Skip to main content
Monte runs in one of two places: Monte Cloud, which Monte runs, or BYOC, in the team’s own AWS, GCP, or Azure account. Monte runs the control plane (the Console, run history, and the scheduler) in both. The control plane runs in the EU or the US, chosen when the team is created, and the team’s run metadata stays there.

​
Choose Where to Run

Monte Cloud is the shortest path to a first run. With BYOC, the data, the weights, and the compute stay in the team’s account. The Monte operator runs the jobs and deployments that the team requests, and Monte staff never sign in to the team’s account. Monte receives scores, run metadata, and the traces and log lines that the team turns on. Security and Privacy lists what Monte can see in each option.

​
How the Planes Connect

The Monte operator in the team's data plane connects outbound to the scheduler, fetches jobs, and returns status and scores; the GPU node pool, artifact storage, secrets, and the inference endpoint run in the team's account The Monte operator in the team's data plane connects outbound to the scheduler, fetches jobs, and returns status and scores; the GPU node pool, artifact storage, secrets, and the inference endpoint run in the team's account The Monte operator runs in the team’s Kubernetes cluster. It opens an outbound connection to the control plane, fetches job specs, and returns status, scores, and metrics. The control plane holds no credentials to the cluster or to artifact storage, and removing the operator revokes access. Jobs read and write data inside the data plane. Inference requests go from the team’s application to the endpoint and do not pass through the control plane.

​
Connect a Cloud for BYOC

monte cloud connect creates the resources below in the team’s account and installs the operator.
  • GKE: a GPU node pool for jobs and deployments
  • Cloud Storage: artifact storage
  • Artifact Registry: job images
  • Secret Manager: secrets
  • Service account with Workload Identity: the operator’s identity, limited to its namespace, artifact storage, the registry, and the secret store
  • Outbound connection: the operator’s only link to the control plane
With --cluster and --namespace, the command joins an existing cluster: it installs the operator there and creates no cluster or node pool. It still creates artifact storage, the registry, and the secret store.
The command uses the signed-in gcloud, az, or aws session. That account needs Owner, or Editor and Project IAM Admin, on the GCP project; Owner, or Contributor and User Access Administrator, on the Azure resource group; or AdministratorAccess on the AWS account. Request GPU quota for the region before the first job. monte cloud show <name> lists each resource and the scope of the operator’s identity. A team can connect more than one cloud, and each deployment names its cloud with --cloud.