After installation, verify the deployment, deploy the Monte Carlo Agent, and create the ClickHouse integration in Monte Carlo. You carry out these steps yourself — work through them in order.

1. Configure cluster access

If you ran terraform apply from this same machine, you can skip this step — the module already ran gcloud container clusters get-credentials during apply, so the cluster's context is in your ~/.kube/config and is current. Run the command below only when connecting from a different machine:

gcloud container clusters get-credentials "$(terraform output -raw gke_cluster_name)" \
  --location <location> --project <project_id>

2. Verify the deployment

All components run in the montecarlo namespace. Confirm each is healthy:

The schema migration job must reach 1/1 before the Collector and LLM worker can write data — both wait on it via an init container, so it is normal for them to sit in Init for a minute or two on a fresh install. Let's Encrypt certificate issuance can take a few extra minutes after external-dns publishes the DNS-01 validation records.

To check end-to-end reachability, resolve both hostnames (they should return the Gateway's private IP) and send a request from a VM inside the VPC:

curl -s -o /dev/null -w '%{http_code}\n' https://<otel_collector_domain>/v1/traces

Verify Workload Identity

The module ships a verification script that proves the secret-sync path works exactly as designed — it asserts the External Secrets store is Ready, syncs a throwaway secret through the external-secrets Workload Identity binding (positive check), and confirms an unbound pod is denied Secret Manager access (negative check — no ambient node-level leak):

# After terraform init, the module source is available locally:
.terraform/modules/ao_data_platform/scripts/verify-wif.sh \
  "$(terraform output -raw gke_cluster_name)" <location> <project_id>

3. Deploy the Monte Carlo Agent

All SQL from the Monte Carlo platform — for both Trace Exploration and agent monitors — flows through the Monte Carlo Agent. For this platform, the Agent runs as a containerized service on Cloud Run and queries ClickHouse over its internal endpoint as the monte_carlo user.

The Agent is not deployed by the terraform-google-ao-data-platform module — it is deployed separately with the terraform-google-mcd-agent module; see Deploying the Agent on GCP for the Agent deployment itself. The Agent Observability-specific configuration is the network path and the ClickHouse connection:

• Network path. The ClickHouse endpoint resolves to a private IP inside the platform VPC, so the Cloud Run service must reach it through Direct VPC egress routing private ranges only, attached to a dedicated subnet in the platform VPC. The platform module's network_name and subnetwork_name outputs identify the VPC and its node subnet — create the Agent's egress subnet alongside them.
• Allow-list. If you restricted the Gateway with gateway.allowed_source_ranges, add the Agent subnet's CIDR to the list and re-apply the platform module — the Cloud Armor policy evaluates the client IP, and the Agent's calls originate from that subnet. See Harden network access.
• Connection. The endpoint is your clickhouse_domain, and the credentials are the monte_carlo user's Secret Manager secret, retrieved in the next step.

4. Retrieve credentials and endpoints

Monte Carlo connects to ClickHouse as the monte_carlo user — a least-privilege identity that reads telemetry and appends only to the evaluation job queue. Its password is stored in Secret Manager; the module exposes it as the clickhouse_monte_carlo_credentials_secret_id output (and, for convenience, the exact version as clickhouse_monte_carlo_credentials_secret_version). Retrieve it:

gcloud secrets versions access \
  "$(terraform output -raw clickhouse_monte_carlo_credentials_secret_version)"

You enter the following when you create the ClickHouse integration in the next step:

The endpoint resolves to a private IP — Monte Carlo reaches it through the Agent you deployed in step 3, which has a network path into the VPC. Telemetry senders push to your otel_collector_domain over OTLP/HTTP (https://<otel_collector_domain>/v1/traces); the L7 Gateway does not carry OTLP/gRPC.

5. Create the ClickHouse integration in Monte Carlo

With the Agent deployed (step 3) and the connection values in hand (step 4), create the ClickHouse integration in Monte Carlo. Monte Carlo reaches ClickHouse through the Agent you deployed, so this is the step that ties the platform to your account. Creating the integration runs a connection check — when it succeeds, you have confirmation that the endpoint, port, credentials, and database are all wired correctly.

Next steps

• Tune retention, users, TLS, and sizing in the Configuration reference.
• Hit a problem during verification or onboarding? See Troubleshooting & FAQ.