template-level inconsistency: Thanos SSO is included in the authservice values-secret condition at authservice/values.yaml (line 2), and istiod considers Thanos SSO when determining authservice use. But authservice’s actual resources omit that condition at authservice/helmrelease.yaml (line 3), authservice/gitrepository.yaml (line 2), authservice/namespace.yaml (line 2), and authservice/imagepullsecret.yaml (line 2). So enabling only addons.thanos.sso.enabled may render authservice values without rendering the authservice release itself.