Agent Observability Data Platform

Self-hosted data platform for Agent Observability β€” OpenTelemetry Collector and ClickHouse on EKS, AKS, or GKE, deployed with Terraform

Overview

The Agent Observability data platform is a self-hosted pipeline that ingests OpenTelemetry trace data from your AI agents and stores it in ClickHouse for Monte Carlo to query. It runs entirely in your own cloud account and is deployed with a single Terraform module β€” one per supported cloud β€” that provisions everything from the OpenTelemetry Collector through to ClickHouse on a Kubernetes cluster.

Once deployed, Monte Carlo connects to the platform to power Trace Exploration and agent monitors β€” all queried through the Monte Carlo Agent.

πŸ“˜

This is a new deployment option that stores trace data directly in ClickHouse. It is distinct from the warehouse-based ingestion path described in Agent with OpenTelemetry Collector, which routes traces into a data warehouse (Snowflake, Databricks, BigQuery, or Athena).

☁️

Supported clouds. The platform deploys on AWS (Amazon EKS), Azure (AKS), and GCP (GKE), each from its own Terraform module. The architecture is the same on every cloud; the ingress, LLM, secrets, and agent-deployment details differ β€” see Choose your cloud below.

πŸ“˜

Public artifacts. The platform is deployed from the per-cloud monte-carlo-data/ao-data-platform Terraform modules on the Terraform Registry (aws, azurerm, google), with the ao-data-platform Helm chart (version 4.0.0) and the ao-llm-worker image (per-cloud tags 1.1.0-aws / 1.1.0-azure / 1.1.0-gcp) on Docker Hub. Pulling them requires no registry credentials β€” see the Prerequisites page for your cloud.

Choose your cloud

AWSAzureGCP
Kubernetes serviceAmazon EKSAzure Kubernetes Service (AKS)Google Kubernetes Engine (GKE, Standard)
Terraform modulemonte-carlo-data/ao-data-platform/awsmonte-carlo-data/ao-data-platform/azurermmonte-carlo-data/ao-data-platform/google
TLS / ingress modelTwo internal Network Load Balancers (L4) with ACM certificatesSingle internal Gateway (Gateway API, app-routing Istio add-on) with Let's Encrypt certificates via cert-manager DNS-01Single internal Gateway (Gateway API, gke-l7-rilb) with Let's Encrypt certificates via cert-manager DNS-01
LLM evaluation backendAmazon BedrockMicrosoft FoundryVertex AI
Secrets integrationAWS Secrets Manager, synced by the External Secrets OperatorAzure Key Vault, synced by the External Secrets OperatorGCP Secret Manager, synced by the External Secrets Operator
Monte Carlo Agent deploymentAWS LambdaAzure FunctionsCloud Run
Object-storage ingestionOptional S3 receivers (SQS-notified) in addition to OTLP pushOTLP push onlyOTLP push only

Start with the Prerequisites page for your cloud:

Architecture

The platform has two independent data flows:

  • Ingestion β€” your instrumented agents send OpenTelemetry traces to the OpenTelemetry Collector, which writes them directly into ClickHouse.
  • Query β€” the Monte Carlo platform sends all of its SQL through the Monte Carlo Agent (a serverless workload running in your account with private network access to the cluster β€” a Lambda function on AWS, an Azure Functions container on Azure, a Cloud Run service on GCP), which queries ClickHouse for Trace Exploration and agent monitors.

By default β€” as configured in the Installation guides β€” the platform is deployed highly available: ClickHouse runs as two replicas spread across availability zones, coordinated by a three-voter ClickHouse Keeper ensemble, so it tolerates the loss of a full zone. A single-replica variant exists for dev/testing β€” see High availability for AWS, Azure or GCP.

flowchart TB
  classDef ext fill:#F8FAFC,stroke:#64748B,color:#0F172A;
  classDef node fill:#FEF2F2,stroke:#DC2626,color:#7F1D1D;
  classDef net fill:#FFF7ED,stroke:#EA580C,color:#7C2D12;
  classDef agent fill:#EEF2FF,stroke:#4F46E5,color:#1E1B4B;

  APPS["Instrumented agents / apps"]:::ext
  MC["Monte Carlo platform"]:::ext
  LLMSVC["Cloud LLM service<br/>Bedrock / Foundry / Vertex AI"]:::ext

  subgraph ACCT["Your cloud account"]
    AGENT["Monte Carlo Agent Β· serverless, in-network<br/>Lambda / Azure Functions / Cloud Run<br/>customer-deployed, outside the cluster"]:::agent
    ING1["Internal load balancer Β· OTLP<br/>NLB (AWS) Β· Gateway API (Azure, GCP)"]:::net
    ING2["Internal load balancer Β· ClickHouse"]:::net

    subgraph K8S["Kubernetes cluster Β· montecarlo namespace<br/>EKS / AKS / GKE"]
      OTEL["OpenTelemetry Collector"]:::node
      LLM["LLM worker"]:::node
      CH[("ClickHouse Β· 2 replicas<br/>across zones")]:::node
      KEEPER["ClickHouse Keeper Β· 3 voters<br/>replication coordination"]:::node
    end
  end

  APPS -->|"OTLP 4318 Β· TLS<br/>(+ gRPC 4317 on AWS)"| ING1
  ING1 --> OTEL
  OTEL -->|"write traces"| CH
  MC -->|"SQL Β· Monte Carlo initiates"| AGENT
  AGENT -->|"forwards SQL Β· 8443 TLS Β· monte_carlo user"| ING2
  ING2 --> CH
  CH <--> KEEPER
  LLM -->|"read / write"| CH
  LLM -->|"evaluations"| LLMSVC

  style ACCT fill:#FFFBEB,stroke:#EA580C,color:#7C2D12
  style K8S fill:#ECFEFF,stroke:#0891B2,color:#164E63

Components

The Terraform module for your cloud deploys the following into your account:

ComponentDescription
Kubernetes cluster + networkA new cluster and network (EKS + VPC, AKS + VNet, or GKE + VPC), or your existing ones. Hosts the data-plane workloads below.
ClickHouseThe trace data store β€” two replicas spread across zones by default. Deployed and managed by the Altinity ClickHouse Operator.
ClickHouse KeeperThree-voter consensus ensemble coordinating table replication between the ClickHouse replicas (see High availability for AWS, Azure, or GCP).
OpenTelemetry CollectorReceives OTLP traces and writes them to ClickHouse.
LLM workerRuns evaluations against trace data using your cloud's LLM service β€” Amazon Bedrock, Microsoft Foundry, or Vertex AI (see Evaluation).
Cluster controllerscert-manager, External Secrets Operator, and external-dns on every cloud. AWS adds the AWS Load Balancer Controller; Azure and GCP add trust-manager (for Gateway backend TLS).
Supporting cloud resourcesTLS certificates and DNS records, workload identities for the platform components (IRSA on AWS, Microsoft Entra Workload ID on Azure, Workload Identity Federation on GCP), and per-user ClickHouse credential secrets in your cloud's secret store.

The Monte Carlo Agent is not part of the module β€” it is deployed separately and pointed at ClickHouse. See Connect to Monte Carlo for AWS, Azure, or GCP.

Ingestion

Instrumented agents send traces to the OpenTelemetry Collector over OTLP, TLS-terminated at an internal load balancer:

  • AWS β€” a Network Load Balancer (L4) accepting OTLP over gRPC on port 4317 or HTTP on port 4318.
  • Azure and GCP β€” an internal Gateway API load balancer (L7) accepting OTLP over HTTP on port 4318 only (no gRPC).

The Collector batches incoming spans and writes them directly into ClickHouse using the ClickHouse exporter; there is no intermediate object storage or data warehouse. On AWS the Collector can additionally ingest OTLP trace objects from S3 buckets (notified via SQS); Azure and GCP are OTLP-push-only.

Evaluation

The platform includes an LLM worker that runs evaluations against trace data. It reads pending work from ClickHouse, invokes a model through your cloud's LLM service in your account, and writes the results back to ClickHouse:

  • AWS β€” Amazon Bedrock. The Bedrock region defaults to your deployment region and is configurable.
  • Azure β€” Microsoft Foundry account the Terraform module provisions (with model deployments and a least-privilege inference role).
  • GCP β€” Vertex AI (serverless, Model-as-a-Service; the models must be enabled in your project's Model Garden β€” see Prerequisites (GCP)).

See the Configuration reference for your cloud (AWS, Azure, or GCP) for the evaluation-backend settings.

End-to-end setup

Getting agent traces into Monte Carlo is a four-step journey. This documentation set covers steps 2–3 (deploy and connect); the links below cover instrumenting your agents and creating monitors.

StepWhat you doWhere
  1. Instrument
Add the Monte Carlo OpenTelemetry SDK to your agents so they emit OTLP traces.Monte Carlo SDK; the instrument-agent skill in the Agent Toolkit
  1. Deploy
Provision the OpenTelemetry Collector and ClickHouse in your cloud account with Terraform.Prerequisites β†’ Installation for your cloud (see Deploying the platform)
  1. Connect
Deploy the Monte Carlo Agent and hand off the ClickHouse connection.Connect to Monte Carlo (AWS, Azure, or GCP)
  1. Monitor
Explore traces and create agent monitors in Monte Carlo.Agent Monitors Overview

Deploying the platform

Work through these pages in order for your cloud:

StepPageCloud
1Prerequisites β€” tooling, account and permissions, domains, and chart accessAWS | Azure | GCP
2Installation β€” configure and apply the Terraform moduleAWS | Azure | GCP
3Connect to Monte Carlo β€” deploy the Monte Carlo Agent and hand off credentialsAWS | Azure | GCP
β€”High availability β€” how the clustered topology works, and day-2 operationsAWS | Azure | GCP
β€”Configuration reference β€” TLS, retention, ClickHouse users, and resource sizingAWS | Azure | GCP
β€”Self-managed Helm install β€” advanced: manage the Helm release yourselfAWS | Azure | GCP
β€”Troubleshooting & FAQ β€” common installation and runtime issuesAll


Did this page help you?