feat: automate private tailnet access on cp1

README.md

@@ -229,11 +229,13 @@ Grafana and Prometheus are exposed through a single Tailscale front door backed
 
 ### Access Grafana and Prometheus
 
-Preferred (when Tailscale Operator is healthy):
+Preferred private access:
 
-- Grafana: `http://observability/grafana/` (or `http://observability.<your-tailnet>/grafana/`)
-- Prometheus: `http://observability/prometheus/` (or `http://observability.<your-tailnet>/prometheus/`)
-- Flux UI: `http://observability:9001/` (or `http://observability.<your-tailnet>:9001/`)
+- Grafana: `http://k8s-cluster-cp-1.<your-tailnet>:30080/`
+- Prometheus: `http://k8s-cluster-cp-1.<your-tailnet>:30990/`
+- Flux UI: `http://k8s-cluster-cp-1.<your-tailnet>:30901/`
+
+This access path is bootstrapped automatically by Ansible on `control_plane[0]` using persistent `kubectl port-forward` systemd services plus `tailscale serve`, so it survives cluster rebuilds.
 
 Fallback (port-forward from a tailnet-connected machine):