> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trymonte.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Options

> Monte Cloud and BYOC

Monte runs in one of two places: Monte Cloud, which Monte runs, or BYOC, in the team's own AWS, GCP, or Azure account. Monte runs the control plane (the Console, run history, and the scheduler) in both. The control plane runs in the EU or the US, chosen when the team is created, and the team's run metadata stays there.

## Choose Where to Run

| | Monte Cloud | BYOC |
| - | - | - |
| **GPU instances** | Monte | The team's AWS, GCP, or Azure account |
| **Artifact storage** (environments, datasets, weights) | Monte | The team's account |
| **Serving endpoints** | Monte | The team's account |
| **Region** | EU or US | The region that `--region` sets |
| **Who bills compute** | Monte | The cloud provider |
| **Setup** | `monte login` | `monte login`, then `monte cloud connect` |

Monte Cloud is the shortest path to a first run. With BYOC, the data, the weights, and the compute stay in the team's account. The Monte operator runs the jobs and deployments that the team requests, and Monte staff never sign in to the team's account. Monte receives scores, run metadata, and the traces and log lines that the team turns on. [Security and Privacy](https://docs.trymonte.ai/security.md) lists what Monte can see in each option.

## How the Planes Connect

![The Monte operator in the team's data plane connects outbound to the scheduler, fetches jobs, and returns status and scores; the GPU node pool, artifact storage, secrets, and the inference endpoint run in the team's account](https://mintcdn.com/monte-inc/ZWomWUu3qYoziwnu/images/diagrams/deployment-planes-light.svg?fit=max\&auto=format\&n=ZWomWUu3qYoziwnu\&q=85\&s=9a2f9a23e4df1bae72089f30f2333e08)

The Monte operator runs in the team's Kubernetes cluster. It opens an outbound connection to the control plane, fetches job specs, and returns status, scores, and metrics. The control plane holds no credentials to the cluster or to artifact storage, and removing the operator revokes access.

Jobs read and write data inside the data plane. Inference requests go from the team's application to the endpoint and do not pass through the control plane.

## Connect a Cloud for BYOC

`monte cloud connect` creates the resources below in the team's account and installs the operator.

> [tab] GCP
>
> ```bash theme={null}
> monte cloud connect gcp --project <project-id> --region us-central1
> ```
>
> * **GKE:** a GPU node pool for jobs and deployments
> * **Cloud Storage:** artifact storage
> * **Artifact Registry:** job images
> * **Secret Manager:** secrets
> * **Service account with Workload Identity:** the operator's identity, limited to its namespace, artifact storage, the registry, and the secret store
> * **Outbound connection:** the operator's only link to the control plane

> [tab] Azure
>
> ```bash theme={null}
> monte cloud connect azure \
>   --subscription <subscription-id> \
>   --resource-group monte \
>   --region eastus
> ```
>
> * **AKS:** a GPU node pool for jobs and deployments
> * **Blob Storage:** artifact storage
> * **Container Registry:** job images
> * **Key Vault:** secrets
> * **Managed identity:** the operator's identity, limited to its namespace, artifact storage, the registry, and the secret store
> * **Outbound connection:** the operator's only link to the control plane

> [tab] AWS
>
> ```bash theme={null}
> monte cloud connect aws --account <account-id> --region us-east-1
> ```
>
> * **EKS:** a GPU node pool for jobs and deployments
> * **S3:** artifact storage
> * **ECR:** job images
> * **Secrets Manager:** secrets
> * **IAM role for the operator's service account:** the operator's identity, limited to its namespace, artifact storage, the registry, and the secret store
> * **Outbound connection:** the operator's only link to the control plane

With `--cluster` and `--namespace`, the command joins an existing cluster: it installs the operator there and creates no cluster or node pool. It still creates artifact storage, the registry, and the secret store.

```bash theme={null}
monte cloud connect azure --subscription <subscription-id> --resource-group monte \
  --region eastus --cluster <name> --namespace monte
```

The command uses the signed-in `gcloud`, `az`, or `aws` session. That account needs Owner, or Editor and Project IAM Admin, on the GCP project; Owner, or Contributor and User Access Administrator, on the Azure resource group; or `AdministratorAccess` on the AWS account.

Request GPU quota for the region before the first job. `monte cloud show <name>` lists each resource and the scope of the operator's identity. A team can connect more than one cloud, and each deployment names its cloud with `--cloud`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.