Talos Omni:
First machine to a running cluster
in under two minutes.

Talos Omni โ€” welcome video

Kubernetes at scale

Why these teams pick Talos Omni.

Talos Omni has been a game changer. Seamless deployments, centralized management, and remote support โ€” all in one place.

Jeff Wright ยท Director of PM, Hardware ยท PowerFlex

We can easily scale to hundreds of clusters. Talos Omni is more than capable of that.

Paulo Araujo ยท Site Reliability Engineer ยท Promptly Health

Simple to set up, more security out of the box, and rock solid during updates.

Gwendolyn James ยท Staff DevOps Engineer ยท Ursa Major

We migrated from Red Hat OpenShift to Talos Linux and Omni in less than 24 hours.

Rushan Ratha ยท Head of Platform Engineering ยท SGX FX Group

Global game studio

Three developers built our entire platform on top of Talos Omni. Without it, we'd have shipped a year later.

Platform engineering team ยท a global game studio

Provision the machines,
not just the clusters.

Deploy an Infrastructure Provider: bare metal, KubeVirt, libvirt, vSphere, Proxmox, or build your own. Talos Omni handles power-on, OS install, and decommissioning through the provider. Machines join the fleet automatically and leave it cleanly.

Infrastructure Providers โ€” before and afterLeft panel shows manual paths from an engineer to bare metal, cloud VMs, and a hypervisor. Right panel shows the same infrastructure mediated through a single Infrastructure Provider layer to Talos Omni.WithoutengineerBare metalPXE scriptCloud VMsTerraformHypervisorISO mountEvery machine. Every time.With Infrastructure ProvidersBare metalCloud VMsHypervisorProviderlayerTalos OmniSet up once. Machines join and leave on their own.

No PXE scripts. No manual ISO mounts. No Terraform for the OS.

Reach any cluster service
from your browser.

Workload Proxy allows you to annotate any HTTP Service with a port and label. Talos Omni generates a URL gated by your IDP and routes traffic over the existing encrypted tunnel to your cluster.

Reaching cluster-internal services: without vs. with Workload ProxyLeft panel shows four access paths an engineer might use today to reach an internal cluster service: bastion, VPN, kubectl port-forward, SSH tunnel. Right panel shows the Workload Proxy path.Without Workload ProxyclusterBastionVPNPort-forwardSSH tunnelInternal service(e.g. Grafana)Four paths in. None of them clean.With Workload ProxyclusterBrowserTalos OmniIDP-gated, encryptedInternal service(e.g. Grafana)One path. IDP-gated. Encrypted by default.

No public ingress. No port-forwarding. No separate VPN.

Ready for production,
out of the box.

Talos Omni ships with all the parts you otherwise need to glue together: fleet upgrade orchestration, encryption across sites, identity management, cluster templates.

Encrypted by design

Talos Omni reaches every node over a WireGuard tunnel (SideroLink). Enable KubeSpan to extend encryption across clusters and sites.

Upgrades at fleet scale

Roll out Talos and Kubernetes upgrades fleet-wide from one place. Health-checked, atomic per node, automatic rollback on failure.

Clusters as code

Define cluster configuration once as a declarative template. Talos Omni applies it across the fleet and keeps clusters reconciled to the spec.

Enterprise identity, full audit

Authenticate through any SAML or OIDC provider, scope per-cluster access by role, and audit every change via the UI or API.

Pro-humans,
anti-heroics.