playhouse create

Provision and bootstrap a Playhouse (an opinionated Kubernetes cluster that hosts Playrooms) in a single command.

Alpha

This command is in active development. Flags and behaviour may change between releases.

Create a Playhouse: an opinionated Kubernetes cluster that hosts Playrooms.

In one command this provisions a cluster (named playhouse-NAME), adds a small system node pool plus an autoscaling, isolated pool for Playrooms, waits for it to come up, and bootstraps it: the Tailscale operator (for SSH connectivity), the playrooms namespace, and an egress policy that keeps the agent off cloud metadata and private networks. Re-running with the same name is safe; it resumes where a previous run left off.

Prerequisite: a Tailscale OAuth client

A brand-new Playhouse needs --tailscale-oauth-client-id and --tailscale-oauth-client-secret (or the TS_OAUTH_CLIENT_SECRET environment variable). Create the OAuth client in your Tailscale admin console following Tailscale's Kubernetes operator setup. The credentials are stored inside the Playhouse and reused on later runs, so you only pass them once.

acloud playhouse create NAME [flags]

Examples

# one cloud account / environment in the org: everything else is inferred
acloud playhouse create demo \
  --tailscale-oauth-client-id ID \
  --tailscale-oauth-client-secret SECRET

# full placement, secret taken from the environment
export TS_OAUTH_CLIENT_SECRET=SECRET
acloud playhouse create demo \
  --cloud-account ID --region eu-central --environment sandbox \
  --tailscale-oauth-client-id ID

# pin a specific AME version instead of tracking the update channel
acloud playhouse create demo \
  --version 1.31.4 \
  --tailscale-oauth-client-id ID --tailscale-oauth-client-secret SECRET

Options

Prop

Type

Options inherited from parent commands

Prop

Type

How create resolves its inputs

The hardest parts of create aren't the individual flags; they're how it fills in what you leave out. A few rules to know:

Placement is inferred. --cloud-account, --environment, and --region are each inferred when your organisation (or account) offers exactly one. If there is more than one, create stops and lists the choices so you can pass the flag.
Node pools are sized and typed for you. --node-count sets the fixed system pool (default 1); --max-playroom-nodes caps the autoscaling Playrooms pool (default 3). Node types are auto-selected per cloud provider unless you set --node-type, --system-node-type, or --playroom-node-type.
Re-running is safe. Running create again with the same name resumes setup (ensure pools → wait → bootstrap). It is how you repair or upgrade a Playhouse. A same-named cluster that isn't a Playhouse is rejected.
It becomes your default Playhouse. Unless you pass --no-default, the new Playhouse is saved as the default target for acloud playroom commands, so you can omit -p afterwards.

Version or update channel, not both

By default a Playhouse tracks the regular update channel and auto-upgrades with it. Pass --version to pin a specific version instead (which drops the channel). Setting both --version and --update-channel is contradictory and fails.

Expected output

create reports what it inferred, prints a summary, asks you to confirm (unless --yes), then provisions and bootstraps:

Using cloud account "Demo Account" (only one available)
Using environment "sandbox" (only one available)
Using region "eu-central" (only one available)
Creating playhouse:
    name: playhouse-demo
    organisation: my-org
    environment: sandbox
    cloud account: Demo Account
    region: eu-central
    update channel: regular (version 1.31.4)
    cni: calico
    pod security profile: baseline
    auto-upgrade: true
    maintenance schedule: playhouse-demo (every Sunday 03:00-11:00)
    node pool "system": cpx22, 1 node(s)
    node pool "playrooms": cpx32, autoscale 1-3

Create playhouse "playhouse-demo" in my-org/sandbox? [y/N]: y

Created maintenance schedule "playhouse-demo" for auto-upgrade
Created playhouse playhouse-demo
Isolated the playrooms node pool (label playroom=true, taint NoSchedule)
Waiting for playhouse playhouse-demo to start... done
Configuring the playrooms and tailscale namespaces
Installing Flux
Installing the Tailscale operator
Applying the egress policy (block private networks and metadata)

Playhouse playhouse-demo is ready.

Create a playroom in it:
  acloud playroom play -p playhouse-demo

It is now your default playhouse, so -p is optional.

Common errors

Missing credentials on a new Playhouse: --tailscale-oauth-client-id and --tailscale-oauth-client-secret (or TS_OAUTH_CLIENT_SECRET) are required when creating a playhouse. Pass them once; they're stored for later runs.
Ambiguous placement: organisation "…" has N environments; pass --environment (…) (similar for cloud accounts and regions). Pass the named flag.
Name recently deleted: playhouse "…" was recently deleted; its name stays reserved for a while. Wait (about 24h) or choose a different name.