enabling the monitoring package does not fully enable authservice
chart/templates/authservice/values.yaml#L2 installs the authservice chart if the monitoring package is enabled.
Despite authservice being deployed, it is not wired up to istio unless addons.authservice.enabled is explicitly set to true. Relevant code for wiring up authservice to istio is chart/templates/istiod/values.yaml#L60-L66.
The result is that if the monitoring package is enabled, but the authservice addon is not also explicitly enabled, then prometheus, alertmanager, and grafana cannot can't be accessed. You get an RBAC: access denied error in the browser because the CUSTOM AuthorizationPolicy installed with the authservice chart references the authservice provider, which hasn't been configured with the istiod chart.
This issue was discovered in a customer engagement by the Engineering Services team.