diff --git a/network_roles.yaml b/network_roles.yaml
index c29897fc..3d71090d 100644
--- a/network_roles.yaml
+++ b/network_roles.yaml
@@ -12,10 +12,8 @@
            - "influxdb_grafana"
            - "primary-influxdb_grafana"
 # Network and virtual IP address for the Grafana service
-# TODO(pasquier-s): expose the Grafana service on this virtual IP address
-# instead of influxdb
 - id: "grafana"
-  default_mapping: "management"
+  default_mapping: "public"
   properties:
     subnet: true
     gateway: false
diff --git a/node_roles.yaml b/node_roles.yaml
index 3bc2140c..9e3a7831 100644
--- a/node_roles.yaml
+++ b/node_roles.yaml
@@ -2,7 +2,8 @@ influxdb_grafana:
   name: 'InfluxDB Grafana'
   description: 'Install InfluxDB and Grafana'
   has_primary: true
-  public_ip_required: false
+  # A public IP address is required when Grafana is deployed on the public network
+  public_ip_required: true
   weight: 100
   limits:
     max: 3