yet.)

4. Generate machine configs

shell

mkdir -p ~/talos/cluster1
cd ~/talos/cluster1
talosctl gen config ramnode-cluster1 https://<node-ip>:6443 \
  --output-dir .

This produces controlplane.yaml, worker.yaml, and talosconfig.

Static IP (recommended for a VPS — don't rely on DHCP lease renewal across reboots)

Patch the network section before applying. Create patch-network.yaml:

shell

machine:
  network:
    hostname: talos-cp1
    interfaces:
      - interface: eth0
        addresses:
          - <public-ip>/<prefix-from-ramnode>
        routes:
          - network: 0.0.0.0/0
            gateway: <gateway-ip-from-ramnode>
    nameservers:
      - 1.1.1.1
      - 8.8.8.8

Get the exact IP/prefix/gateway values from RamNode's VPS network details panel (same values you'd use for any static-IP Linux install on that node).

5. Apply config to install to disk

While still booted from the ISO (insecure/maintenance mode):

shell

talosctl apply-config --insecure \
  -n <node-ip> \
  --file controlplane.yaml \
  --config-patch @patch-network.yaml

The node will install Talos to the primary disk and reboot. After reboot it comes up with its real identity and the static IP from the patch — it will not boot into maintenance mode again unless wiped.

Important: after this reboot, detach/unmount the ISO in SolusVM (or set boot order back to disk) so future reboots boot the installed OS, not the ISO again.

6. Point talosctl at the real node and bootstrap etcd

shell

export TALOSCONFIG=~/talos/cluster1/talosconfig
talosctl config endpoint <public-ip>
talosctl config node <public-ip>

talosctl bootstrap -n <public-ip>

Bootstrap only needs to run once, against one control-plane node, ever.

7. Get kubeconfig

shell

talosctl kubeconfig -n <public-ip>
kubectl get nodes

You should see the control-plane node Ready (it may show a taint if you haven't added workers — control-plane nodes are tainted NoSchedule by default, same as upstream Kubernetes).

8. Adding worker nodes

Repeat steps 2–5 on additional RamNode VPS instances using worker.yaml instead of controlplane.yaml, each with its own network patch for its assigned IP. Then:

shell

talosctl config node <public-ip>,<worker-ip-1>,<worker-ip-2>
kubectl get nodes

9. Firewall / exposure notes

Talos has no local firewall config exposed the way ufw does on normal Linux — it's not a general-purpose OS. Ports to be aware of on each node:

50000/tcp — apid (talosctl management API) — restrict to your jump host / management IPs at the RamNode network level if the plan supports per-VM security groups; otherwise rely on the apid mTLS (talosconfig-based auth) as the actual security boundary, since nothing else is listening for unauthenticated access
6443/tcp — Kubernetes API (control-plane nodes only)
2379-2380/tcp — etcd, control-plane nodes only, should not be exposed beyond the cluster's control-plane set

If RamNode's KVM platform doesn't offer per-VM security groups (SolusVM 2 typically doesn't expose this the way a cloud provider would), your practical mitigation is talosconfig/kubeconfig secrecy plus IP-based restriction wherever there's an upstream network ACL you control (e.g., a pfSense/OPNsense edge if you're routing several RamNode VPS instances through one).

10. Caveats specific to a VPS (vs. bare metal/cloud)

No cloud-init metadata service on generic KVM — all config must be applied via talosctl apply-config against the booted ISO, as above. There's no equivalent of dropping a user-data file at provision time unless RamNode's SolusVM 2 image pipeline specifically supports NoCloud-style metadata injection for custom images (verify before assuming).
Console access during install is VNC-only through SolusVM — no serial-over-SSH fallback since Talos has no SSH. If talosctl apply-config fails, your only recovery path is the VNC console output and re-mounting the ISO.
Disk device naming: confirm via the Talos ISO's console banner or talosctl disks -n <node-ip> --insecure before writing the install config if the VPS has more than one virtual disk attached — don't assume /dev/sda blindly on every RamNode KVM template.

Reference

Talos docs: https://www.talos.dev/latest/
ISO releases: https://github.com/siderolabs/talos/releases