The updated chart will create a credentials secret by default with empty content unless existingCredentialsSecret is used, but the README references the older key, so its easy to create an external secret but not have it actually mounted to the controller and thus all the policy reference lookups fail.
One way to confirm this condition is to:
kubectl exec -t <controller pod> /bin/cat /credentials/credentials.json
If that returns {} then you're probably using the old method and it isn't in the pod properly.