Answer
The monitoring components' ingress hosts need to be configured with the same FQDN used for the main IFS Cloud system URL, not a raw IP address — this is also required so the monitoring endpoints (like Grafana, reached at a path under that same hostname) can share the existing TLS certificate rather than needing their own; set the monitoring installation's host/FQDN parameter to that shared hostname rather than the load balancer's private IP.