Add proxmox windows by plouton24 · Pull Request #1976 · kubernetes-sigs/image-builder

plouton24 · 2026-04-07T00:55:44Z

Change description

This PR adds Windows Server 2022 image support for the Proxmox provider in image-builder. For use with CAPMOX CAPI project.

The main changes are:

add a Proxmox Windows Server 2022 make/build configuration
add the Proxmox Windows Packer flow for proxmox-iso
add/update the Windows unattended installation flow for Proxmox
configure Cloudbase-Init for Proxmox NoCloud metadata via ansible overrides:
- META_DATA
- USER_DATA
- NETWORK_CONFIG
add a Proxmox-specific Cloudbase-Init helper in the Windows provider role to handle NETWORK_CONFIG
- Cloudbase-init has PR Add proxmox cidata support cloudbase/cloudbase-init-test-resources#19 but has not been merged in. So helper script allows cloubase-init to read config data
add ansible windows provider settings, and goss checks
update Proxmox Windows documentation and the provider / OS support matrix

A few implementation notes:

CAPMOX currently exposes cidata/init data using uppercase filenames, which differs from the default NoCloud naming expected by Cloudbase-Init
- META_DATA and USER_DATA are handled through Cloudbase-Init config overrides
- NETWORK_CONFIG is currently handled by a small Proxmox-specific python script staged through the Windows provider role
  - Unsure where best place to stage this file and or place it with in repo.

This PR adds support for a new provider / OS combination.

Is this change including a new Provider or a new OS? (y/n) y
If yes, has the Provider/OS matrix been updated in the readme? (y/n) y
If adding a new provider, are you a representative of that provider? (y/n) n/a

Related issues

Fixes #

Testing

Testing performed during development:

built the image locally with make build-proxmox-windows-2022
tested the image on a local Proxmox environment
tested the image with CAPMOX via:
- https://github.com/plouton24/capmox-cc-windows/tree/main
validated that a CAPMOX-created Windows node booted and completed the expected bootstrap flow

Additional context

Assumes user is running capmox for windows image.
- due to cloubase init plugins
- can override vars via empty string: ""
Codex AI was used to troubleshoot and create portions of this provider.
Goss file checks were added but not implemented into packer.json due to lack of knowledge/experience with program

k8s-ci-robot · 2026-04-07T00:55:57Z

Welcome @plouton24!

It looks like this is your first PR to kubernetes-sigs/image-builder 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/image-builder has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-04-07T00:55:58Z

Hi @plouton24. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-04-07T00:56:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign averagemarcus for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2026-04-07T00:56:03Z

The committers listed above are authorized under a signed CLA.

✅ login: plouton24 / name: plouton24 (9246632, aa2a54f)

mboersma · 2026-04-10T16:39:05Z

Hey @plouton24, thanks for doing this work!

Could you rebase it from image-builder's main branch and squash your commits? Currently it shows 59 commits, including merge commits (which are considered invalid). That should also take care of the CLA problem, since it appears you already signed it.

… provider

plouton24 · 2026-04-13T05:38:28Z

Hey @plouton24, thanks for doing this work!

Could you rebase it from image-builder's main branch and squash your commits? Currently it shows 59 commits, including merge commits (which are considered invalid). That should also take care of the CLA problem, since it appears you already signed it.

This has been completed.

mboersma · 2026-04-14T14:21:51Z

/ok-to-test

drew-viles

So I'm no Windows, Proxmox or Python expert - I want to prefix that. But a few things popped up in my looks through this that I wanted to ask about. See comments below :-)

drew-viles · 2026-04-14T20:57:07Z

+def main():
+    network_data_path = find_network_data_path()
+    if not network_data_path:
+        LOG.info(
+            "No Proxmox network data found in candidate paths: %s",
+            ", ".join(_iter_candidate_paths()),
+        )
+        return 0
+
+    try:
+        network_data = load_network_data(network_data_path)
+    except Exception:
+        LOG.exception(
+            "Failed to load Proxmox network data from %s", network_data_path
+        )
+        return 0
+
+    try:
+        LOG.info("Applying Proxmox network data from %s", network_data_path)
+        applied = apply_network_data(network_data)
+    except Exception:
+        LOG.exception(
+            "Failed to apply Proxmox network data from %s", network_data_path
+        )
+        return 0
+
+    if not applied:
+        LOG.warning(
+            "No network interfaces were applied from %s", network_data_path
+        )
+
+    return 0


Would it not be better to fail a little louder rather than return 0 if something fails? As I'm reading this, it looks like failures will happen silently meaning an image could successfully build even if something like applying the proxmox network fails.

Would we be ok with this?

So this is kind of my hack to read the cloudinit network data that CAPMOX injects via a ISO-9660 cd drive for kubeadm boostrap. So this wont fail the build of the VM, as its a node first boot helper script for cloudbase-init(windows version of cloud-init). Though I should try to write to a file to troubleshoot networking incase CAPMOX changes its kubeadmbootstrap process, and be more verbose on failures.

drew-viles · 2026-04-14T20:57:42Z

+                <ProductKey>
+                    <Key>VDYBN-27WPP-V4HQT-9VMD4-VMK7H</Key>
+                    <WillShowUI>OnError</WillShowUI>
+                </ProductKey>


Do we mind this being here? Is this a demo key?

This to my understanding is a demo key. Copied from proxmox/ova/windows/2022/autounattend.xml

drew-viles · 2026-04-14T21:00:20Z

+build-proxmox-ubuntu-2204: ## Builds the Proxmox ubuntu-2204 image
+build-proxmox-ubuntu-2404: ## Builds the Proxmox ubuntu-2404 image
+build-proxmox-ubuntu-2404-efi: ## Builds the Proxmox ubuntu-2404-efi image that EFI boots
+build-proxmox-rockylinux-9: ## Builds the Proxmox rockylinux-9 image


Look like duplicate lines of 862 - 865

drew-viles · 2026-04-14T21:02:13Z

+    # This uses a packer file builder to input unattend variables into a JSON file to be consumed by the python script before running the vsphere provisioner
+	$(if $(findstring windows,$@),$(PACKER) build $(PACKER_WINDOWS_NODE_FLAGS) -var-file="$(abspath packer/proxmox/$(subst build-proxmox-,,$@).json)" -var-file="$(abspath packer/proxmox/$(subst build-proxmox-,,$@).json)" -only=file $(ABSOLUTE_PACKER_VAR_FILES) packer/proxmox/packer-windows.json,)
+	$(if $(findstring windows,$@),hack/windows-unattend.py --unattend-file='./packer/proxmox/windows/$(subst build-proxmox-,,$@)/autounattend.xml',)
+	$(PACKER) build $(if $(findstring windows,$@),$(PACKER_WINDOWS_NODE_FLAGS),$(PACKER_NODE_FLAGS)) -var-file="$(abspath packer/proxmox/$(subst build-proxmox-,,$@).json)" $(ABSOLUTE_PACKER_VAR_FILES) packer/proxmox/packer$(if $(findstring windows,$@),-windows,).json
+


This section looks copy-pasted: the same -var-file is passed twice, and the comment references vSphere in the Proxmox path. Is the duplicate var-file intentional?

drew-viles · 2026-04-14T21:02:49Z

+cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
+cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'


Is this secure? Is it standard for Windows?

I copied the existing winrm config from nutanix, oci and azure. Also the ansible windows workflow also has similar settings. I do agree work is needed on most windows enabled providers to disable winrm after image build if not required, as it is a security risk. Just was unsure if there were capmox/capi specific need for winrm to be enabled after build. I can test disabling this on sysprep/final build step.

drew-viles · 2026-04-14T21:03:43Z

Is this a WIP file and is is needed?

plouton24 · 2026-04-15T01:44:15Z

So I'm no Windows, Proxmox or Python expert - I want to prefix that. But a few things popped up in my looks through this that I wanted to ask about. See comments below :-)

Comments on the most of the for the ones i didnt comment on I will fix via a commit. As need to fix typos and other small issues you mentioned.

k8s-ci-robot · 2026-04-15T01:44:25Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 7, 2026

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. do-not-merge/contains-merge-commits labels Apr 7, 2026

k8s-ci-robot requested review from kkeshavamurthy and mboersma April 7, 2026 00:56

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Apr 7, 2026

mboersma requested review from drew-viles and removed request for kkeshavamurthy April 10, 2026 16:34

Squashed Changes to Merge Change for Windows 2022 support for Proxmox…

aa2a54f

… provider

plouton24 force-pushed the add-proxmox-windows branch from 600dcd9 to aa2a54f Compare April 13, 2026 05:35

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed do-not-merge/contains-merge-commits cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Apr 13, 2026

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 14, 2026

Ran Json sort to resolve issue in CI tests

9246632

drew-viles reviewed Apr 14, 2026

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 15, 2026

		cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
		cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'

Conversation

plouton24 commented Apr 7, 2026

Change description

Related issues

Testing

Additional context

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

linux-foundation-easycla Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mboersma commented Apr 10, 2026

Uh oh!

plouton24 commented Apr 13, 2026

Uh oh!

mboersma commented Apr 14, 2026

Uh oh!

drew-viles left a comment

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

plouton24 Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

plouton24 Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

plouton24 Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

drew-viles Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

plouton24 commented Apr 15, 2026

Uh oh!

k8s-ci-robot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

linux-foundation-easycla Bot commented Apr 7, 2026 •

edited

Loading

drew-viles Apr 14, 2026 •

edited

Loading

plouton24 Apr 15, 2026 •

edited

Loading