infrastructure/addons/observability/prometheus-tailscale-service.yaml

apiVersion: v1
kind: Service
metadata:
  name: prometheus-tailscale
  namespace: observability
  annotations:
    tailscale.com/hostname: prometheus
    tailscale.com/tags: "tag:prod,tag:prometheus"
    tailscale.com/proxy-class: infra-stable
spec:
  type: LoadBalancer
  loadBalancerClass: tailscale
  selector:
    app.kubernetes.io/name: prometheus
    operator.prometheus.io/name: observability-kube-prometh-prometheus
  ports:
    - name: http
      port: 9090
      protocol: TCP
      targetPort: 9090
feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB services matching the existing Rancher pattern. Each service gets its own tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net). 2026-03-31 08:53:28 +00:00			`apiVersion: v1`
			`kind: Service`
			`metadata:`
			`name: prometheus-tailscale`
			`namespace: observability`
			`annotations:`
			`tailscale.com/hostname: prometheus`
fix: Reserve Tailscale service hostnames and tag exposed proxies Reserve grafana/prometheus/flux alongside rancher during rebuild cleanup so stale tailnet devices do not force -1 hostnames. Tag the exposed Tailscale services so operator-managed proxies are provisioned with explicit prod/service tags from the tailnet policy. 2026-04-18 05:48:26 +00:00			`tailscale.com/tags: "tag:prod,tag:prometheus"`
feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB services matching the existing Rancher pattern. Each service gets its own tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net). 2026-03-31 08:53:28 +00:00			`tailscale.com/proxy-class: infra-stable`
			`spec:`
			`type: LoadBalancer`
			`loadBalancerClass: tailscale`
			`selector:`
			`app.kubernetes.io/name: prometheus`
fix: Correct pod selectors for Prometheus and Flux Tailscale services, use Doppler for Grafana creds Prometheus needs operator.prometheus.io/name label selector. Flux UI pods are labeled gitops-server not weave-gitops. Grafana now reads admin creds from Doppler via ExternalSecret instead of hardcoded values. 2026-03-31 22:54:57 +00:00			`operator.prometheus.io/name: observability-kube-prometh-prometheus`
feat: Expose Grafana, Prometheus, and Flux UI via Tailscale LoadBalancer services Replace Ansible port-forwarding + tailscale serve with direct Tailscale LB services matching the existing Rancher pattern. Each service gets its own tailnet hostname (grafana/prometheus/flux.silverside-gopher.ts.net). 2026-03-31 08:53:28 +00:00			`ports:`
			`- name: http`
			`port: 9090`
			`protocol: TCP`
			`targetPort: 9090`