Setup

What acloud playhouse create provisions (an opinionated Kubernetes cluster with two node pools) and how it is bootstrapped for Playrooms.

Alpha

Playhouses are in active development. The exact objects and defaults may change between releases.

acloud playhouse create does two things in one command: it provisions a Kubernetes cluster and then bootstraps the in-cluster components that make it a usable Playhouse. The details may change, but the current setup looks like this.

The cluster

The cluster is created with opinionated, sandbox-friendly settings:

Calico CNI

A Playhouse always runs Calico.

Pod Security: baseline

Pod Security Standards are enabled with the baseline profile.

Auto-upgrade

Enabled and tied to a maintenance schedule. A dedicated weekly schedule is created for the Playhouse if you don't supply one.

Lean addons

Flux and the default network policies are on; monitoring and logging are off.

By default the cluster tracks the regular update channel (auto-upgrade follows the channel). Pass --version instead to pin a specific version.

The two node pools

A Playhouse has two node pools with different jobs:

system: a fixed-size pool (--node-count, default 1) that runs always-on platform pods such as Flux and the Tailscale operator.

playrooms: an autoscaling pool (1 up to --max-playroom-nodes, default 3) for the bursty Playroom workload. It is labelled and tainted (playroom=true, NoSchedule) right after creation, so only Playrooms are scheduled onto it and nothing else lands there.

Node types are chosen per cloud provider: a curated default when available, otherwise the smallest supported type that meets a memory floor (4 GB for the system pool, 8 GB for the playrooms pool). Override with --node-type (both pools) or --system-node-type / --playroom-node-type.

Bootstrap

Once the cluster is running, create converges the in-cluster state:

Namespaces: the playrooms and tailscale namespaces are created with privileged Pod Security Admission labels (the Playroom and operator pods aren't baseline-compliant, so these namespaces opt out).

Flux: a FluxInstance installs the Flux controllers, which provide the Helm APIs the Tailscale operator install depends on.

Tailscale operator: installed via a Flux HelmRelease from Tailscale's Helm repository. The OAuth credentials you pass to create are stored in an in-cluster Secret and injected into the operator, which is named after the Playhouse so multiple Playhouses don't collide on one tailnet.

Egress policy: a NetworkPolicy in the playrooms namespace blocks private networks and cloud metadata while allowing DNS and public internet. The same policy ships with every Playroom workspace namespace, since the agent can deploy pods there too.

Every step uses Server-Side Apply and is idempotent, so re-running acloud playhouse create with the same name reconverges a half-built or drifted Playhouse instead of erroring. See the lifecycle page.