agent-platform release v4.10.5

An in-cluster jwtAuthentication.jwks.host in a namespace, or on a port, that gateway.jwksEgress does not name now fails the render, under networkPolicy.enabled. That key renders one rule, for one namespace on one port, so a host elsewhere reached nothing while the render stayed green and every request read 401 token uses the unknown key. The message names the value to set. Both guards stand down for a host reached by address: gateway.jwksEgress.external.cidrs non-empty on an external.port equal to the route’s jwks.port, which is how a second in-cluster issuer is carried — the one rule covers one namespace on one port, so two routes on in-cluster hosts in different namespaces cannot both be satisfied. gateway.jwksEgress.podSelector is read by no guard, because a hostname carries no pod labels. An installation whose issuer is dex.giantswarm.svc.cluster.local on 5556, the default, is unaffected.