The local chart never rendered AUTH_GROUP_MAPPING, so tap.auth.groupMapping was silently dropped — SSO groups and the kubeshark-cli SA fell back to AUTH_DEFAULT_ROLE instead of their mapped roles.
tap.ingress.path