Skip to main content
Once your BYOC environment is deployed, connect to your indexes over public or private networking, then monitor and maintain the deployment.

​
Connect to your index

How you connect to your indexes for data plane operations like querying, upserting, and fetching vectors depends on your network access mode.
BYOC doesn’t support reading and writing data from the index browser in the Pinecone console.

​
Connect over the public endpoint

Use the host URL from the Pinecone console or the Describe an index API response. For example:
Connect from anywhere using the standard Pinecone SDK or API.

​
Connect over a private endpoint

With public access disabled, you can only connect from within your VPC via private connectivity. Control plane operations (create, delete, list indexes) still work. After deployment, the Pulumi stack outputs include the service name needed to create a private endpoint for your cloud provider. Use this service name to set up private connectivity:
1

Create a VPC endpoint

Follow the instructions in the AWS documentation to create a VPC endpoint for connecting to your indexes via AWS PrivateLink.For Resource configurations, use the VPC endpoint service name from the Pulumi stack outputs.
2

Select network settings

For Network settings, select the VPC for your BYOC deployment.
3

Enable DNS name

In Additional settings, select Enable DNS name to allow you to access your indexes using a DNS name.
Once configured, use the private_host URL from the Pinecone console or the Describe an index API response. For example:

​
Manage BYOC

Pinecone handles upgrades, scaling, and maintenance through the in-cluster agent. You monitor the deployment and tear it down when you no longer need it.

​
Operations and upgrades

Pinecone uses a pull-based model for cluster operations:
  1. When upgrades, scaling, or maintenance are needed, Pinecone queues operations in the control plane.
  2. An agent running in your cluster (deployed automatically during setup) continuously pulls pending operations.
  3. Operations execute locally within your cluster.
  4. Status is reported back to Pinecone for monitoring.
This model ensures Pinecone never needs direct access to your infrastructure. All operations are stored as Kubernetes CRDs, providing a complete audit trail.

​
Monitoring

You can monitor your BYOC deployment through multiple channels:
View index metrics (read/write units, latency, storage) in the Pinecone console. Control plane operations and metrics work regardless of your network access mode.
To use Prometheus, configure your monitoring tool within your VPC to scrape metrics from the cluster. Your Prometheus instance must have network access to the BYOC VPC. The deployment output includes the metrics endpoint URL and port for configuration.
All cluster operations are persisted as Kubernetes CRDs for compliance and auditing:

​
Cleanup

To destroy your BYOC deployment:
Delete all BYOC indexes before destroying the cluster. Indexes cannot be properly terminated if the cluster is destroyed first.
If deletion-protection is enabled (the default), you must either disable it in Pulumi.<stack>.yaml and run pulumi up, or manually delete protected resources via the cloud console before running pulumi destroy:
  • AWS: S3 buckets
  • GCP: GCS buckets
  • Azure: storage accounts