The following paragraph is misleading. The url provided by the Endpoints tab is for internal access only.
"Grafana exposes a single endpoint for the Grafana UI, which is shown in the Endpoints tab. The URL of the Grafana UI is http://grafana.grafana.l4lb.thisdcos.directory:3000. As with Prometheus, you may need to use dcos tunnel to access the UI."
A better approach is to include Edge-LB or Marathon-lb and instruct the user how to access Grafana from their own browser. As phrased, we are making the customer have to work hard and open security vulnerabilities with the 'docs tunnel".