Agent Observability Data Platform
Self-hosted data platform for Agent Observability β OpenTelemetry Collector and ClickHouse on EKS, AKS, or GKE, deployed with Terraform
Overview
The Agent Observability data platform is a self-hosted pipeline that ingests OpenTelemetry trace data from your AI agents and stores it in ClickHouse for Monte Carlo to query. It runs entirely in your own cloud account and is deployed with a single Terraform module β one per supported cloud β that provisions everything from the OpenTelemetry Collector through to ClickHouse on a Kubernetes cluster.
Once deployed, Monte Carlo connects to the platform to power Trace Exploration and agent monitors β all queried through the Monte Carlo Agent.
This is a new deployment option that stores trace data directly in ClickHouse. It is distinct from the warehouse-based ingestion path described in Agent with OpenTelemetry Collector, which routes traces into a data warehouse (Snowflake, Databricks, BigQuery, or Athena).
Supported clouds. The platform deploys on AWS (Amazon EKS), Azure (AKS), and GCP (GKE), each from its own Terraform module. The architecture is the same on every cloud; the ingress, LLM, secrets, and agent-deployment details differ β see Choose your cloud below.
Public artifacts. The platform is deployed from the per-cloud
monte-carlo-data/ao-data-platformTerraform modules on the Terraform Registry (aws,azurerm,ao-data-platformHelm chart (version4.0.0) and theao-llm-workerimage (per-cloud tags1.1.0-aws/1.1.0-azure/1.1.0-gcp) on Docker Hub. Pulling them requires no registry credentials β see the Prerequisites page for your cloud.
Choose your cloud
| AWS | Azure | GCP | |
|---|---|---|---|
| Kubernetes service | Amazon EKS | Azure Kubernetes Service (AKS) | Google Kubernetes Engine (GKE, Standard) |
| Terraform module | monte-carlo-data/ao-data-platform/aws | monte-carlo-data/ao-data-platform/azurerm | monte-carlo-data/ao-data-platform/google |
| TLS / ingress model | Two internal Network Load Balancers (L4) with ACM certificates | Single internal Gateway (Gateway API, app-routing Istio add-on) with Let's Encrypt certificates via cert-manager DNS-01 | Single internal Gateway (Gateway API, gke-l7-rilb) with Let's Encrypt certificates via cert-manager DNS-01 |
| LLM evaluation backend | Amazon Bedrock | Microsoft Foundry | Vertex AI |
| Secrets integration | AWS Secrets Manager, synced by the External Secrets Operator | Azure Key Vault, synced by the External Secrets Operator | GCP Secret Manager, synced by the External Secrets Operator |
| Monte Carlo Agent deployment | AWS Lambda | Azure Functions | Cloud Run |
| Object-storage ingestion | Optional S3 receivers (SQS-notified) in addition to OTLP push | OTLP push only | OTLP push only |
Start with the Prerequisites page for your cloud:
Architecture
The platform has two independent data flows:
- Ingestion β your instrumented agents send OpenTelemetry traces to the OpenTelemetry Collector, which writes them directly into ClickHouse.
- Query β the Monte Carlo platform sends all of its SQL through the Monte Carlo Agent (a serverless workload running in your account with private network access to the cluster β a Lambda function on AWS, an Azure Functions container on Azure, a Cloud Run service on GCP), which queries ClickHouse for Trace Exploration and agent monitors.
By default β as configured in the Installation guides β the platform is deployed highly available: ClickHouse runs as two replicas spread across availability zones, coordinated by a three-voter ClickHouse Keeper ensemble, so it tolerates the loss of a full zone. A single-replica variant exists for dev/testing β see High availability for AWS, Azure or GCP.
flowchart TB
classDef ext fill:#F8FAFC,stroke:#64748B,color:#0F172A;
classDef node fill:#FEF2F2,stroke:#DC2626,color:#7F1D1D;
classDef net fill:#FFF7ED,stroke:#EA580C,color:#7C2D12;
classDef agent fill:#EEF2FF,stroke:#4F46E5,color:#1E1B4B;
APPS["Instrumented agents / apps"]:::ext
MC["Monte Carlo platform"]:::ext
LLMSVC["Cloud LLM service<br/>Bedrock / Foundry / Vertex AI"]:::ext
subgraph ACCT["Your cloud account"]
AGENT["Monte Carlo Agent Β· serverless, in-network<br/>Lambda / Azure Functions / Cloud Run<br/>customer-deployed, outside the cluster"]:::agent
ING1["Internal load balancer Β· OTLP<br/>NLB (AWS) Β· Gateway API (Azure, GCP)"]:::net
ING2["Internal load balancer Β· ClickHouse"]:::net
subgraph K8S["Kubernetes cluster Β· montecarlo namespace<br/>EKS / AKS / GKE"]
OTEL["OpenTelemetry Collector"]:::node
LLM["LLM worker"]:::node
CH[("ClickHouse Β· 2 replicas<br/>across zones")]:::node
KEEPER["ClickHouse Keeper Β· 3 voters<br/>replication coordination"]:::node
end
end
APPS -->|"OTLP 4318 Β· TLS<br/>(+ gRPC 4317 on AWS)"| ING1
ING1 --> OTEL
OTEL -->|"write traces"| CH
MC -->|"SQL Β· Monte Carlo initiates"| AGENT
AGENT -->|"forwards SQL Β· 8443 TLS Β· monte_carlo user"| ING2
ING2 --> CH
CH <--> KEEPER
LLM -->|"read / write"| CH
LLM -->|"evaluations"| LLMSVC
style ACCT fill:#FFFBEB,stroke:#EA580C,color:#7C2D12
style K8S fill:#ECFEFF,stroke:#0891B2,color:#164E63
Components
The Terraform module for your cloud deploys the following into your account:
| Component | Description |
|---|---|
| Kubernetes cluster + network | A new cluster and network (EKS + VPC, AKS + VNet, or GKE + VPC), or your existing ones. Hosts the data-plane workloads below. |
| ClickHouse | The trace data store β two replicas spread across zones by default. Deployed and managed by the Altinity ClickHouse Operator. |
| ClickHouse Keeper | Three-voter consensus ensemble coordinating table replication between the ClickHouse replicas (see High availability for AWS, Azure, or GCP). |
| OpenTelemetry Collector | Receives OTLP traces and writes them to ClickHouse. |
| LLM worker | Runs evaluations against trace data using your cloud's LLM service β Amazon Bedrock, Microsoft Foundry, or Vertex AI (see Evaluation). |
| Cluster controllers | cert-manager, External Secrets Operator, and external-dns on every cloud. AWS adds the AWS Load Balancer Controller; Azure and GCP add trust-manager (for Gateway backend TLS). |
| Supporting cloud resources | TLS certificates and DNS records, workload identities for the platform components (IRSA on AWS, Microsoft Entra Workload ID on Azure, Workload Identity Federation on GCP), and per-user ClickHouse credential secrets in your cloud's secret store. |
The Monte Carlo Agent is not part of the module β it is deployed separately and pointed at ClickHouse. See Connect to Monte Carlo for AWS, Azure, or GCP.
Ingestion
Instrumented agents send traces to the OpenTelemetry Collector over OTLP, TLS-terminated at an internal load balancer:
- AWS β a Network Load Balancer (L4) accepting OTLP over gRPC on port
4317or HTTP on port4318. - Azure and GCP β an internal Gateway API load balancer (L7) accepting OTLP over HTTP on port
4318only (no gRPC).
The Collector batches incoming spans and writes them directly into ClickHouse using the ClickHouse exporter; there is no intermediate object storage or data warehouse. On AWS the Collector can additionally ingest OTLP trace objects from S3 buckets (notified via SQS); Azure and GCP are OTLP-push-only.
Evaluation
The platform includes an LLM worker that runs evaluations against trace data. It reads pending work from ClickHouse, invokes a model through your cloud's LLM service in your account, and writes the results back to ClickHouse:
- AWS β Amazon Bedrock. The Bedrock region defaults to your deployment region and is configurable.
- Azure β Microsoft Foundry account the Terraform module provisions (with model deployments and a least-privilege inference role).
- GCP β Vertex AI (serverless, Model-as-a-Service; the models must be enabled in your project's Model Garden β see Prerequisites (GCP)).
See the Configuration reference for your cloud (AWS, Azure, or GCP) for the evaluation-backend settings.
End-to-end setup
Getting agent traces into Monte Carlo is a four-step journey. This documentation set covers steps 2β3 (deploy and connect); the links below cover instrumenting your agents and creating monitors.
| Step | What you do | Where |
|---|---|---|
| Add the Monte Carlo OpenTelemetry SDK to your agents so they emit OTLP traces. | Monte Carlo SDK; the instrument-agent skill in the Agent Toolkit |
| Provision the OpenTelemetry Collector and ClickHouse in your cloud account with Terraform. | Prerequisites β Installation for your cloud (see Deploying the platform) |
| Deploy the Monte Carlo Agent and hand off the ClickHouse connection. | Connect to Monte Carlo (AWS, Azure, or GCP) |
| Explore traces and create agent monitors in Monte Carlo. | Agent Monitors Overview |
Deploying the platform
Work through these pages in order for your cloud:
| Step | Page | Cloud |
|---|---|---|
| 1 | Prerequisites β tooling, account and permissions, domains, and chart access | AWS | Azure | GCP |
| 2 | Installation β configure and apply the Terraform module | AWS | Azure | GCP |
| 3 | Connect to Monte Carlo β deploy the Monte Carlo Agent and hand off credentials | AWS | Azure | GCP |
| β | High availability β how the clustered topology works, and day-2 operations | AWS | Azure | GCP |
| β | Configuration reference β TLS, retention, ClickHouse users, and resource sizing | AWS | Azure | GCP |
| β | Self-managed Helm install β advanced: manage the Helm release yourself | AWS | Azure | GCP |
| β | Troubleshooting & FAQ β common installation and runtime issues | All |
Updated 1 day ago
