Networking

• Network policy

  The opt-in NetworkPolicy the chart ships — pod-scoped allowlists vs. a namespace-wide default-deny, choosing a policy engine, the ingress and egress traffic JaaS needs, and how to tighten each port.

• Operator unavailable

  The jaas process is running and serving Jsonnet, but its controller manager cannot start, so no JsonnetSnippet is being reconciled

• Service mesh

  The opt-in service-mesh authorization the chart ships — Istio or Linkerd identity-based authorization and mTLS layered over networkPolicy, per-port allowed mesh identities, the non-mesh carve-outs for the apiserver and kubelet, and native passthrough.