# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "concourse.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified web node(s) name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "concourse.web.fullname" -}}
{{- $name := default "web" .Values.web.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified worker node(s) name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "concourse.worker.fullname" -}}
{{- $name := default "worker" .Values.worker.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified postgresql name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "concourse.postgresql.fullname" -}}
{{- $name := default "postgresql" .Values.postgresql.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "concourse.secret.required" -}}
{{- if .is }}
{{- required (printf "secrets.%s is required because secrets.create is true and %s is true" .key .is) (index .root.Values.secrets .key ) | b64enc | quote }}
{{- else -}}
{{- required (printf "secrets.%s is required because secrets.create is true and %s isn't true" .key .isnt) (index .root.Values.secrets .key ) | b64enc | quote }}
{{- end -}}
{{- end -}}

{{- define "concourse.namespacePrefix" -}}
{{- default (printf "%s-" .Release.Name ) .Values.concourse.web.kubernetes.namespacePrefix -}}
{{- end -}}

{{- define "concourse.are-there-additional-volumes.with-the-name.concourse-work-dir" }}
  {{- range .Values.worker.additionalVolumes }}
    {{- if .name | eq "concourse-work-dir" }}
      {{- .name }}
    {{- end }}
  {{- end }}
{{- end }}


{{/*
Creates the address of the TSA service.
*/}}
{{- define "concourse.web.tsa.address" -}}
{{- $port := .Values.concourse.web.tsa.bindPort -}}
{{ template "concourse.web.fullname" . }}:{{- print $port -}}
{{- end -}}
 # namespace.yaml
{{- if .Values.web.enabled -}}
{{- if and .Values.concourse.web.kubernetes.enabled .Values.concourse.web.kubernetes.createTeamNamespaces -}}
{{- range .Values.concourse.web.kubernetes.teams }}
---
apiVersion: v1
kind: Namespace
metadata:
{{- if $.Values.concourse.web.kubernetes.keepNamespaces }}
  annotations:
    "helm.sh/resource-policy": keep
{{- end }}
  name: {{ template "concourse.namespacePrefix" $ }}{{ . }}
  labels:
    app: {{ template "concourse.web.fullname" $ }}
    chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
    release: "{{ $.Release.Name }}"
    heritage: "{{ $.Release.Service }}"
{{- end }}
{{- end }}
{{- end -}}
 # required-check.yaml
{{ if not (or .Values.web.enabled .Values.worker.enabled) }}
{{- required "Must set either web.enabled or worker.enabled to create a concourse deployment" "" }}
{{ end }}

{{ if and (not .Values.concourse.worker.tsa.hosts) (and (not .Values.web.enabled) (.Values.worker.enabled)) }}
{{- required "concourse.worker.tsa.hosts must be set in case of worker only deployment" "" }}
{{ end }}
 # web-deployment.yaml
{{- if .Values.web.enabled -}}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ .Values.web.replicas }}
{{- if .Values.web.strategy }}
{{ toYaml .Values.web.strategy | indent 2 }}
{{- end }}
  template:
    metadata:
      labels:
        app: {{ template "concourse.web.fullname" . }}
        release: "{{ .Release.Name }}"
        {{- with .Values.web.labels }}
{{ toYaml . | trim | indent 8 }}
        {{- end }}
      {{- if .Values.web.annotations }}
      annotations:
{{ toYaml .Values.web.annotations | indent 8 }}
      {{- end }}
    spec:
    {{- if .Values.web.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.web.nodeSelector | indent 8 }}
    {{- end }}
      serviceAccountName: {{ if .Values.rbac.create }}{{ template "concourse.web.fullname" . }}{{ else }}{{ .Values.rbac.webServiceAccountName }}{{ end }}
      {{- if .Values.web.tolerations }}
      tolerations:
{{ toYaml .Values.web.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.imagePullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      containers:
      {{- if .Values.web.sidecarContainers }}
      {{- toYaml .Values.web.sidecarContainers | nindent 8 }}
      {{- end }}
        - name: {{ template "concourse.web.fullname" . }}
          {{- if .Values.imageDigest }}
          image: "{{ .Values.image }}@{{ .Values.imageDigest }}"
          {{- else }}
          image: "{{ .Values.image }}:{{ .Values.imageTag }}"
          {{- end }}
          imagePullPolicy: {{ .Values.imagePullPolicy | quote }}
          args:
            - web
          env:
            {{- if .Values.concourse.web.clusterName }}
            - name: CONCOURSE_CLUSTER_NAME
              value: {{ .Values.concourse.web.clusterName | quote }}
            {{- end }}
            {{- if .Values.concourse.web.maxConns }}
            - name: CONCOURSE_MAX_CONNS
              value: {{ .Values.concourse.web.maxConns | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableGlobalResources }}
            - name: CONCOURSE_ENABLE_GLOBAL_RESOURCES
              value: {{ .Values.concourse.web.enableGlobalResources | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableLidar }}
            - name: CONCOURSE_ENABLE_LIDAR
              value: {{ .Values.concourse.web.enableLidar | quote }}
            {{- end }}
            {{- if .Values.concourse.web.lidarScannerInterval }}
            - name: CONCOURSE_LIDAR_SCANNER_INTERVAL
              value: {{ .Values.concourse.web.lidarScannerInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.lidarCheckerInterval }}
            - name: CONCOURSE_LIDAR_CHECKER_INTERVAL
              value: {{ .Values.concourse.web.lidarCheckerInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableBuildAuditing }}
            - name: CONCOURSE_ENABLE_BUILD_AUDITING
              value: {{ .Values.concourse.web.enableBuildAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableContainerAuditing }}
            - name: CONCOURSE_ENABLE_CONTAINER_AUDITING
              value: {{ .Values.concourse.web.enableContainerAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableJobAuditing }}
            - name: CONCOURSE_ENABLE_JOB_AUDITING
              value: {{ .Values.concourse.web.enableJobAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enablePipelineAuditing }}
            - name: CONCOURSE_ENABLE_PIPELINE_AUDITING
              value: {{ .Values.concourse.web.enablePipelineAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableResourceAuditing }}
            - name: CONCOURSE_ENABLE_RESOURCE_AUDITING
              value: {{ .Values.concourse.web.enableResourceAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableSystemAuditing }}
            - name: CONCOURSE_ENABLE_SYSTEM_AUDITING
              value: {{ .Values.concourse.web.enableSystemAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableTeamAuditing }}
            - name: CONCOURSE_ENABLE_TEAM_AUDITING
              value: {{ .Values.concourse.web.enableTeamAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableWorkerAuditing }}
            - name: CONCOURSE_ENABLE_WORKER_AUDITING
              value: {{ .Values.concourse.web.enableWorkerAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableVolumeAuditing }}
            - name: CONCOURSE_ENABLE_VOLUME_AUDITING
              value: {{ .Values.concourse.web.enableVolumeAuditing | quote }}
            {{- end }}
            {{- if .Values.concourse.web.enableRedactSecrets }}
            - name: CONCOURSE_ENABLE_REDACT_SECRETS
              value: {{ .Values.concourse.web.enableRedactSecrets | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretRetryAttempts }}
            - name: CONCOURSE_SECRET_RETRY_ATTEMPTS
              value: {{ .Values.concourse.web.secretRetryAttempts | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretRetryInterval }}
            - name: CONCOURSE_SECRET_RETRY_INTERVAL
              value: {{ .Values.concourse.web.secretRetryInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretCacheDuration }}
            - name: CONCOURSE_SECRET_CACHE_DURATION
              value: {{ .Values.concourse.web.secretCacheDuration | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretCacheDurationNotFound }}
            - name: CONCOURSE_SECRET_CACHE_DURATION_NOTFOUND
              value: {{ .Values.concourse.web.secretCacheDurationNotFound | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretCacheEnabled }}
            - name: CONCOURSE_SECRET_CACHE_ENABLED
              value: {{ .Values.concourse.web.secretCacheEnabled | quote }}
            {{- end }}
            {{- if .Values.concourse.web.secretCachePurgeInterval }}
            - name: CONCOURSE_SECRET_CACHE_PURGE_INTERVAL
              value: {{ .Values.concourse.web.secretCachePurgeInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.awsSecretsManager.region }}
            - name: CONCOURSE_AWS_SECRETSMANAGER_REGION
              value: {{ .Values.concourse.web.awsSecretsManager.region | quote }}
            {{- end }}
            {{- if .Values.concourse.web.awsSsm.region }}
            - name: CONCOURSE_AWS_SSM_REGION
              value: {{ .Values.concourse.web.awsSsm.region | quote }}
            {{- end }}
            {{- if .Values.concourse.web.metrics.bufferSize }}
            - name: CONCOURSE_METRICS_BUFFER_SIZE
              value: {{ .Values.concourse.web.metrics.bufferSize | quote }}
            {{- end }}
            {{- if .Values.concourse.web.metrics.captureErrorMetrics }}
            - name: CONCOURSE_CAPTURE_ERROR_METRICS
              value: {{ .Values.concourse.web.metrics.captureErrorMetrics | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.config }}
            - name: CONCOURSE_MAIN_TEAM_CONFIG
              value: {{ .Values.concourse.web.auth.mainTeam.config | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.bitbucketCloud.user }}
            - name: CONCOURSE_MAIN_TEAM_BITBUCKET_CLOUD_USER
              value: {{ .Values.concourse.web.auth.mainTeam.bitbucketCloud.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.bitbucketCloud.team }}
            - name: CONCOURSE_MAIN_TEAM_BITBUCKET_CLOUD_TEAM
              value: {{ .Values.concourse.web.auth.mainTeam.bitbucketCloud.team | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.bitbucketCloud.enabled }}
            - name: CONCOURSE_BITBUCKET_CLOUD_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: bitbucket-cloud-client-id
            - name: CONCOURSE_BITBUCKET_CLOUD_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: bitbucket-cloud-client-secret
            {{- end }}
            {{- if .Values.concourse.web.logLevel }}
            - name: CONCOURSE_LOG_LEVEL
              value: {{ .Values.concourse.web.logLevel | quote }}
            {{- end }}
            {{- if .Values.concourse.web.bindPort }}
            - name: CONCOURSE_BIND_PORT
              value: {{ .Values.concourse.web.bindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.web.bindIp }}
            - name: CONCOURSE_BIND_IP
              value: {{ .Values.concourse.web.bindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.web.localAuth.enabled }}
            - name: CONCOURSE_ADD_LOCAL_USER
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: local-users
            {{- end }}
            {{- if .Values.concourse.web.tls.enabled }}
            - name: CONCOURSE_TLS_BIND_PORT
              value: {{ .Values.concourse.web.tls.bindPort | quote }}
            - name: CONCOURSE_TLS_CERT
              value: "{{ .Values.web.tlsSecretsPath }}/client.cert"
            - name: CONCOURSE_TLS_KEY
              value: "{{ .Values.web.tlsSecretsPath }}/client.key"
            {{- end }}
            {{- if .Values.concourse.web.tls.enabled }}
            - name: CONCOURSE_EXTERNAL_URL
              value: {{ required "Must specify HTTPS external URL when concourse.web.tls.enabled is true" .Values.concourse.web.externalUrl | quote }}
            {{- else }}
            {{- if .Values.concourse.web.externalUrl }}
            - name: CONCOURSE_EXTERNAL_URL
              value: {{ .Values.concourse.web.externalUrl | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.encryption.enabled }}
            - name: CONCOURSE_ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: encryption-key
            - name: CONCOURSE_OLD_ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: old-encryption-key
            {{- end }}
            {{- if .Values.concourse.web.debugBindIp }}
            - name: CONCOURSE_DEBUG_BIND_IP
              value: {{ .Values.concourse.web.debugBindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.web.debugBindPort }}
            - name: CONCOURSE_DEBUG_BIND_PORT
              value: {{ .Values.concourse.web.debugBindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.web.interceptIdleTimeout }}
            - name: CONCOURSE_INTERCEPT_IDLE_TIMEOUT
              value: {{ .Values.concourse.web.interceptIdleTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.web.globalResourceCheckTimeout }}
            - name: CONCOURSE_GLOBAL_RESOURCE_CHECK_TIMEOUT
              value: {{ .Values.concourse.web.globalResourceCheckTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.web.resourceCheckingInterval }}
            - name: CONCOURSE_RESOURCE_CHECKING_INTERVAL
              value: {{ .Values.concourse.web.resourceCheckingInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.resourceTypeCheckingInterval }}
            - name: CONCOURSE_RESOURCE_TYPE_CHECKING_INTERVAL
              value: {{ .Values.concourse.web.resourceTypeCheckingInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.containerPlacementStrategy }}
            - name: CONCOURSE_CONTAINER_PLACEMENT_STRATEGY
              value: {{ .Values.concourse.web.containerPlacementStrategy | quote }}
            {{- end }}
            {{- if .Values.concourse.web.limitActiveTasks }}
            - name: CONCOURSE_MAX_ACTIVE_TASKS_PER_WORKER
              value: {{ .Values.concourse.web.limitActiveTasks | quote }}
            {{- end}}
            {{- if .Values.concourse.web.baggageclaimResponseHeaderTimeout }}
            - name: CONCOURSE_BAGGAGECLAIM_RESPONSE_HEADER_TIMEOUT
              value: {{ .Values.concourse.web.baggageclaimResponseHeaderTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.web.cliArtifactsDir }}
            - name: CONCOURSE_CLI_ARTIFACTS_DIR
              value: {{ .Values.concourse.web.cliArtifactsDir | quote }}
            {{- end }}
            {{- if .Values.concourse.web.logDbQueries }}
            - name: CONCOURSE_LOG_DB_QUERIES
              value: {{ .Values.concourse.web.logDbQueries | quote }}
            {{- end }}
            {{- if .Values.concourse.web.logClusterName }}
            - name: CONCOURSE_LOG_CLUSTER_NAME
              value: {{ .Values.concourse.web.logClusterName | quote }}
            {{- end }}
            {{- if .Values.concourse.web.buildTrackerInterval }}
            - name: CONCOURSE_BUILD_TRACKER_INTERVAL
              value: {{ .Values.concourse.web.buildTrackerInterval | quote  }}
            {{- end }}
            {{- if .Values.concourse.web.defaultBuildLogsToRetain }}
            - name: CONCOURSE_DEFAULT_BUILD_LOGS_TO_RETAIN
              value: {{ .Values.concourse.web.defaultBuildLogsToRetain | quote }}
            {{- end }}
            {{- if .Values.concourse.web.maxBuildLogsToRetain }}
            - name: CONCOURSE_MAX_BUILD_LOGS_TO_RETAIN
              value: {{ .Values.concourse.web.maxBuildLogsToRetain | quote }}
            {{- end }}
            {{- if .Values.concourse.web.defaultDaysToRetainBuildLogs }}
            - name: CONCOURSE_DEFAULT_DAYS_TO_RETAIN_BUILD_LOGS
              value: {{ .Values.concourse.web.defaultDaysToRetainBuildLogs | quote }}
            {{- end }}
            {{- if .Values.concourse.web.maxDaysToRetainBuildLogs }}
            - name: CONCOURSE_MAX_DAYS_TO_RETAIN_BUILD_LOGS
              value: {{ .Values.concourse.web.maxDaysToRetainBuildLogs | quote }}
            {{- end }}
            {{- if .Values.concourse.web.defaultTaskCpuLimit }}
            - name: CONCOURSE_DEFAULT_TASK_CPU_LIMIT
              value: {{ .Values.concourse.web.defaultTaskCpuLimit | quote }}
            {{- end }}
            {{- if .Values.concourse.web.defaultTaskMemoryLimit }}
            - name: CONCOURSE_DEFAULT_TASK_MEMORY_LIMIT
              value: {{ .Values.concourse.web.defaultTaskMemoryLimit | quote }}
            {{- end }}
            {{- if .Values.postgresql.enabled }}
            - name: CONCOURSE_POSTGRES_HOST
              value: {{ template "concourse.postgresql.fullname" . }}
            - name: CONCOURSE_POSTGRES_USER
              value: {{ .Values.postgresql.postgresqlUsername | quote }}
            - name: CONCOURSE_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.postgresql.fullname" . }}
                  key: postgresql-password
            - name: CONCOURSE_POSTGRES_DATABASE
              value: {{ .Values.postgresql.postgresqlDatabase | quote }}
            {{- else }}
            {{- if .Values.concourse.web.postgres.host }}
            - name: CONCOURSE_POSTGRES_HOST
              value: {{ .Values.concourse.web.postgres.host | quote }}
            {{- end }}
            {{- if .Values.concourse.web.postgres.port }}
            - name: CONCOURSE_POSTGRES_PORT
              value: {{ .Values.concourse.web.postgres.port | quote }}
            {{- end }}
            {{- if .Values.concourse.web.postgres.socket }}
            - name: CONCOURSE_POSTGRES_SOCKET
              value: {{ .Values.concourse.web.postgres.socket | quote }}
            {{- end }}
            - name: CONCOURSE_POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: postgresql-user
            - name: CONCOURSE_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: postgresql-password
            {{- if .Values.concourse.web.postgres.sslmode }}
            - name: CONCOURSE_POSTGRES_SSLMODE
              value: {{ .Values.concourse.web.postgres.sslmode | quote }}
            {{- end }}
            {{- if .Values.secrets.postgresCaCert }}
            - name: CONCOURSE_POSTGRES_CA_CERT
              value: "{{ .Values.web.postgresqlSecretsPath }}/ca.cert"
            {{- end }}
            {{- if .Values.secrets.postgresClientCert }}
            - name: CONCOURSE_POSTGRES_CLIENT_CERT
              value: "{{ .Values.web.postgresqlSecretsPath }}/client.cert"
            {{- end }}
            {{- if .Values.secrets.postgresClientKey }}
            - name: CONCOURSE_POSTGRES_CLIENT_KEY
              value: "{{ .Values.web.postgresqlSecretsPath }}/client.key"
            {{- end }}
            {{- if .Values.concourse.web.postgres.connectTimeout }}
            - name: CONCOURSE_POSTGRES_CONNECT_TIMEOUT
              value: {{ .Values.concourse.web.postgres.connectTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.web.postgres.database }}
            - name: CONCOURSE_POSTGRES_DATABASE
              value: {{ .Values.concourse.web.postgres.database | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.kubernetes.enabled }}
            - name: CONCOURSE_KUBERNETES_IN_CLUSTER
              value: "true"
            - name: CONCOURSE_KUBERNETES_NAMESPACE_PREFIX
              value: {{ template "concourse.namespacePrefix" . }}
            {{- else}}
            {{- if .Values.concourse.web.kubernetes.configPath }}
            - name: CONCOURSE_KUBERNETES_CONFIG_PATH
              value: {{ .Values.concourse.web.kubernetes.configPath | quote }}
            {{- end }}
            {{- if .Values.concourse.web.kubernetes.namespacePrefix }}
            - name: CONCOURSE_KUBERNETES_NAMESPACE_PREFIX
              value: {{ .Values.concourse.web.kubernetes.namespacePrefix | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.awsSecretsManager.enabled }}
            {{- if .Values.concourse.web.awsSecretsManager.keyAuth.enabled }}
            - name: CONCOURSE_AWS_SECRETSMANAGER_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-secretsmanager-access-key
            - name: CONCOURSE_AWS_SECRETSMANAGER_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-secretsmanager-secret-key
            {{- if .Values.concourse.web.awsSecretsManager.keyAuth.useSessionToken }}
            - name: CONCOURSE_AWS_SECRETSMANAGER_SESSION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-secretsmanager-session-token
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate }}
            - name: CONCOURSE_AWS_SECRETSMANAGER_PIPELINE_SECRET_TEMPLATE
              value: {{ .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate | quote }}
            {{- end }}
            {{- if .Values.concourse.web.awsSecretsManager.teamSecretTemplate }}
            - name: CONCOURSE_AWS_SECRETSMANAGER_TEAM_SECRET_TEMPLATE
              value: {{ .Values.concourse.web.awsSecretsManager.teamSecretTemplate | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.awsSsm.enabled }}
            {{- if .Values.concourse.web.awsSsm.keyAuth.enabled }}
            - name: CONCOURSE_AWS_SSM_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-ssm-access-key
            - name: CONCOURSE_AWS_SSM_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-ssm-secret-key
            {{- if .Values.concourse.web.awsSsm.keyAuth.useSessionToken }}
            - name: CONCOURSE_AWS_SSM_SESSION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: aws-ssm-session-token
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.awsSsm.pipelineSecretTemplate }}
            - name: CONCOURSE_AWS_SSM_PIPELINE_SECRET_TEMPLATE
              value: {{ .Values.concourse.web.awsSsm.pipelineSecretTemplate | quote }}
            {{- end }}
            {{- if .Values.concourse.web.awsSsm.teamSecretTemplate }}
            - name: CONCOURSE_AWS_SSM_TEAM_SECRET_TEMPLATE
              value: {{ .Values.concourse.web.awsSsm.teamSecretTemplate | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.vault.enabled }}
            - name: CONCOURSE_VAULT_URL
              value: {{ .Values.concourse.web.vault.url | quote }}
            - name: CONCOURSE_VAULT_PATH_PREFIX
              value: {{ .Values.concourse.web.vault.pathPrefix | quote }}
            {{- if.Values.concourse.web.vault.sharedPath }}
            - name: CONCOURSE_VAULT_SHARED_PATH
              value: {{ .Values.concourse.web.vault.sharedPath | quote }}
            {{- end }}
            - name: CONCOURSE_VAULT_AUTH_BACKEND
              value: {{ .Values.concourse.web.vault.authBackend | quote }}
            {{- if .Values.concourse.web.vault.useCaCert }}
            - name: CONCOURSE_VAULT_CA_CERT
              value: "{{ .Values.web.vaultSecretsPath }}/ca.cert"
            {{- end }}
            {{- if eq .Values.concourse.web.vault.authBackend "token" }}
            - name: CONCOURSE_VAULT_CLIENT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: vault-client-token
            {{- end }}
            {{- if eq .Values.concourse.web.vault.authBackend "cert" }}
            - name: CONCOURSE_VAULT_CLIENT_CERT
              value: "{{ .Values.web.vaultSecretsPath }}/client.cert"
            - name: CONCOURSE_VAULT_CLIENT_KEY
              value: "{{ .Values.web.vaultSecretsPath }}/client.key"
            {{- end }}
            {{- if eq .Values.concourse.web.vault.authBackend "approle" }}
            - name: CONCOURSE_VAULT_AUTH_PARAM
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: vault-client-auth-param
            {{- end }}
            {{- if .Values.concourse.web.vault.authBackendMaxTtl }}
            - name: CONCOURSE_VAULT_AUTH_BACKEND_MAX_TTL
              value: {{ .Values.concourse.web.vault.authBackendMaxTtl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.vault.caPath }}
            - name: CONCOURSE_VAULT_CA_PATH
              value: {{ .Values.concourse.web.vault.caPath | quote }}
            {{- end }}
            {{- if .Values.concourse.web.vault.insecureSkipVerify }}
            - name: CONCOURSE_VAULT_INSECURE_SKIP_VERIFY
              value: {{ .Values.concourse.web.vault.insecureSkipVerify | quote }}
            {{- end }}
            {{- if .Values.concourse.web.vault.retryInitial }}
            - name: CONCOURSE_VAULT_RETRY_INITIAL
              value: {{ .Values.concourse.web.vault.retryInitial | quote }}
            {{- end }}
            {{- if .Values.concourse.web.vault.retryMax }}
            - name: CONCOURSE_VAULT_RETRY_MAX
              value: {{ .Values.concourse.web.vault.retryMax | quote }}
            {{- end }}
            {{- if .Values.concourse.web.vault.serverName }}
            - name: CONCOURSE_VAULT_SERVER_NAME
              value: {{ .Values.concourse.web.vault.serverName | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.credhub.enabled }}
            {{- if .Values.concourse.web.credhub.useCaCert }}
            - name: CONCOURSE_CREDHUB_CA_CERT
              value: "{{ .Values.web.credhubSecretsPath }}/ca.cert"
            {{- end }}
            - name: CONCOURSE_CREDHUB_URL
              value: {{ .Values.concourse.web.credhub.url | quote }}
            {{- if.Values.concourse.web.credhub.pathPrefix }}
            - name: CONCOURSE_CREDHUB_PATH_PREFIX
              value: {{ .Values.concourse.web.credhub.pathPrefix | quote }}
            {{- end }}
            {{- if .Values.concourse.web.credhub.insecureSkipVerify }}
            - name: CONCOURSE_CREDHUB_INSECURE_SKIP_VERIFY
              value: {{ .Values.concourse.web.credhub.insecureSkipVerify | quote }}
            {{- end }}
            {{- if (eq .Values.concourse.web.credhub.authenticationMode "secrets") }}
            - name: CONCOURSE_CREDHUB_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: credhub-client-id
            - name: CONCOURSE_CREDHUB_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: credhub-client-secret
            {{- else if (eq .Values.concourse.web.credhub.authenticationMode "mtls") }}
            - name: CONCOURSE_CREDHUB_CLIENT_CERT
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: credhub-client-cert
            - name: CONCOURSE_CREDHUB_CLIENT_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: credhub-client-key
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.noop }}
            - name: CONCOURSE_NOOP
              value: {{ .Values.concourse.web.noop | quote }}
            {{- end }}
            {{- if .Values.concourse.web.staticWorker.enabled }}
            {{- if .Values.concourse.web.staticWorker.gardenUrl }}
            - name: CONCOURSE_WORKER_GARDEN_URL
              value: {{ .Values.concourse.web.staticWorker.gardenUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.staticWorker.baggageclaimUrl }}
            - name: CONCOURSE_WORKER_BAGGAGECLAIM_URL
              value: {{ .Values.concourse.web.staticWorker.baggageclaimUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.staticWorker.resource }}
            - name: CONCOURSE_WORKER_RESOURCE
              value: {{ .Values.concourse.web.staticWorker.resource | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.metrics.hostName }}
            - name: CONCOURSE_METRICS_HOST_NAME
              value: {{ .Values.concourse.web.metrics.hostName | quote }}
            {{- end }}
            {{- if .Values.concourse.web.metrics.attribute }}
            - name: CONCOURSE_METRICS_ATTRIBUTE
              value: {{ .Values.concourse.web.metrics.attribute | quote }}
            {{- end }}
            {{- if .Values.concourse.web.datadog.enabled }}
            - name: CONCOURSE_DATADOG_AGENT_HOST
            {{- if .Values.concourse.web.datadog.agentHostUseHostIP }}
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            {{- else }}
              value: {{ .Values.concourse.web.datadog.agentHost | quote }}
            {{- end }}
            - name: CONCOURSE_DATADOG_AGENT_PORT
              value: {{ .Values.concourse.web.datadog.agentPort | quote }}
            {{- if .Values.concourse.web.datadog.prefix }}
            - name: CONCOURSE_DATADOG_PREFIX
              value: {{ .Values.concourse.web.datadog.prefix | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.influxdb.enabled }}
            - name: CONCOURSE_INFLUXDB_URL
              value: {{ .Values.concourse.web.influxdb.url | quote }}
            {{- if .Values.concourse.web.influxdb.batchSize }}
            - name: CONCOURSE_INFLUXDB_BATCH_SIZE
              value: {{.Values.concourse.web.influxdb.batchSize | quote }}
            {{- end }}
            {{- if .Values.concourse.web.influxdb.batchDuration }}
            - name: CONCOURSE_INFLUXDB_BATCH_DURATION
              value: {{.Values.concourse.web.influxdb.batchDuration | quote }}
            {{- end }}
            - name: CONCOURSE_INFLUXDB_DATABASE
              value: {{ .Values.concourse.web.influxdb.database | quote }}
            - name: CONCOURSE_INFLUXDB_USERNAME
              value: {{ .Values.concourse.web.influxdb.username | quote }}
            - name: CONCOURSE_INFLUXDB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: influxdb-password
            - name: CONCOURSE_INFLUXDB_INSECURE_SKIP_VERIFY
              value: {{ .Values.concourse.web.influxdb.insecureSkipVerify | quote}}
            {{- end }}
            {{- if .Values.concourse.web.emitToLogs }}
            - name: CONCOURSE_EMIT_TO_LOGS
              value: {{ .Values.concourse.web.emitToLogs | quote }}
            {{- end }}
            {{- if .Values.concourse.web.newrelic.enabled }}
            {{- if .Values.concourse.web.newrelic.accountId }}
            - name: CONCOURSE_NEWRELIC_ACCOUNT_ID
              value: {{ .Values.concourse.web.newrelic.accountId | quote }}
            {{- end }}
            {{- if .Values.concourse.web.newrelic.apiKey }}
            - name: CONCOURSE_NEWRELIC_API_KEY
              value: {{ .Values.concourse.web.newrelic.apiKey | quote }}
            {{- end }}
            {{- if .Values.concourse.web.newrelic.servicePrefix }}
            - name: CONCOURSE_NEWRELIC_SERVICE_PREFIX
              value: {{ .Values.concourse.web.newrelic.servicePrefix | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.prometheus.enabled }}
            - name: CONCOURSE_PROMETHEUS_BIND_IP
              value: {{ .Values.concourse.web.prometheus.bindIp | quote }}
            - name: CONCOURSE_PROMETHEUS_BIND_PORT
              value: {{ .Values.concourse.web.prometheus.bindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.web.riemann.enabled }}
            {{- if .Values.concourse.web.riemann.host }}
            - name: CONCOURSE_RIEMANN_HOST
              value: {{ .Values.concourse.web.riemann.host | quote }}
            {{- end }}
            {{- if .Values.concourse.web.riemann.port }}
            - name: CONCOURSE_RIEMANN_PORT
              value: {{ .Values.concourse.web.riemann.port | quote }}
            {{- end }}
            {{- if .Values.concourse.web.riemann.servicePrefix }}
            - name: CONCOURSE_RIEMANN_SERVICE_PREFIX
              value: {{ .Values.concourse.web.riemann.servicePrefix | quote }}
            {{- end }}
            {{- if .Values.concourse.web.riemann.tag }}
            - name: CONCOURSE_RIEMANN_TAG
              value: {{ .Values.concourse.web.riemann.tag | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.xFrameOptions }}
            - name: CONCOURSE_X_FRAME_OPTIONS
              value: {{ .Values.concourse.web.xFrameOptions | quote }}
            {{- end }}
            {{- if .Values.concourse.web.gc.interval }}
            - name: CONCOURSE_GC_INTERVAL
              value: {{ .Values.concourse.web.gc.interval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.gc.oneOffGracePeriod }}
            - name: CONCOURSE_GC_ONE_OFF_GRACE_PERIOD
              value: {{ .Values.concourse.web.gc.oneOffGracePeriod | quote }}
            {{- end }}
            {{- if .Values.concourse.web.gc.missingGracePeriod }}
            - name: CONCOURSE_GC_MISSING_GRACE_PERIOD
              value: {{ .Values.concourse.web.gc.missingGracePeriod | quote }}
            {{- end }}
            {{- if .Values.concourse.web.gc.checkRecyclePeriod }}
            - name: CONCOURSE_GC_CHECK_RECYCLE_PERIOD
              value: {{ .Values.concourse.web.gc.checkRecyclePeriod | quote }}
            {{- end }}
            {{- if .Values.concourse.web.syslog.enabled }}
            {{- if .Values.concourse.web.syslog.hostname }}
            - name: CONCOURSE_SYSLOG_HOSTNAME
              value: {{ .Values.concourse.web.syslog.hostname | quote }}
            {{- end }}
            {{- if .Values.concourse.web.syslog.address }}
            - name: CONCOURSE_SYSLOG_ADDRESS
              value: {{ .Values.concourse.web.syslog.address | quote }}
            {{- end }}
            {{- if .Values.concourse.web.syslog.transport }}
            - name: CONCOURSE_SYSLOG_TRANSPORT
              value: {{ .Values.concourse.web.syslog.transport | quote }}
            {{- end }}
            {{- if .Values.concourse.web.syslog.drainInterval }}
            - name: CONCOURSE_SYSLOG_DRAIN_INTERVAL
              value: {{ .Values.concourse.web.syslog.drainInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.syslog.useCaCert }}
            - name: CONCOURSE_SYSLOG_CA_CERT
              value: "{{ .Values.web.syslogSecretsPath }}/ca.cert"
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.cookieSecure }}
            - name: CONCOURSE_COOKIE_SECURE
              value: {{ .Values.concourse.web.auth.cookieSecure | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.duration }}
            - name: CONCOURSE_AUTH_DURATION
              value: {{ .Values.concourse.web.auth.duration | quote }}
            {{- end }}
            - name: CONCOURSE_SESSION_SIGNING_KEY
              value: "{{ .Values.web.keySecretsPath }}/session_signing_key"
            {{- if .Values.concourse.web.auth.mainTeam.localUser }}
            - name: CONCOURSE_MAIN_TEAM_LOCAL_USER
              value: {{ .Values.concourse.web.auth.mainTeam.localUser | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.cf.org }}
            - name: CONCOURSE_MAIN_TEAM_CF_ORG
              value: {{ .Values.concourse.web.auth.mainTeam.cf.org | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.cf.space }}
            - name: CONCOURSE_MAIN_TEAM_CF_SPACE
              value: {{ .Values.concourse.web.auth.mainTeam.cf.space | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.cf.spaceGuid }}
            - name: CONCOURSE_MAIN_TEAM_CF_SPACE_GUID
              value: {{ .Values.concourse.web.auth.mainTeam.cf.spaceGuid | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.cf.user }}
            - name: CONCOURSE_MAIN_TEAM_CF_USER
              value: {{ .Values.concourse.web.auth.mainTeam.cf.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.github.user }}
            - name: CONCOURSE_MAIN_TEAM_GITHUB_USER
              value: {{ .Values.concourse.web.auth.mainTeam.github.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.github.org }}
            - name: CONCOURSE_MAIN_TEAM_GITHUB_ORG
              value: {{ .Values.concourse.web.auth.mainTeam.github.org | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.github.team }}
            - name: CONCOURSE_MAIN_TEAM_GITHUB_TEAM
              value: {{ .Values.concourse.web.auth.mainTeam.github.team | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.gitlab.user }}
            - name: CONCOURSE_MAIN_TEAM_GITLAB_USER
              value: {{ .Values.concourse.web.auth.mainTeam.gitlab.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.gitlab.group }}
            - name: CONCOURSE_MAIN_TEAM_GITLAB_GROUP
              value: {{ .Values.concourse.web.auth.mainTeam.gitlab.group | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.ldap.user }}
            - name: CONCOURSE_MAIN_TEAM_LDAP_USER
              value: {{ .Values.concourse.web.auth.mainTeam.ldap.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.ldap.group }}
            - name: CONCOURSE_MAIN_TEAM_LDAP_GROUP
              value: {{ .Values.concourse.web.auth.mainTeam.ldap.group | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.oauth.user }}
            - name: CONCOURSE_MAIN_TEAM_OAUTH_USER
              value: {{ .Values.concourse.web.auth.mainTeam.oauth.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.oauth.group }}
            - name: CONCOURSE_MAIN_TEAM_OAUTH_GROUP
              value: {{ .Values.concourse.web.auth.mainTeam.oauth.group | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.oidc.group }}
            - name: CONCOURSE_MAIN_TEAM_OIDC_GROUP
              value: {{ .Values.concourse.web.auth.mainTeam.oidc.group | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.mainTeam.oidc.user }}
            - name: CONCOURSE_MAIN_TEAM_OIDC_USER
              value: {{ .Values.concourse.web.auth.mainTeam.oidc.user | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.cf.enabled }}
            - name: CONCOURSE_CF_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: cf-client-id
            - name: CONCOURSE_CF_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: cf-client-secret
            {{- if .Values.concourse.web.auth.cf.apiUrl }}
            - name: CONCOURSE_CF_API_URL
              value: {{ .Values.concourse.web.auth.cf.apiUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.cf.useCaCert }}
            - name: CONCOURSE_CF_CA_CERT
              value: "{{ .Values.web.authSecretsPath }}/cf_ca.cert"
            {{- end }}
            {{- if .Values.concourse.web.auth.cf.skipSslValidation }}
            - name: CONCOURSE_CF_SKIP_SSL_VALIDATION
              value: {{ .Values.concourse.web.auth.cf.skipSslValidation | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.github.enabled }}
            - name: CONCOURSE_GITHUB_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: github-client-id
            - name: CONCOURSE_GITHUB_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: github-client-secret
            {{- if .Values.concourse.web.auth.github.host }}
            - name: CONCOURSE_GITHUB_HOST
              value: {{ .Values.concourse.web.auth.github.host | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.github.useCaCert }}
            - name: CONCOURSE_GITHUB_CA_CERT
              value: "{{ .Values.web.authSecretsPath }}/github_ca.cert"
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.gitlab.enabled }}
            - name: CONCOURSE_GITLAB_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: gitlab-client-id
            - name: CONCOURSE_GITLAB_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: gitlab-client-secret
            {{- if .Values.concourse.web.auth.gitlab.host }}
            - name: CONCOURSE_GITLAB_HOST
              value: {{ .Values.concourse.web.auth.gitlab.host | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.enabled }}
            {{- if .Values.concourse.web.auth.ldap.bindDn }}
            - name: CONCOURSE_LDAP_BIND_DN
              value: {{ .Values.concourse.web.auth.ldap.bindDn | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.bindPw }}
            - name: CONCOURSE_LDAP_BIND_PW
              value: {{ .Values.concourse.web.auth.ldap.bindPw | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.useCaCert }}
            - name: CONCOURSE_LDAP_CA_CERT
              value: "{{ .Values.web.authSecretsPath }}/ldap_ca.cert"
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.displayName }}
            - name: CONCOURSE_LDAP_DISPLAY_NAME
              value: {{ .Values.concourse.web.auth.ldap.displayName | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchBaseDn }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_BASE_DN
              value: {{ .Values.concourse.web.auth.ldap.groupSearchBaseDn | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchFilter }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_FILTER
              value: {{ .Values.concourse.web.auth.ldap.groupSearchFilter | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchGroupAttr }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_GROUP_ATTR
              value: {{ .Values.concourse.web.auth.ldap.groupSearchGroupAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchNameAttr }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_NAME_ATTR
              value: {{ .Values.concourse.web.auth.ldap.groupSearchNameAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchScope }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_SCOPE
              value: {{ .Values.concourse.web.auth.ldap.groupSearchScope | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.groupSearchUserAttr }}
            - name: CONCOURSE_LDAP_GROUP_SEARCH_USER_ATTR
              value: {{ .Values.concourse.web.auth.ldap.groupSearchUserAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.host }}
            - name: CONCOURSE_LDAP_HOST
              value: {{ .Values.concourse.web.auth.ldap.host | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.insecureNoSsl }}
            - name: CONCOURSE_LDAP_INSECURE_NO_SSL
              value: {{ .Values.concourse.web.auth.ldap.insecureNoSsl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.insecureSkipVerify }}
            - name: CONCOURSE_LDAP_INSECURE_SKIP_VERIFY
              value: {{ .Values.concourse.web.auth.ldap.insecureSkipVerify | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.startTls }}
            - name: CONCOURSE_LDAP_START_TLS
              value: {{ .Values.concourse.web.auth.ldap.startTls | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchBaseDn }}
            - name: CONCOURSE_LDAP_USER_SEARCH_BASE_DN
              value: {{ .Values.concourse.web.auth.ldap.userSearchBaseDn | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchEmailAttr }}
            - name: CONCOURSE_LDAP_USER_SEARCH_EMAIL_ATTR
              value: {{ .Values.concourse.web.auth.ldap.userSearchEmailAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchFilter }}
            - name: CONCOURSE_LDAP_USER_SEARCH_FILTER
              value: {{ .Values.concourse.web.auth.ldap.userSearchFilter | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchIdAttr }}
            - name: CONCOURSE_LDAP_USER_SEARCH_ID_ATTR
              value: {{ .Values.concourse.web.auth.ldap.userSearchIdAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchNameAttr }}
            - name: CONCOURSE_LDAP_USER_SEARCH_NAME_ATTR
              value: {{ .Values.concourse.web.auth.ldap.userSearchNameAttr | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchScope }}
            - name: CONCOURSE_LDAP_USER_SEARCH_SCOPE
              value: {{ .Values.concourse.web.auth.ldap.userSearchScope | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.ldap.userSearchUsername }}
            - name: CONCOURSE_LDAP_USER_SEARCH_USERNAME
              value: {{ .Values.concourse.web.auth.ldap.userSearchUsername | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.enabled }}
            {{- if .Values.concourse.web.auth.oauth.displayName }}
            - name: CONCOURSE_OAUTH_DISPLAY_NAME
              value: {{ .Values.concourse.web.auth.oauth.displayName | quote }}
            {{- end }}
            - name: CONCOURSE_OAUTH_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: oauth-client-id
            - name: CONCOURSE_OAUTH_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: oauth-client-secret
            {{- if .Values.concourse.web.auth.oauth.authUrl }}
            - name: CONCOURSE_OAUTH_AUTH_URL
              value: {{ .Values.concourse.web.auth.oauth.authUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.tokenUrl }}
            - name: CONCOURSE_OAUTH_TOKEN_URL
              value: {{ .Values.concourse.web.auth.oauth.tokenUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.userinfoUrl }}
            - name: CONCOURSE_OAUTH_USERINFO_URL
              value: {{ .Values.concourse.web.auth.oauth.userinfoUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.scope }}
            - name: CONCOURSE_OAUTH_SCOPE
              value: {{ .Values.concourse.web.auth.oauth.scope | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.groupsKey }}
            - name: CONCOURSE_OAUTH_GROUPS_KEY
              value: {{ .Values.concourse.web.auth.oauth.groupsKey | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.useCaCert }}
            - name: CONCOURSE_OAUTH_CA_CERT
              value: "{{ .Values.web.authSecretsPath }}/oauth_ca.cert"
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.skipSslValidation }}
            - name: CONCOURSE_OAUTH_SKIP_SSL_VALIDATION
              value: {{ .Values.concourse.web.auth.oauth.skipSslValidation | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.userNameKey }}
            - name: CONCOURSE_OAUTH_USER_NAME_KEY
              value: {{ .Values.concourse.web.auth.oauth.userNameKey | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oauth.userIdKey }}
            - name: CONCOURSE_OAUTH_USER_ID_KEY
              value: {{ .Values.concourse.web.auth.oauth.userIdKey | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.enabled }}
            {{- if .Values.concourse.web.auth.oidc.displayName }}
            - name: CONCOURSE_OIDC_DISPLAY_NAME
              value: {{ .Values.concourse.web.auth.oidc.displayName | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.issuer }}
            - name: CONCOURSE_OIDC_ISSUER
              value: {{ .Values.concourse.web.auth.oidc.issuer | quote }}
            {{- end }}
            - name: CONCOURSE_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: oidc-client-id
            - name: CONCOURSE_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ template "concourse.web.fullname" . }}
                  key: oidc-client-secret
            {{- if .Values.concourse.web.auth.oidc.scope }}
            - name: CONCOURSE_OIDC_SCOPE
              value: {{ .Values.concourse.web.auth.oidc.scope | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.groupsKey }}
            - name: CONCOURSE_OIDC_GROUPS_KEY
              value: {{ .Values.concourse.web.auth.oidc.groupsKey | quote}}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.hostedDomains }}
            - name: CONCOURSE_OIDC_HOSTED_DOMAINS
              value: {{ .Values.concourse.web.auth.oidc.hostedDomains | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.useCaCert }}
            - name: CONCOURSE_OIDC_CA_CERT
              value: "{{ .Values.web.authSecretsPath }}/oidc_ca.cert"
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.skipSslValidation }}
            - name: CONCOURSE_OIDC_SKIP_SSL_VALIDATION
              value: {{ .Values.concourse.web.auth.oidc.skipSslValidation | quote }}
            {{- end }}
            {{- if .Values.concourse.web.auth.oidc.userNameKey }}
            - name: CONCOURSE_OIDC_USER_NAME_KEY
              value: {{ .Values.concourse.web.auth.oidc.userNameKey | quote }}
            {{- end }}
            {{- end }}
            {{- if .Values.concourse.web.peerAddress }}
            - name: CONCOURSE_PEER_ADDRESS
              value: {{ .Values.concourse.web.peerAddress | quote }}
            {{- else }}
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CONCOURSE_PEER_ADDRESS
              value: "$(POD_IP)"
            {{- end }}
            {{- if .Values.concourse.web.tsa.logLevel }}
            - name: CONCOURSE_TSA_LOG_LEVEL
              value: {{ .Values.concourse.web.tsa.logLevel | quote }}
            {{- end }}
            {{- if .Values.concourse.web.tsa.bindIp }}
            - name: CONCOURSE_TSA_BIND_IP
              value: {{ .Values.concourse.web.tsa.bindIp | quote }}
            {{- end }}
            - name: CONCOURSE_TSA_BIND_PORT
              value: {{ .Values.concourse.web.tsa.bindPort | quote }}
            {{- if .Values.concourse.web.tsa.debugBindIp }}
            - name: CONCOURSE_TSA_DEBUG_BIND_IP
              value: {{ .Values.concourse.web.tsa.debugBindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.web.tsa.debugBindPort }}
            - name: CONCOURSE_TSA_DEBUG_BIND_PORT
              value: {{ .Values.concourse.web.tsa.debugBindPort | quote }}
            {{- end }}
            - name: CONCOURSE_TSA_HOST_KEY
              value: "{{ .Values.web.keySecretsPath }}/host_key"
            - name: CONCOURSE_TSA_AUTHORIZED_KEYS
              value: "{{ .Values.web.keySecretsPath }}/worker_key.pub"
            {{- if .Values.secrets.teamAuthorizedKeys }}
            - name: CONCOURSE_TSA_TEAM_AUTHORIZED_KEYS
              value: "{{- $root := . -}}{{- range $i, $v := .Values.secrets.teamAuthorizedKeys }}{{- if $i}},{{- end}}{{ $v.team }}:{{ $root.Values.web.teamSecretsPath }}/{{ $v.team }}-authorized-key.pub{{- end }}"
            {{- end }}
            {{- if .Values.concourse.web.tsa.atcUrl }}
            - name: CONCOURSE_TSA_ATC_URL
              value: {{ .Values.concourse.web.tsa.atcUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.web.tsa.sessionSigningKey }}
            - name: CONCOURSE_TSA_SESSION_SIGNING_KEY
              value: {{ .Values.concourse.web.tsa.sessionSigningKey | quote }}
            {{- end }}
            {{- if .Values.concourse.web.tsa.heartbeatInterval }}
            - name: CONCOURSE_TSA_HEARTBEAT_INTERVAL
              value: {{ .Values.concourse.web.tsa.heartbeatInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.web.letsEncrypt.enabled }}
            - name: CONCOURSE_ENABLE_LETS_ENCRYPT
              value: {{ .Values.concourse.web.letsEncrypt.enabled | quote }}
            {{- end }}
            {{- if .Values.concourse.web.letsEncrypt.acmeURL }}
            - name: CONCOURSE_LETS_ENCRYPT_ACME_URL
              value: {{ .Values.concourse.web.letsEncrypt.acmeURL | quote }}
            {{- end }}
{{- if .Values.web.env }}
{{ toYaml .Values.web.env | indent 12 }}
{{- end }}
          ports:
            - name: atc
              containerPort: {{ .Values.concourse.web.bindPort }}
            {{- if .Values.concourse.web.tls.enabled }}
            - name: atc-tls
              containerPort: {{ .Values.concourse.web.tls.bindPort }}
            {{- end }}
            - name: tsa
              containerPort: {{ .Values.concourse.web.tsa.bindPort }}
            {{- if .Values.concourse.web.debugBindPort }}
            - name: atc-debug
              containerPort: {{ .Values.concourse.web.debugBindPort }}
            {{- end }}
            {{- if .Values.concourse.web.tsa.bindDebugPort }}
            - name: tsa-debug
              containerPort: {{ .Values.concourse.web.tsa.bindDebugPort }}
            {{- end }}
            {{- if .Values.concourse.web.prometheus.enabled }}
            - name: prometheus
              containerPort: {{ .Values.concourse.web.prometheus.bindPort }}
            {{- end }}
{{- if .Values.web.livenessProbe }}
          livenessProbe:
{{ toYaml .Values.web.livenessProbe | indent 12 }}
{{- end }}
{{- if .Values.web.readinessProbe }}
          readinessProbe:
{{ toYaml .Values.web.readinessProbe | indent 12 }}
{{- end }}
{{- if .Values.web.resources }}
          resources:
{{ toYaml .Values.web.resources | indent 12 }}
{{- end }}
          volumeMounts:
{{- if .Values.web.additionalVolumeMounts }}
{{ toYaml .Values.web.additionalVolumeMounts | indent 12 }}
{{- end }}
            - name: concourse-keys
              mountPath: {{ .Values.web.keySecretsPath | quote }}
              readOnly: true
            {{- if .Values.secrets.teamAuthorizedKeys }}
            - name: team-authorized-keys
              mountPath: {{ .Values.web.teamSecretsPath | quote }}
              readOnly: true
            {{- end }}
            {{- if .Values.concourse.web.tls.enabled }}
            - name: web-tls
              mountPath: {{ .Values.web.tlsSecretsPath | quote }}
              readOnly: true
            {{- end }}
            {{- if .Values.concourse.web.vault.enabled }}
            - name: vault-keys
              mountPath: {{ .Values.web.vaultSecretsPath | quote }}
              readOnly: true
            {{- end }}
            {{- if .Values.concourse.web.credhub.enabled }}
            - name: credhub-keys
              mountPath: {{ .Values.web.credhubSecretsPath | quote }}
              readOnly: true
            {{- end }}
            {{- if not (eq .Values.concourse.web.postgres.sslmode "disable") }}
            - name: postgresql-keys
              mountPath: {{ .Values.web.postgresqlSecretsPath | quote }}
              readOnly: true
            {{- end }}
            {{- if .Values.concourse.web.syslog.enabled }}
            - name: syslog-keys
              mountPath: {{ .Values.web.syslogSecretsPath | quote }}
              readOnly: true
            {{- end }}
            - name: auth-keys
              mountPath: {{ .Values.web.authSecretsPath | quote }}
              readOnly: true
{{- if .Values.web.additionalAffinities }}
      affinity:
{{ toYaml .Values.web.additionalAffinities | indent 8 }}
{{- end }}
      volumes:
{{- if .Values.web.additionalVolumes }}
{{ toYaml .Values.web.additionalVolumes | indent 8 }}
{{- end }}
        - name: concourse-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
              - key: host-key
                path: host_key
              - key: session-signing-key
                path: session_signing_key
              - key: worker-key-pub
                path: worker_key.pub
        {{- if .Values.secrets.teamAuthorizedKeys }}
        - name: team-authorized-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
            {{- range .Values.secrets.teamAuthorizedKeys }}
            - key: {{ .team }}-team-authorized-key
              path: {{ .team }}-authorized-key.pub
            {{- end }}
        {{- end }}
        {{- if .Values.concourse.web.tls.enabled }}
        - name: web-tls
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
              - key: web-tls-cert
                path: client.cert
              - key: web-tls-key
                path: client.key
        {{- end }}
        {{- if .Values.concourse.web.vault.enabled }}
        - name: vault-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
            {{- if .Values.concourse.web.vault.useCaCert }}
              - key: vault-ca-cert
                path: ca.cert
            {{- end }}
            {{- if (eq .Values.concourse.web.vault.authBackend "cert") }}
              - key: vault-client-cert
                path: client.cert
              - key: vault-client-key
                path: client.key
            {{- end }}
        {{- end }}
        {{- if .Values.concourse.web.credhub.enabled }}
        - name: credhub-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
            {{- if .Values.concourse.web.credhub.useCaCert }}
              - key: credhub-ca-cert
                path: ca.cert
            {{- end }}
        {{- end }}
        {{- if not (eq .Values.concourse.web.postgres.sslmode "disable") }}
        - name: postgresql-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
              - key: postgresql-ca-cert
                path: ca.cert
              - key: postgresql-client-cert
                path: client.cert
              - key: postgresql-client-key
                path: client.key
        {{- end }}
        {{- if .Values.concourse.web.syslog.enabled }}
        - name: syslog-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
              - key: syslog-ca-cert
                path: ca.cert
        {{- end }}
        - name: auth-keys
          secret:
            secretName: {{ template "concourse.web.fullname" . }}
            defaultMode: 0400
            items:
              {{- if .Values.concourse.web.auth.cf.useCaCert }}
              - key: cf-ca-cert
                path: cf_ca.cert
              {{- end }}
              {{- if .Values.concourse.web.auth.github.useCaCert }}
              - key: github-ca-cert
                path: github_ca.cert
              {{- end }}
              {{- if .Values.concourse.web.auth.ldap.useCaCert }}
              - key: ldap-ca-cert
                path: ldap_ca.cert
              {{- end }}
              {{- if .Values.concourse.web.auth.oauth.useCaCert }}
              - key: oauth-ca-cert
                path: oauth_ca.cert
              {{- end }}
              {{- if .Values.concourse.web.auth.oidc.useCaCert }}
              - key: oidc-ca-cert
                path: oidc_ca.cert
              {{- end }}
{{- end }}
 # web-ingress.yaml
{{- if .Values.web.enabled -}}
{{- if .Values.web.ingress.enabled -}}
{{- $releaseName := .Release.Name -}}
{{- $serviceName := default "web" .Values.web.nameOverride -}}
{{- $servicePort := .Values.concourse.web.bindPort -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
  annotations:
    {{- range $key, $value := .Values.web.ingress.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
    {{- range .Values.web.ingress.hosts }}
    - host: {{ . }}
      http:
        paths:
          - backend:
              serviceName: {{ printf "%s-%s" $releaseName $serviceName | trunc 63 | trimSuffix "-" }}
              servicePort: {{ $servicePort }}
    {{- end -}}
  {{- if .Values.web.ingress.tls }}
  tls:
{{ toYaml .Values.web.ingress.tls | indent 4 }}
  {{- end -}}
{{- end -}}
{{- end -}}
 # web-role.yaml
{{- if .Values.web.enabled -}}
{{- if .Values.rbac.create -}}
{{- if .Values.concourse.web.kubernetes.enabled -}}
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRole
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
{{- end -}}
{{- end -}}
{{- end -}}
 # web-rolebinding.yaml
{{- if .Values.web.enabled -}}
{{- if .Values.rbac.create -}}
{{- if .Values.concourse.web.kubernetes.enabled -}}
{{- range .Values.concourse.web.kubernetes.teams }}
---
apiVersion: rbac.authorization.k8s.io/{{ $.Values.rbac.apiVersion }}
kind: RoleBinding
metadata:
  name: {{ template "concourse.web.fullname" $ }}-{{ . }}
  namespace: {{ template "concourse.namespacePrefix" $ }}{{ . }}
  labels:
    app: {{ template "concourse.web.fullname" $ }}
    chart: {{ $.Chart.Name }}-{{ $.Chart.Version }}
    heritage: {{ $.Release.Service }}
    release: {{ $.Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "concourse.web.fullname" $ }}
subjects:
- kind: ServiceAccount
  name: {{ template "concourse.web.fullname" $ }}
  namespace: {{ $.Release.Namespace }}
{{- end }}
{{- end -}}
{{- end -}}
{{- end -}}
 # web-secrets.yaml
{{- if .Values.web.enabled  }}
{{- if .Values.secrets.create }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  host-key: {{ .Values.secrets.hostKey | b64enc | quote }}
  session-signing-key: {{ .Values.secrets.sessionSigningKey | b64enc | quote }}
  worker-key-pub: {{ .Values.secrets.workerKeyPub | b64enc | quote }}

  {{- if not .Values.postgresql.enabled }}
  postgresql-user: {{ template "concourse.secret.required" dict "key" "postgresUser" "isnt" "postgresql.enabled" "root" . }}
  postgresql-password: {{ template "concourse.secret.required" dict "key" "postgresPassword" "isnt" "postgresql.enabled" "root" . }}
  postgresql-ca-cert: {{ default "" .Values.secrets.postgresCaCert | b64enc | quote }}
  postgresql-client-cert: {{ default "" .Values.secrets.postgresClientCert | b64enc | quote }}
  postgresql-client-key: {{ default "" .Values.secrets.postgresClientKey | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.encryption.enabled }}
  encryption-key: {{ template "concourse.secret.required" dict "key" "encryptionKey" "is" "concourse.encryption.enabled" "root" . }}
  old-encryption-key: {{ default "" .Values.secrets.oldEncryptionKey | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.localAuth.enabled }}
  local-users: {{ .Values.secrets.localUsers | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.auth.cf.enabled }}
  cf-client-id: {{ template "concourse.secret.required" dict "key" "cfClientId" "is" "concourse.web.auth.cf.enabled" "root" . }}
  cf-client-secret: {{ template "concourse.secret.required" dict "key" "cfClientSecret" "is" "concourse.web.auth.cf.enabled" "root" . }}
  cf-ca-cert: {{ default "" .Values.secrets.cfCaCert | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.auth.bitbucketCloud.enabled }}
  bitbucket-cloud-client-id: {{ template "concourse.secret.required" dict "key" "bitbucketCloudClientId" "is" "concourse.web.auth.bitbucketCloud.enabled" "root" . }}
  bitbucket-cloud-client-secret: {{ template "concourse.secret.required" dict "key" "bitbucketCloudClientSecret" "is" "concourse.web.auth.bitbucketCloud.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.web.auth.github.enabled }}
  github-client-id: {{ template "concourse.secret.required" dict "key" "githubClientId" "is" "concourse.web.auth.github.enabled" "root" . }}
  github-client-secret: {{ template "concourse.secret.required" dict "key" "githubClientSecret" "is" "concourse.web.auth.github.enabled" "root" . }}
  github-ca-cert: {{ default "" .Values.secrets.githubCaCert | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.auth.gitlab.enabled }}
  gitlab-client-id: {{ template "concourse.secret.required" dict "key" "gitlabClientId" "is" "concourse.web.auth.gitlab.enabled" "root" . }}
  gitlab-client-secret: {{ template "concourse.secret.required" dict "key" "gitlabClientSecret" "is" "concourse.web.auth.gitlab.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.web.auth.ldap.enabled }}
  ldap-ca-cert: {{ default "" .Values.secrets.ldapCaCert | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.auth.oauth.enabled }}
  oauth-client-id: {{ template "concourse.secret.required" dict "key" "oauthClientId" "is" "concourse.web.auth.oauth.enabled" "root" . }}
  oauth-client-secret: {{ template "concourse.secret.required" dict "key" "oauthClientSecret" "is" "concourse.web.auth.oauth.enabled" "root" . }}
  oauth-ca-cert: {{ default "" .Values.secrets.oauthCaCert | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.auth.oidc.enabled }}
  oidc-client-id: {{ template "concourse.secret.required" dict "key" "oidcClientId" "is" "concourse.web.auth.oidc.enabled" "root" . }}
  oidc-client-secret: {{ template "concourse.secret.required" dict "key" "oidcClientSecret" "is" "concourse.web.auth.oidc.enabled" "root" . }}
  oidc-ca-cert: {{ default "" .Values.secrets.oidcCaCert | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.tls.enabled }}
  web-tls-cert: {{ template "concourse.secret.required" dict "key" "webTlsCert" "is" "concourse.web.tls.enabled" "root" . }}
  web-tls-key: {{ template "concourse.secret.required" dict "key" "webTlsKey" "is" "concourse.web.tls.enabled" "root" . }}
  {{- end }}
  {{- if .Values.concourse.web.vault.enabled }}
  vault-ca-cert: {{ default "" .Values.secrets.vaultCaCert | b64enc | quote }}
  vault-client-token: {{ default "" .Values.secrets.vaultClientToken | b64enc | quote }}
  vault-client-cert: {{ default "" .Values.secrets.vaultClientCert | b64enc | quote }}
  vault-client-key: {{ default "" .Values.secrets.vaultClientKey | b64enc | quote }}
  vault-client-auth-param: {{ default "" .Values.secrets.vaultAuthParam | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.credhub.enabled }}
  credhub-ca-cert: {{ default "" .Values.secrets.credhubCaCert | b64enc | quote }}
  {{- if eq .Values.concourse.web.credhub.authenticationMode "secrets" }}
  credhub-client-id: {{ template "concourse.secret.required" dict "key" "credhubClientId" "is" "authenticationMode set to 'secrets' with concourse.web.credhub.enabled" "root" . }}
  credhub-client-secret: {{ template "concourse.secret.required" dict "key" "credhubClientSecret" "is" "authenticationMode set to 'secrets' with concourse.web.credhub.enabled" "root" . }}
  {{- else if eq .Values.concourse.web.credhub.authenticationMode "mtls" }}
  credhub-client-cert: {{ template "concourse.secret.required" dict "key" "credhubClientCert" "is" "authenticationMode set to 'mtls' with concourse.web.credhub.enabled" "root" . }}
  credhub-client-key: {{ template "concourse.secret.required" dict "key" "credhubClientKey" "is" "authenticationMode set to 'mtls' with concourse.web.credhub.enabled" "root" . }}
  {{- else }}
  {{- required (printf "value %s is not recognized as an option for concourse.web.credhub.authenticationMode" .Values.concourse.web.credhub.authenticationMode) "" }}
  {{- end }}
  {{- end }}
  {{- if .Values.concourse.web.awsSsm.enabled }}
  aws-ssm-access-key: {{ default "" .Values.secrets.awsSsmAccessKey | b64enc | quote }}
  aws-ssm-secret-key: {{ default "" .Values.secrets.awsSsmSecretKey | b64enc | quote }}
  {{- if .Values.secrets.awsSsmSessionToken }}
  aws-ssm-session-token: {{ .Values.secrets.awsSsmSessionToken | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if .Values.concourse.web.awsSecretsManager.enabled }}
  aws-secretsmanager-access-key: {{ default "" .Values.secrets.awsSecretsmanagerAccessKey | b64enc | quote }}
  aws-secretsmanager-secret-key: {{ default "" .Values.secrets.awsSecretsmanagerSecretKey | b64enc | quote }}
  {{- if .Values.secrets.awsSecretsmanagerSessionToken }}
  aws-secretsmanager-session-token: {{ .Values.secrets.awsSecretsmanagerSessionToken | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if .Values.concourse.web.influxdb.enabled }}
  influxdb-password: {{ default "" .Values.secrets.influxdbPassword | b64enc | quote }}
  {{- end }}
  {{- if .Values.concourse.web.syslog.enabled }}
  syslog-ca-cert: {{ default "" .Values.secrets.syslogCaCert | b64enc | quote }}
  {{- end }}
  {{- range .Values.secrets.teamAuthorizedKeys}}
  {{ .team }}-team-authorized-key: {{ .key | b64enc | quote }}
  {{- end}}
{{- end }}
{{- end }}
 # web-serviceaccount.yaml
{{- if .Values.web.enabled -}}
{{- if .Values.rbac.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
{{- end -}}
{{- end }}
 # web-svc.yaml
{{- if .Values.web.enabled -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "concourse.web.fullname" . }}
  labels:
    app: {{ template "concourse.web.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    {{- range $key, $value := .Values.web.service.labels }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- if or .Values.web.service.annotations .Values.concourse.web.prometheus.enabled }}
  annotations:
    {{- range $key, $value := .Values.web.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
    {{- if .Values.concourse.web.prometheus.enabled }}
    prometheus.io/scrape: "true"
    prometheus.io/port: {{ .Values.concourse.web.prometheus.bindPort | quote }}
    {{- end }}
  {{- end }}
spec:
  type: {{ .Values.web.service.type }}
  {{ if .Values.web.service.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
    {{- range .Values.web.service.loadBalancerSourceRanges }}
    - {{ . }}
    {{- end }}
  {{ end }}
  {{ if and (eq "LoadBalancer" .Values.web.service.type) .Values.web.service.loadBalancerIP }}
  loadBalancerIP: {{ .Values.web.service.loadBalancerIP }}
  {{ end }}
  ports:
    - name: atc
      port: {{ .Values.concourse.web.bindPort }}
      targetPort: atc
      {{ if and (eq "NodePort" .Values.web.service.type) .Values.web.service.atcNodePort }}
      nodePort: {{ .Values.web.service.atcNodePort}}
      {{ end }}
    {{- if .Values.concourse.web.tls.enabled }}
    - name: atc-tls
      port: {{ .Values.concourse.web.tls.bindPort }}
      targetPort: atc-tls
      {{ if and (eq "NodePort" .Values.web.service.type) .Values.web.service.atcTlsNodePort }}
      nodePort: {{ .Values.web.service.atcTlsNodePort}}
      {{ end }}
    {{- end }}
    - name: tsa
      port: {{ .Values.concourse.web.tsa.bindPort }}
      targetPort: tsa
      {{ if and (eq "NodePort" .Values.web.service.type) .Values.web.service.tsaNodePort }}
      nodePort: {{ .Values.web.service.tsaNodePort}}
      {{ end }}
    {{- if .Values.concourse.web.prometheus.enabled }}
    - name: prometheus
      port: {{ .Values.concourse.web.prometheus.bindPort }}
      targetPort: prometheus
    {{- end }}
  selector:
    app: {{ template "concourse.web.fullname" . }}
{{- end }}
 # worker-policy.yaml
{{- if .Values.worker.enabled -}}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  minAvailable: {{ .Values.worker.minAvailable }}
  selector:
    matchLabels:
      app: {{ template "concourse.worker.fullname" . }}
{{- end }}
 # worker-prestop-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
data:
  pre-stop-hook.sh: |
    #!/bin/bash
    kill -s {{ .Values.concourse.worker.shutdownSignal }} 1
    while [ -e /proc/1 ]; do sleep 1; done

 # worker-role.yaml
{{- if .Values.worker.enabled -}}
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: Role
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
rules:
- apiGroups:
  - extensions
  resources:
  - podsecuritypolicies
  resourceNames:
  - privileged
  verbs:
  - use
{{- end -}}
{{- end }}
 # worker-rolebinding.yaml
{{- if .Values.worker.enabled -}}
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: RoleBinding
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "concourse.worker.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ template "concourse.worker.fullname" . }}
{{- end -}}
{{- end }}
 # worker-secrets.yaml
{{- if .Values.worker.enabled  }}
{{- if .Values.secrets.create }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
  host-key-pub: {{ .Values.secrets.hostKeyPub | b64enc | quote }}
  worker-key: {{ .Values.secrets.workerKey | b64enc | quote }}
{{- end }}
{{- end }}
 # worker-serviceaccount.yaml
{{- if .Values.worker.enabled -}}
{{- if .Values.rbac.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
{{- end -}}
{{- end }}
 # worker-statefulset.yaml
{{- if .Values.worker.enabled -}}
apiVersion: apps/v1beta1
kind: StatefulSet
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  serviceName: {{ template "concourse.worker.fullname" . }}
  replicas: {{ .Values.worker.replicas }}
  template:
    metadata:
      labels:
        app: {{ template "concourse.worker.fullname" . }}
        release: "{{ .Release.Name }}"
        {{- with .Values.worker.labels }}
{{ toYaml . | trim | indent 8 }}
        {{- end }}
      {{- if .Values.worker.annotations }}
      annotations:
{{ toYaml .Values.worker.annotations | indent 8 }}
      {{- end }}
    spec:
    {{- if .Values.worker.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.worker.nodeSelector | indent 8 }}
    {{- end }}
      serviceAccountName: {{ if .Values.rbac.create }}{{ template "concourse.worker.fullname" . }}{{ else }}{{ .Values.rbac.workerServiceAccountName }}{{ end }}
      {{- if .Values.worker.tolerations }}
      tolerations:
{{ toYaml .Values.worker.tolerations | indent 8 }}
      {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.imagePullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      {{- if .Values.worker.terminationGracePeriodSeconds }}
      terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
      {{- end }}
      {{- if .Values.worker.cleanUpWorkDirOnStart }}
      initContainers:
        - name: {{ template "concourse.worker.fullname" . }}-init-rm
          {{- if .Values.imageDigest }}
          image: "{{ .Values.image }}@{{ .Values.imageDigest }}"
          {{- else }}
          image: "{{ .Values.image }}:{{ .Values.imageTag }}"
          {{- end }}
          imagePullPolicy: {{ .Values.imagePullPolicy | quote }}
          securityContext:
            privileged: true
          command:
            - /bin/bash
          args:
            - -ce
            - |-
              for v in $((btrfs subvolume list --sort=-ogen "{{ .Values.concourse.worker.workDir }}" || true) | awk '{print $9}'); do
                (btrfs subvolume show "{{ .Values.concourse.worker.workDir }}/$v" && btrfs subvolume delete "{{ .Values.concourse.worker.workDir }}/$v") || true
              done
              rm -rf "{{ .Values.concourse.worker.workDir }}"/*
          volumeMounts:
            - name: concourse-work-dir
              mountPath: {{ .Values.concourse.worker.workDir | quote }}
      {{- end }}
      containers:
      {{- if .Values.worker.sidecarContainers }}
      {{- toYaml .Values.worker.sidecarContainers | nindent 8 }}
      {{- end }}
        - name: {{ template "concourse.worker.fullname" . }}
          {{- if .Values.imageDigest }}
          image: "{{ .Values.image }}@{{ .Values.imageDigest }}"
          {{- else }}
          image: "{{ .Values.image }}:{{ .Values.imageTag }}"
          {{- end }}
          imagePullPolicy: {{ .Values.imagePullPolicy | quote }}
          args:
            - worker
{{- if .Values.worker.livenessProbe }}
          livenessProbe:
{{ toYaml .Values.worker.livenessProbe | indent 12 }}
{{- end }}
{{- if .Values.worker.readinessProbe }}
          readinessProbe:
{{ toYaml .Values.worker.readinessProbe | indent 12 }}
{{- end }}
          lifecycle:
            preStop:
              exec:
                command:
                  - "/bin/bash"
                  - "/pre-stop-hook.sh"
          env:
            {{- if .Values.concourse.worker.rebalanceInterval }}
            - name: CONCOURSE_REBALANCE_INTERVAL
              value: {{ .Values.concourse.worker.rebalanceInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.sweepInterval }}
            - name: CONCOURSE_SWEEP_INTERVAL
              value: {{ .Values.concourse.worker.sweepInterval | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.resourceTypes }}
            - name: CONCOURSE_RESOURCE_TYPES
              value: {{ .Values.concourse.worker.resourceTypes | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.connectionDrainTimeout }}
            - name: CONCOURSE_CONNECTION_DRAIN_TIMEOUT
              value: {{ .Values.concourse.worker.connectionDrainTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.healthcheckBindIp }}
            - name: CONCOURSE_HEALTHCHECK_BIND_IP
              value: {{ .Values.concourse.worker.healthcheckBindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.healthcheckBindPort }}
            - name: CONCOURSE_HEALTHCHECK_BIND_PORT
              value: {{ .Values.concourse.worker.healthcheckBindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.healthcheckTimeout }}
            - name: CONCOURSE_HEALTHCHECK_TIMEOUT
              value: {{ .Values.concourse.worker.healthcheckTimeout | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.name }}
            - name: CONCOURSE_NAME
              value: {{ .Values.concourse.worker.name | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.tag }}
            - name: CONCOURSE_TAG
              value: {{ .Values.concourse.worker.tag | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.team }}
            - name: CONCOURSE_TEAM
              value: {{ .Values.concourse.worker.team | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.http_proxy }}
            - name: http_proxy
              value: {{ .Values.concourse.worker.http_proxy | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.https_proxy }}
            - name: https_proxy
              value: {{ .Values.concourse.worker.https_proxy | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.no_proxy }}
            - name: no_proxy
              value: {{ .Values.concourse.worker.no_proxy | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.ephemeral }}
            - name: CONCOURSE_EPHEMERAL
              value: {{ .Values.concourse.worker.ephemeral | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.debugBindIp }}
            - name: CONCOURSE_DEBUG_BIND_IP
              value: {{ .Values.concourse.worker.debugBindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.debugBindPort }}
            - name: CONCOURSE_DEBUG_BIND_PORT
              value: {{ .Values.concourse.worker.debugBindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.certsDir }}
            - name: CONCOURSE_CERTS_DIR
              value: {{ .Values.concourse.worker.certsDir | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.workDir }}
            - name: CONCOURSE_WORK_DIR
              value: {{ .Values.concourse.worker.workDir | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.bindIp }}
            - name: CONCOURSE_BIND_IP
              value: {{ .Values.concourse.worker.bindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.bindPort }}
            - name: CONCOURSE_BIND_PORT
              value: {{ .Values.concourse.worker.bindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.logLevel }}
            - name: CONCOURSE_LOG_LEVEL
              value: {{ .Values.concourse.worker.logLevel | quote }}
            {{- end }}
            {{ if not .Values.web.enabled }}
            - name: CONCOURSE_TSA_HOST
              value: "{{- range $i, $tsaHost := .Values.concourse.worker.tsa.hosts }}{{- if $i }},{{ end }}{{- $tsaHost }}{{- end -}}"
            {{ else }}
            - name: CONCOURSE_TSA_HOST
              value: "{{ template "concourse.web.tsa.address" . -}}"
            {{- end }}
            - name: CONCOURSE_TSA_PUBLIC_KEY
              value: "{{ .Values.worker.keySecretsPath }}/host_key.pub"
            - name: CONCOURSE_TSA_WORKER_PRIVATE_KEY
              value: "{{ .Values.worker.keySecretsPath }}/worker_key"
            {{- if .Values.concourse.worker.externalGardenUrl }}
            - name: CONCOURSE_EXTERNAL_GARDEN_URL
              value: {{ .Values.concourse.worker.externalGardenUrl | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.garden.useHoudini }}
            - name: CONCOURSE_GARDEN_USE_HOUDINI
              value: {{ .Values.concourse.worker.garden.useHoudini | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.garden.bin }}
            - name: CONCOURSE_GARDEN_BIN
              value: {{ .Values.concourse.worker.garden.bin | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.garden.config }}
            - name: CONCOURSE_GARDEN_CONFIG
              value: {{ .Values.concourse.worker.garden.config | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.garden.dnsProxyEnable }}
            - name: CONCOURSE_GARDEN_DNS_PROXY_ENABLE
              value: {{ .Values.concourse.worker.garden.dnsProxyEnable | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.logLevel }}
            - name: CONCOURSE_BAGGAGECLAIM_LOG_LEVEL
              value: {{ .Values.concourse.worker.baggageclaim.logLevel | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.bindIp }}
            - name: CONCOURSE_BAGGAGECLAIM_BIND_IP
              value: {{ .Values.concourse.worker.baggageclaim.bindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.bindPort }}
            - name: CONCOURSE_BAGGAGECLAIM_BIND_PORT
              value: {{ .Values.concourse.worker.baggageclaim.bindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.debugBindIp }}
            - name: CONCOURSE_BAGGAGECLAIM_DEBUG_BIND_IP
              value: {{ .Values.concourse.worker.baggageclaim.debugBindIp | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.debugBindPort }}
            - name: CONCOURSE_BAGGAGECLAIM_DEBUG_BIND_PORT
              value: {{ .Values.concourse.worker.baggageclaim.debugBindPort | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.volumes }}
            - name: CONCOURSE_BAGGAGECLAIM_VOLUMES
              value: {{ .Values.concourse.worker.baggageclaim.volumes | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.driver }}
            - name: CONCOURSE_BAGGAGECLAIM_DRIVER
              value: {{ .Values.concourse.worker.baggageclaim.driver | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.btrfsBin }}
            - name: CONCOURSE_BAGGAGECLAIM_BTRFS_BIN
              value: {{ .Values.concourse.worker.baggageclaim.btrfsBin | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.mkfsBin }}
            - name: CONCOURSE_BAGGAGECLAIM_MKFS_BIN
              value: {{ .Values.concourse.worker.baggageclaim.mkfsBin | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.overlaysDir }}
            - name: CONCOURSE_BAGGAGECLAIM_OVERLAYS_DIR
              value: {{ .Values.concourse.worker.baggageclaim.overlaysDir | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.baggageclaim.disableUserNamespaces }}
            - name: CONCOURSE_BAGGAGECLAIM_DISABLE_USER_NAMESPACES
              value: {{ .Values.concourse.worker.baggageclaim.disableUserNamespaces | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.volumeSweeperMaxInFlight }}
            - name: CONCOURSE_VOLUME_SWEEPER_MAX_IN_FLIGHT
              value: {{ .Values.concourse.worker.volumeSweeperMaxInFlight | quote }}
            {{- end }}
            {{- if .Values.concourse.worker.containerSweeperMaxInFlight }}
            - name: CONCOURSE_CONTAINER_SWEEPER_MAX_IN_FLIGHT
              value: {{ .Values.concourse.worker.containerSweeperMaxInFlight | quote }}
            {{- end }}
{{- if .Values.worker.env }}
{{ toYaml .Values.worker.env | indent 12 }}
{{- end }}
          ports:
            - name: worker-hc
              containerPort: {{ .Values.concourse.worker.healthcheckBindPort }}
{{- if .Values.worker.resources }}
          resources:
{{ toYaml .Values.worker.resources | indent 12 }}
{{- end }}
          securityContext:
            privileged: true
          volumeMounts:
            - name: concourse-keys
              mountPath: {{ .Values.worker.keySecretsPath | quote }}
              readOnly: true
            - name: concourse-work-dir
              mountPath: {{ .Values.concourse.worker.workDir | quote }}
            - name: pre-stop-hook
              mountPath: /pre-stop-hook.sh
              subPath: pre-stop-hook.sh

{{- if .Values.worker.additionalVolumeMounts }}
{{ toYaml .Values.worker.additionalVolumeMounts | indent 12 }}
{{- end }}
      affinity:
{{- if .Values.worker.additionalAffinities }}
{{ toYaml .Values.worker.additionalAffinities | indent 8 }}
{{- end }}
        podAntiAffinity:
          {{- if .Values.worker.hardAntiAffinity }}
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app: {{ template "concourse.worker.fullname" . }}
                release: {{ .Release.Name | quote }}
            topologyKey: kubernetes.io/hostname
          {{- else }}
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  app: {{ template "concourse.worker.fullname" . }}
                  release: {{ .Release.Name | quote }}
          {{- end }}
      volumes:
{{- if .Values.worker.additionalVolumes }}
{{ toYaml .Values.worker.additionalVolumes | indent 8 }}
{{- end }}
        - name: pre-stop-hook
          configMap:
            name: {{ template "concourse.worker.fullname" . }}
        - name: concourse-keys
          secret:
            secretName: {{ template "concourse.worker.fullname" . }}
            defaultMode: 0400
            items:
              - key: host-key-pub
                path: host_key.pub
              - key: worker-key
                path: worker_key
  {{- if .Values.persistence.enabled }}
  volumeClaimTemplates:
    - metadata:
        name: concourse-work-dir
      spec:
        accessModes:
          - {{ .Values.persistence.worker.accessMode | quote }}
        resources:
          requests:
            storage: {{ .Values.persistence.worker.size | quote }}
      {{- if .Values.persistence.worker.storageClass }}
      {{- if (eq "-" .Values.persistence.worker.storageClass) }}
        storageClassName: ""
      {{- else }}
        storageClassName: "{{ .Values.persistence.worker.storageClass }}"
      {{- end }}
      {{- end }}
  {{- else }}
      {{ if include "concourse.are-there-additional-volumes.with-the-name.concourse-work-dir" . | not }}
        - name: concourse-work-dir
          emptyDir:
            {{- if .Values.worker.emptyDirSize }}
            sizeLimit: {{ .Values.worker.emptyDirSize | quote }}
            {{- end }}
      {{- end }}
  {{- end }}
  {{- if semverCompare "^1.7-0" .Capabilities.KubeVersion.GitVersion }}
  updateStrategy:
    type: {{ .Values.worker.updateStrategy }}
  {{- end }}
  {{- if .Values.worker.podManagementPolicy }}
  podManagementPolicy: {{ .Values.worker.podManagementPolicy }}
  {{- end }}
{{- end }}
 # worker-svc.yaml
{{- if .Values.worker.enabled -}}
## A Headless Service is required when using a StatefulSet
## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/
##
apiVersion: v1
kind: Service
metadata:
  name: {{ template "concourse.worker.fullname" . }}
  labels:
    app: {{ template "concourse.worker.fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  type: ClusterIP
  clusterIP: None
  ## We do NOT expose any port as workers will forward connections with the ATC through a TSA reverse-tunnel
  ## ref: https://concourse-ci.org/architecture.html#architecture-worker
  ##
  ports: []
  selector:
    app: {{ template "concourse.worker.fullname" . }}
{{- end }}

## Default values for Concourse Helm Chart.
## This is a YAML-formatted file.
## Declare variables to be passed into your templates.

## Provide a name in place of `concourse` for `app:` labels
##
nameOverride:

## Provide a name to substitute for the full names of resources
##
fullnameOverride:

## Concourse image to use in both Web and Worker containers.
##
image: concourse/concourse

## Concourse image tag.
## ps.: release candidates are published under `concourse/concourse-rc` instead
##      of `concourse/concourse`.
## Ref: https://hub.docker.com/r/concourse/concourse/tags/
##
imageTag: "5.6.0"

## Specific image digest to use in place of a tag.
## Ref: https://kubernetes.io/docs/concepts/configuration/overview/#container-images
##
imageDigest:

## Specify a imagePullPolicy regarding the fetching of container images.
## Ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
imagePullPolicy: IfNotPresent

## Array of imagePullSecrets to allow pulling the Concourse image from private registries.
## ps.: secrets must be manually created in the namespace.
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
##
## Example:
##
##   imagePullSecrets:
##    - myRegistryKeySecretName
##
imagePullSecrets: []


## Configuration values for the Concourse application (worker and web components).
## The values specified here are almost direct references to the flags under the
## `concourse web` and `concourse worker` commands.
##
concourse:
  ## Configurations for the `web` component based on the possible flags configurable
  ## through the `concourse web` command.
  ##
  web:
    ## A name for this Concourse cluster, to be displayed on the dashboard page.
    ##
    clusterName:

    ## The maximum number of open connections for a connection pool
    ##
    maxConns:

    ## Enable equivalent resources across pipelines and teams to share a single version history.
    ## Ref: https://concourse-ci.org/global-resources.html
    ##
    enableGlobalResources: true

    ## The Future™ of resource checking.
    ##
    enableLidar:

    ## Interval on which the resource scanner will run to see if new checks need
    ## to be scheduled.
    ##
    lidarScannerInterval:

    ## Interval on which the resource checker runs any scheduled checks.
    ##
    lidarCheckerInterval:

    ## Enable auditing for all api requests connected to builds.
    ##
    enableBuildAuditing: false

    ## Enable auditing for all api requests connected to containers.
    ##
    enableContainerAuditing: false

    ## Enable auditing for all api requests connected to jobs.
    ##
    enableJobAuditing: false

    ## Enable auditing for all api requests connected to pipelines.
    ##
    enablePipelineAuditing: false

    ## Enable auditing for all api requests connected to resources.
    ##
    enableResourceAuditing: false

    ## Enable auditing for all api requests connected to system transactions.
    ##
    enableSystemAuditing: false

    ## Enable auditing for all api requests connected to teams.
    ##
    enableTeamAuditing: false

    ## Enable auditing for all api requests connected to workers.
    ##
    enableWorkerAuditing: false

    ## Enable auditing for all api requests connected to volumes.
    ##
    enableVolumeAuditing: false

    ## Enable redacting secrets in build logs.
    ##
    enableRedactSecrets:

    ## The number of attempts secret will be retried to be fetched,
    ## in case a retryable error happens.
    ##
    secretRetryAttempts: 5

    ## The interval between secret retry retieval attempts.
    ##
    secretRetryInterval: 1s

    ## Enable in-memory cache for secrets.
    ##
    secretCacheEnabled: false

    ## If the cache is enabled, secret values will be cached for not longer
    ## than this duration (it can be less, if underlying secret lease time
    ## is smaller).
    ##
    secretCacheDuration:

    ## If the cache is enabled, secret not found responses will be cached for
    ## this duration.
    ##
    secretCacheDurationNotFound:

    ## If the cache is enabled, expired items will be removed on this internal.
    ##
    secretCachePurgeInterval:

    ## Minimum level of logs to see. Possible options: debug, info, error.
    ##
    logLevel: info

    ## IP address on which to listen for HTTP traffic (web UI and API).
    ##
    bindIp: 0.0.0.0

    ## Port on which to listen for HTTP traffic (web UI and API).
    ##
    bindPort: 8080

    ## TLS configuration for the web component to be able to serve HTTPS traffic.
    ## Once enabled, consumes the certificates set via secrets (`web-tls-cert` and
    ## `web-tls-key`).
    ##
    tls:

      ## Enable serving HTTPS traffic directly through the web component.
      ##
      enabled: false

      ## Port on which to listen for HTTPS traffic.
      ##
      bindPort: 443

    ## URL used to reach any ATC from the outside world.
    ## This is *very* important for a proper authentication workflow as
    ## browser redirects are based on the value set here.
    ##
    ## Example: http://ci.concourse-ci.org
    ##
    externalUrl:

    encryption:
      ## Enable encryption of pipeline configuration. Encryption keys can be set via secrets
      ## (`encryption-key` and `old-encryption-key` fields).
      ## Ref: https://concourse-ci.org/encryption.html
      ##
      enabled: false

    localAuth:
      ## Enable the use of local authentication (basic auth).
      ## Once enabled, users configured through `local-users` (secret)
      ## are able to authenticate.
      ##
      ## Local users can be individually added to the `main` team by setting
      ## `concourse.web.auth.mainTeam.localUser` with a comma-separated list
      ## of ids.
      ##
      ## Ref: https://concourse-ci.org/install.html#local-auth-config
      ##
      enabled: true

    ## IP address on which to listen for the pprof debugger endpoints.
    ##
    debugBindIp: 127.0.0.1

    ## Port on which to listen for the pprof debugger endpoints.
    ##
    debugBindPort: 8079

    ## Length of time for a intercepted session to be idle before terminating.
    ##
    interceptIdleTimeout: 0m

    ## Time limit on checking for new versions of resources.
    ##
    globalResourceCheckTimeout: 1h

    ## Interval on which to check for new versions of resources.
    ##
    resourceCheckingInterval: 1m

    ## Interval on which to check for new versions of resource types.
    ##
    resourceTypeCheckingInterval: 1m

    ## Method by which a worker is selected during container placement.
    ## Possible values: volume-locality | random | fewest-build-containers| limit-active-tasks
    containerPlacementStrategy: volume-locality

    ## Maximum allowed number of active build tasks per worker.
    ##
    ## Has effect only when containerPlacementStrategy is set to use
    ## limit-active-tasks placement strategy.
    ##
    ## ps.: 0 means no limit.
    ##
    ## ref: https://concourse-ci.org/container-placement.html#limit-active-tasks-strategy
    ##
    limitActiveTasks:

    ## How long to wait for Baggageclaim to send the response header.
    ##
    baggageclaimResponseHeaderTimeout: 1m

    ## Directory containing downloadable CLI binaries.
    ## By default, Concourse will try to find the assets
    ## path relative to the executable.
    ##
    cliArtifactsDir:

    ## Log database queries.
    ##
    logDbQueries: false

    ## Log cluster name.
    ##
    logClusterName:


    ## Interval on which to run build tracking.
    ##
    buildTrackerInterval: 10s

    ## Default number of build logs to retain. 0 means all.
    ##
    defaultBuildLogsToRetain:

    ## Maximum build logs to retain, 0 means not specified. Will override values configured in jobs.
    ##
    maxBuildLogsToRetain:

    ## Default days to retain build logs. 0 means unlimited.
    ##
    defaultDaysToRetainBuildLogs:

    ## Maximum days to retain build logs, 0 means not specified. Will override values configured in jobs.
    ##
    maxDaysToRetainBuildLogs:

    ## Default max number of cpu shares per task, 0 means unlimited.
    ##
    defaultTaskCpuLimit:

    ## Default maximum memory per task, 0 means unlimited.
    ##
    defaultTaskMemoryLimit:

    ## Network address of this web node, reachable by other web nodes. Used for forwarded worker addresses. (default: $POD_IP)
    ##
    peerAddress:

    ## Configurations regarding how the web component is able to connect to a postgres
    ## instance.
    ##
    postgres:
      ## The host to connect to.
      ##
      host:

      ## The port to connect to.
      ##
      port: 5432

      ## Path to a UNIX domain socket to connect to.
      ##
      socket:

      ## Whether or not to use SSL.
      ##
      sslmode: disable

      ## Dialing timeout. (0 means wait indefinitely)
      ##
      connectTimeout: 5m

      ## The name of the database to use.
      ##
      database: atc


    kubernetes:
      ## Enable the use of Kubernetes Secrets as the credential provider for
      ## concourse pipelines.
      ##
      enabled: true

      ## Prefix to use for Kubernetes namespaces under which secrets will be looked up.
      ## Defaults to the Release name hyphen, e.g. "my-release-" produces namespace "my-release-main"
      ## for the "main" Concourse team.
      ##
      namespacePrefix:

      ## Teams to create namespaces for to hold secrets.
      ## This property only has effect if `createTeamNamespaces` is set to `true`.
      ##
      teams:
        - main

      ## Create the Kubernetes namespace for each team listed under `concourse.web.kubernetes.teams`.
      ##
      createTeamNamespaces: true

      ## When true, namespaces are not deleted when the release is deleted.
      ## Irrelevant if the namespaces are not created by this chart.
      ##
      keepNamespaces: true

      ## Path to Kubernetes config when running ATC outside Kubernetes.
      ##
      configPath:

    ## Configuration for using AWS SSM as a credential manager.
    ## Ref: https://concourse-ci.org/creds.html#asm
    ##
    awsSecretsManager:
      ## Enable the use of AWS Secrets Manager for credential management.
      ##
      enabled: false

      ## AWS region to use when reading from Secrets Manager
      ##
      region:

      ## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed.
      ## Session Token can also be enabled, if required.
      keyAuth:
        enabled: true
        useSessionToken: false

      ## pipeline-specific template for Secrets Manager parameters, defaults to: /concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}
      ##
      pipelineSecretTemplate: /concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}

      ## team-specific template for Secrets Manager parameters, defaults to: /concourse/{{.Team}}/{{.Secret}}
      ##
      teamSecretTemplate: /concourse/{{.Team}}/{{.Secret}}

    ## Configuration for using AWS SSM as a credential manager.
    ## Ref: https://concourse-ci.org/creds.html#ssm
    ##
    awsSsm:
      ## Enable the use of AWS SSM.
      ##
      enabled: false

      ## AWS region to use when reading from SSM
      ##
      region:

      ## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed.
      ## Session Token can also be enabled, if required.
      keyAuth:
        enabled: true
        useSessionToken: false

      ## pipeline-specific template for SSM parameters, defaults to: /concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}
      ##
      pipelineSecretTemplate: /concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}

      ## team-specific template for SSM parameters, defaults to: /concourse/{{.Team}}/{{.Secret}}
      ##
      teamSecretTemplate: /concourse/{{.Team}}/{{.Secret}}


    ## Configuration for using Vault as a credential manager.
    ## Ref: https://concourse-ci.org/creds.html#vault
    ##
    vault:
      ## Enable the use of Vault as a credential manager.
      ##
      enabled: false

      ## URL pointing to vault addr (i.e. http://vault:8200).
      ##
      url:

      ## Vault path under which to namespace credentials lookup.
      ##
      pathPrefix: /concourse

      ## Path under which to lookup shared credentials.
      ##
      sharedPath:

      ## if the Vault server is using a self-signed certificate, set this to true,
      ## and provide a value for the cert in secrets (field `vault-ca-cert`).
      ##
      useCaCert: false

      ## Vault authentication backend, leave this blank if using an initial periodic token.
      ## Currently supported backends: token, approle, cert.
      ##
      authBackend: ""

      ## Path to a directory of PEMEncoded CA cert files to verify the vault server SSL cert.
      ##
      caPath:

      ## If set, is used to set the SNI host when connecting via TLS.
      ##
      serverName:

      ## Enable insecure SSL verification.
      ##
      insecureSkipVerify: false

      ## Client token for accessing secrets within the Vault server.
      ##
      clientToken:

      ## Time after which to force a reLogin. If not set, the token will just be continuously renewed.
      ##
      authBackendMaxTtl:

      ## The maximum time between retries when logging in or reAuthing a secret.
      ##
      retryMax: 5m

      ## The initial time between retries when logging in or reAuthing a secret.
      ##
      retryInitial: 1s

    ## Configuration for using Credhub as a credential manager.
    ## Ref: https://concourse-ci.org/credhub-credential-manager.html
    ##
    credhub:
      ## Enable the use of Credhub as a credential manager.
      ##
      enabled: false

      ## CredHub server address used to access secrets
      ## Example: https://credhub.example.com
      ##
      url:

      ## Path under which to namespace credential lookup. (default: /concourse)
      ##
      pathPrefix:

      ## Enables using a CA Certificate
      ##
      useCaCert: false

      ## Enables insecure SSL verification.
      ##
      insecureSkipVerify: false

      ## Configures the way that the Concourse authenticates against CredHub
      ## - secrets: makes use of `client-id` and `client-secret`
      ## - mtls: leverages client certificates
      ##
      authenticationMode: "secrets"


    ## Don't actually do any automatic scheduling or checking.
    ##
    noop: false

    staticWorker:
      ## Enables the direct registration of a worker that has its properties
      ## hardcoded.
      ##
      enabled: false

      ## A Garden API endpoint to register as a worker.
      ##
      gardenUrl:

      ## A Baggageclaim API endpoint to register with the worker.
      ##
      baggageclaimUrl:

      ## A resource type to advertise for the worker. Can be specified multiple times.
      ##
      resource:

    metrics:
      ## Host string to attach to emitted metrics.
      ##
      hostName:

      ## A key-value attribute to attach to emitted metrics.
      ##
      attribute:

      ## Enable capturing of error log metrics.
      ##
      captureErrorMetrics: false

      ## The size of the buffer used in emitting event metrics.
      ##
      bufferSize:

    datadog:
      enabled: false

      ## Use IP of node the pod is scheduled on, overrides `agentHost`
      ##
      agentHostUseHostIP: false

      ## Datadog agent host to expose dogstatsd metrics
      ##
      agentHost: 127.0.0.1

      ## Datadog agent port to expose dogstatsd metrics
      ##
      agentPort: 8125

      ## Prefix for all metrics to easily find them in Datadog
      ##
      prefix: "concourse.ci"

    influxdb:
      enabled: false

      ## Number of points to batch together when emitting to InfluxDB
      ##
      batchSize:

      ## The duration to wait before emitting a batch of points to InfluxDB,
      ## disregarding # the batch size.
      ##
      batchDuration:

      ## InfluxDB server address to emit points to.
      ## Example: http://127.0.0.1:8086
      ##
      url:

      ## InfluxDB database to write points to.
      ##
      database: concourse

      ## InfluxDB server username.
      ##
      username:

      ## Skip SSL verification when emitting to InfluxDB.
      ##
      insecureSkipVerify: false

    ## Emit metrics to logs instead of an actual metrics system.
    ##
    emitToLogs: false

    newrelic:
      enabled: false

      ## New Relic Account ID
      ##
      accountId:

      ## New Relic Insights API Key
      ##
      apiKey:

      ## An optional prefix for emitted New Relic events
      ##
      servicePrefix:

    prometheus:
      enabled: false

      ## IP to listen on to expose Prometheus metrics.
      ##
      bindIp: "0.0.0.0"

      ## Port to listen on to expose Prometheus metrics.
      ##
      bindPort: 9391

    riemann:
      enabled: false

      ## Riemann server address to emit metrics to.
      ##
      host:

      ## Port of the Riemann server to emit metrics to.
      ##
      port: 5555

      ## An optional prefix for emitted Riemann services
      ##
      servicePrefix:

      ## Tag to attach to emitted metrics. Can be specified multiple times.
      ##
      tag:

    ## The value to set for X-Frame-Options. If omitted, the header is not set.
    ##
    xFrameOptions:

    gc:
      ## Interval on which to perform garbage collection.
      ##
      interval: 30s

      ## Grace period before reaping oneOff task containers
      ##
      oneOffGracePeriod: 5m

      ## Period after which to reap containers and volumes that were created but
      ## went missing from the worker.
      ##
      missingGracePeriod: 5m

      ## Period after which to reap checks that are completed.
      ##
      checkRecyclePeriod:

    syslog:
      ## Enables the emission of build logs to external log ingesters through
      ## using the syslog protocol.
      ##
      enabled: false

      ## Client hostname with which the build logs will be sent to the syslog server.
      ##
      hostname: atc-syslog-drainer

      ## Remote syslog server address with port (Example: 0.0.0.0:514).
      ##
      address:

      ## Transport protocol for syslog messages (Currently supporting tcp, udp & tls).
      ##
      transport:

      ## Interval over which checking is done for new build logs to send to syslog server
      ## (duration measurement units are s/m/h; eg. 30s/30m/1h)
      drainInterval: 30s

      ## If the syslog server is using a self-signed certificate, set this to true,
      ## and provide a value for the cert in secrets (`syslog-ca-cert`).
      ##
      useCaCert: false

    auth:
      ## Force sending secure flag on http cookies
      ##
      cookieSecure: false

      ## Length of time for which tokens are valid. Afterwards, users will have to log back in.
      ## The value must be specified as Go duration values (e.g.: 30m or 24h).
      duration: 24h

      mainTeam:
        ## Configuration file for specifying team params.
        ## Ref: https://concourse-ci.org/managing-teams.html#setting-roles
        ##
        config:

        ## List of local Concourse users to be included as members of the `main` team.
        ## Make sure you have local users support enabled (`concourse.web.localAuth.enabled`) and
        ## that the users were added (`local-users` secret).
        ##
        localUser: "test"

        ## Authentication (Main Team) (CloudFoundry)
        ##
        cf:
          ## List of whitelisted CloudFoundry users.
          ##
          user:

          ## List of whitelisted CloudFoundry orgs
          ##
          org:

          ## List of whitelisted CloudFoundry spaces
          ##
          space:

          ## (Deprecated) List of whitelisted CloudFoundry space guids
          ##
          spaceGuid:

        ## Authentication (Main Team) (Bitbucket Cloud)
        ##
        bitbucketCloud:

          ## List of whitelisted Bitbucket Cloud users
          ##
          user:

          ## List of whitelisted Bitbucket Cloud teams
          ##
          team:

        ## Authentication (Main Team) (GitHub)
        ##
        github:
          ## List of whitelisted GitHub users
          ##
          user:

          ## List of whitelisted GitHub orgs
          ##
          org:

          ## List of whitelisted GitHub teams
          ##
          team:

        ## Authentication (Main Team) (GitLab)
        ##
        gitlab:

          ## List of whitelisted GitLab users
          ##
          user:

          ## List of whitelisted GitLab groups
          ##
          group:

        ## Authentication (Main Team) (LDAP)
        ##
        ldap:
          ## List of whitelisted LDAP users
          ##
          user:

          ## List of whitelisted LDAP groups
          ##
          group:

        ## Authentication (Main Team) (OAuth2)
        ##
        oauth:
          ## List of whitelisted OAuth2 users
          ##
          user:

          ## List of whitelisted OAuth2 groups
          ##
          group:

        ## Authentication (Main Team) (OIDC)
        ##
        oidc:

          ## List of whitelisted OIDC users
          ##
          user:

          ## List of whitelisted OIDC groups
          ##
          group:

      ## Authentication (CloudFoundry)
      ##
      cf:
        enabled: false

        ## (Required) The base API URL of your CF deployment. It will use this information to discover information
        ## about the authentication provider.
        ##
        ## Example: https://api.run.pivotal.io
        ##
        apiUrl:

        ## CA Certificate
        ##
        useCaCert: false

        ## Skip SSL validation
        ##
        skipSslValidation: false

      ## Authentication (GitHub)
      ##
      github:
        enabled: false

        ## Hostname of GitHub Enterprise deployment (No scheme, No trailing slash)
        ##
        host:

        ## CA certificate of GitHub Enterprise deployment
        ##
        useCaCert: false

      ## Authentication (BitbucketCloud)
      ##
      bitbucketCloud:
        enabled: false

      ## Authentication (GitLab)
      gitlab:
        enabled: false

        ## Hostname of Gitlab Enterprise deployment (Include scheme, No trailing slash)
        ##
        host:

      ## Authentication (LDAP)
      ldap:
        enabled: false

        ## The auth provider name displayed to users on the login page
        ##
        displayName:

        ## (Required) The host and optional port of the LDAP server. If port isn't supplied, it will be guessed
        ## based on the TLS configuration. 389 or 636.
        ##
        host:

        ## (Required) Bind DN for searching LDAP users and groups. Typically this is a readOnly user.
        ##
        bindDn:

        ## (Required) Bind Password for the user specified by 'bindDn'
        ##
        bindPw:

        ## Required if LDAP host does not use TLS.
        ##
        insecureNoSsl:

        ## Skip certificate verification
        ##
        insecureSkipVerify:

        ## Start on insecure port, then negotiate TLS
        ##
        startTls:

        ## CA certificate
        ##
        useCaCert:

        ## BaseDN to start the search from. For example 'cn=users,dc=example,dc=com'
        ##
        userSearchBaseDn:

        ## Optional filter to apply when searching the directory. For example '(objectClass=person)'
        ##
        userSearchFilter:

        ## Attribute to match against the inputted username. This will be translated and combined with the other
        ## filter as '(<attr>=<username>)'.
        ##
        userSearchUsername:

        ## Can either be: 'sub'  search the whole sub tree or 'one' - only search one level. Defaults to 'sub'.
        ##
        userSearchScope:

        ## A mapping of attributes on the user entry to claims. Defaults to 'uid'.
        ##
        userSearchIdAttr:

        ## A mapping of attributes on the user entry to claims. Defaults to 'mail'.
        ##
        userSearchEmailAttr:

        ## A mapping of attributes on the user entry to claims.
        ##
        userSearchNameAttr:

        ## BaseDN to start the search from. For example 'cn=groups,dc=example,dc=com'
        ##
        groupSearchBaseDn:

        ## Optional filter to apply when searching the directory. For example '(objectClass=posixGroup)'
        ##
        groupSearchFilter:

        ## Can either be: 'sub'  search the whole sub tree or 'one' - only search one level. Defaults to 'sub'.
        ##
        groupSearchScope:

        ## Adds an additional requirement to the filter that an attribute in the group match the user's attribute value. The exact filter being added is: (<groupAttr>=<userAttr value>)
        ##
        groupSearchUserAttr:

        ## Adds an additional requirement to the filter that an attribute in the group match the user's attribute value. The exact filter being added is: (<groupAttr>=<userAttr value>)
        ##
        groupSearchGroupAttr:

        ## The attribute of the group that represents its name.
        ##
        groupSearchNameAttr:

      ## Authentication (OAuth2)
      ##
      oauth:
        enabled: false

        ## The auth provider name displayed to users on the login page
        ##
        displayName:

        ## (Required) Authorization URL
        ##
        authUrl:

        ## (Required) Token URL
        ##
        tokenUrl:

        ## UserInfo URL
        ##
        userinfoUrl:

        ## Any additional scopes that need to be requested during authorization
        ##
        scope:

        ## The groups key indicates which claim to use to map external groups to Concourse teams.
        ##
        groupsKey:

        ## CA Certificate
        ##
        useCaCert:

        ## Skip SSL validation
        ##
        skipSslValidation:

        ## The user id key indicates which claim to use to map an external user id to a
        ## Concourse user id.
        ##
        userIdKey: user_id

        ## The user name key indicates which claim to use to map an external user name to a
        ## Concourse user name.
        ##
        userNameKey: user_name

      ## Authentication (OIDC)
      oidc:
        enabled: false

        ## The auth provider name displayed to users on the login page
        ##
        displayName:

        ## (Required) An OIDC issuer URL that will be used to discover provider configuration using the .wellKnown/openid-configuration
        ##
        issuer:

        ## Any additional scopes that need to be requested during authorization
        ##
        scope:

        ## The groups key indicates which claim to use to map external groups to Concourse teams.
        ##
        groupsKey:

        ## CA Certificate
        ##
        useCaCert:

        ## Skip SSL validation
        ##
        skipSslValidation:

        ## The user name key indicates which claim to use to map an external user name to a
        ## Concourse user name.
        ##
        userNameKey: username

    tsa:
      ## Minimum level of logs to see. Possible values: debug, info, error.
      ##
      logLevel: info

      ## IP address on which to listen for SSH.
      ##
      bindIp: 0.0.0.0

      ## Port on which to listen for SSH.
      ##
      bindPort: 2222

      ## IP address on which to listen for the pprof debugger endpoints (default: 127.0.0.1)
      ##
      debugBindIp: 127.0.0.1

      ## Port on which to listen for TSA pprof server.
      ##
      debugBindPort: 2221

      ## Path to private key to use for the SSH server.
      ##
      hostKey:

      ## Path to file containing keys to authorize, in SSH authorized_keys format (one public key per line).
      ##
      authorizedKeys:

      ## ATC API endpoints to which workers will be registered.
      ##
      atcUrl:

      ## Path to private key to use when signing tokens in reqests to the ATC during registration.
      ##
      sessionSigningKey:

      ## Interval on which to heartbeat workers to the ATC.
      ##
      heartbeatInterval: 30s

    letsEncrypt:
      ## Automatically configure TLS certificates via Let's Encrypt/ACME.
      ##
      enabled: false

      ## URL of the ACME CA directory endpoint.
      ##
      acmeURL:

  worker:
    ## Signal to send to the worker container when shutting down.
    ## Possible values:
    ##
    ## - SIGUSR1: land the worker, and
    ## - SIGUSR2: retire the worker.
    ##
    ## Note.: using SIGUSR2 with persistence enabled implies the use of an
    ## initContainer that removes any data the existed previously under
    ## `concourse.worker.workDir` as the action of `retire`ing a worker implies
    ## that no state comes back with it when re-registering.
    ##
    ## Ref: https://concourse-ci.org/concourse-worker.html
    ## Ref: https://concourse-ci.org/worker-internals.html
    ##
    shutdownSignal: SIGUSR2

    ## Duration after which the registration should be swapped to another random SSH gateway.
    ##
    rebalanceInterval:

    ## Duration after which a worker should give up draining forwarded connections on shutdown.
    ##
    connectionDrainTimeout: 1h

    ## IP address on which to listen for health checking requests.
    ##
    healthcheckBindIp: 0.0.0.0

    ## Port on which to listen for health checking requests.
    ##
    healthcheckBindPort: 8888

    ## HTTP timeout for the full duration of health checking.
    ##
    healthcheckTimeout: 5s

    ## The name to set for the worker during registration. If not specified, the hostname will be used.
    ##
    name:

    ## A tag to set during registration. Can be specified multiple times.
    ##
    tag:

    ## The name of the team that this worker will be assigned to.
    ##
    team:

    ## HTTP proxy endpoint to use for containers.
    ##
    http_proxy:

    ## HTTPS proxy endpoint to use for containers.
    ##
    https_proxy:

    ## Blacklist of addresses to skip the proxy when reaching.
    ##
    no_proxy:

    ## If set, the worker will be immediately removed upon stalling.
    ##
    ephemeral:

    ## IP address on which to listen for the pprof debugger endpoints.
    ##
    debugBindIp: 127.0.0.1

    ## Port on which to listen for beacon pprof server.
    ##
    debugBindPort: 7776

    ## Version of the worker. This is normally baked in to the binary, so this flag is hidden.
    ##
    version:

    ## Directory in which to place container data.
    ##
    workDir: /concourse-work-dir

    ## IP address on which to listen for the Garden server.
    ##
    bindIp: 127.0.0.1

    ## Port on which to listen for the Garden server.
    ##
    bindPort: 7777

    ## IP used to reach this worker from the ATC nodes.
    ##
    peerIp:

    ## Interval on which containers and volumes will be garbage collected from the worker.
    ##
    sweepInterval: 30s

    ## Minimum level of logs to see. Possible options: debug, info, error.
    ##
    logLevel: info

    ## Maximum number of containers which can be swept in parallel.
    ##
    containerSweeperMaxInFlight: 5

    ## Maximum number of volumes which can be swept in parallel.
    ##
    volumeSweeperMaxInFlight: 5

    tsa:

      ## TSA host(s) to forward the worker through.
      ## Only used for worker-only deployments.
      ## Example:
      ## hosts:
      ##   - 1.1.1.1:2222
      ##   - 2.2.2.2:2222
      ##
      hosts: []

      ## File containing a public key to expect from the TSA.
      ##
      publicKey:

      ## File containing the private key to use when authenticating to the TSA.
      ##
      workerPrivateKey:

    ## API endpoint of an externally managed Garden server to use instead of
    ## running the embedded Garden server.
    ##
    externalGardenUrl:

    garden:
      ## Path to the 'gdn' executable (or leave as 'gdn' to find it in $PATH)
      ##
      bin: gdn

      ## Path to a config file to use for Garden in INI format.
      ##
      ## For example, in a ConfigMap:
      ##
      ##   [server]
      ##     max-containers = 100
      ##
      ## For information about the possible values:
      ## Ref: https://bosh.io/jobs/garden?source=github.com/cloudfoundry/garden-runc-release
      ##
      config:

      ## Enable a proxy DNS server for Garden
      ##
      dnsProxyEnable:

      ## Use the insecure Houdini Garden backend.
      ##
      useHoudini:

    baggageclaim:
      ## Minimum level of logs to see. Possible values: debug, info, error
      ##
      logLevel: info

      ## IP address on which to listen for API traffic.
      ##
      bindIp: 127.0.0.1

      ## Port on which to listen for API traffic.
      ##
      bindPort: 7788

      ## IP address on which to listen for the pprof debugger endpoints.
      ##
      debugBindIp: 127.0.0.1

      ## Port on which to listen for baggageclaim pprof server.
      ##
      debugBindPort: 7787

      ## Disable remapping of user/group IDs in unprivileged volumes.
      ##
      disableUserNamespaces:

      ## Directory in which to place volume data.
      ##
      volumes:

      ## Driver to use for managing volumes.
      ## Possible values: detect, naive, btrfs, and overlay.
      ##
      driver: naive

      ## Path to btrfs binary
      ##
      btrfsBin: btrfs

      ## Path to mkfs.btrfs binary
      ##
      mkfsBin: mkfs.btrfs

      ## Path to directory in which to store overlay data
      ##
      overlaysDir:

      ## Interval on which to reap expired volumes.
      ##
      reapInterval: 10s

## Configuration values for Concourse Web components.
## For more information regarding the characteristics of
## Concourse Web nodes, see https://concourse-ci.org/concourse-web.html.
##
web:

  ## Enable or disable the web component.
  ## This allows the creation of worker-only releases by setting this to false.
  ##
  enabled: true

  ## Override the components name (defaults to web).
  ##
  nameOverride:

  ## Number of replicas.
  ##
  replicas: 1

  ## Array of extra containers to run alongside the Concourse Web
  ## container.
  ##
  ## Example:
  ## - name: myapp-container
  ##   image: busybox
  ##   command: ['sh', '-c', 'echo Hello && sleep 3600']
  ##
  sidecarContainers: []

  ## Configures the liveness probe used to determine if the Web component is up.
  ## ps.: if you're upgrading Concourse from one version  to another, the probe will
  ## probably fail for some time before migrations are finished - in such situations,
  ## consider bumping the values set here.
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
  ##
  livenessProbe:
    failureThreshold: 5
    initialDelaySeconds: 10
    periodSeconds: 15
    timeoutSeconds: 3
    httpGet:
      path: /api/v1/info
      port: atc

  ## Configures the readiness probes.
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
  ##
  readinessProbe:
    httpGet:
      path: /api/v1/info
      port: atc

  ## Configure resource requests and limits.
  ## Ref: https://kubernetes.io/docs/user-guide/compute-resources/
  ##
  resources:
    requests:
      cpu: "100m"
      memory: "128Mi"

  ## Configure additional environment variables for the
  ## web containers.
  ## Example:
  ##
  ##   - name: CONCOURSE_LOG_LEVEL
  ##     value: "debug"
  ##   - name: CONCOURSE_TSA_LOG_LEVEL
  ##     value: "debug"
  ##
  env:

  ## Where secrets should be mounted for the web container.
  ##
  keySecretsPath: "/concourse-keys"
  teamSecretsPath: "/team-authorized-keys"
  authSecretsPath: "/concourse-auth"
  vaultSecretsPath: "/concourse-vault"
  credhubSecretsPath: "/concourse-credhub"
  postgresqlSecretsPath: "/concourse-postgresql"
  syslogSecretsPath: "/concourse-syslog"
  tlsSecretsPath: "/concourse-web-tls"

  ## Configure additional volumes for the
  ## web container(s).
  ##
  ## Example:
  ##
  ##   - name: my-team-authorized-keys
  ##     configMap:
  ##       name: my-team-authorized-keys-config
  ##
  ## Ref: https://kubernetes.io/docs/concepts/storage/volumes/
  ##
  additionalVolumes: []

  ## Configure additional volumeMounts for the
  ## web container(s)
  ##
  ## Example:
  ##
  ##  - name: my-team-authorized-keys
  ##    mountPath: /my-team-authorized-keys
  ##
  ## Ref: https://kubernetes.io/docs/concepts/storage/volumes/
  ##
  additionalVolumeMounts:

  ## Additional affinities to add to the web pods.
  ##
  ## Example:
  ##   nodeAffinity:
  ##     preferredDuringSchedulingIgnoredDuringExecution:
  ##       - weight: 50
  ##         preference:
  ##           matchExpressions:
  ##             - key: spot
  ##               operator: NotIn
  ##               values:
  ##                 - "true"
  ##
  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  additionalAffinities:

  ## Additional Labels to be added to the web pods.
  ##
  ## Example:
  ##   key1: "value1"
  ##   key2: "value2"
  ##
  ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  ##
  labels: {}

  ## Annotations for the web nodes.
  ##
  ## Example:
  ##   key1: "value1"
  ##   key2: "value2"
  ##
  ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  annotations: {}

  ## Node selector for web nodes.
  ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  ##
  nodeSelector: {}

  ## Tolerations for the web nodes.
  ##
  ## Example:
  ##   - key: "toleration=key"
  ##     operator: "Equal"
  ##     value: "value"
  ##     effect: "NoSchedule"
  ##
  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []

  ## Strategy for web deployment updates.
  ##
  ## Example:
  ##
  ##   strategy:
  ##     type: RollingUpdate
  ##     rollingUpdate:
  ##       maxSurge: 1
  ##       maxUnavailable: 25%
  strategy: {}

  ## Service configuration.
  ## Ref: https://kubernetes.io/docs/user-guide/services/
  ##
  service:
    ## For minikube, set this to ClusterIP, elsewhere use LoadBalancer or NodePort
    ## Ref: https://kubernetes.io/docs/user-guide/services/#publishing-services---service-types
    ##
    type: ClusterIP

    ## When using `web.service.type: LoadBalancer`, sets the user-specified load balancer IP.
    ## Example: 172.217.1.174
    ##
    loadBalancerIP:

    ## Additional Labels to be added to the web service.
    ##
    labels:

    ## Annotations to be added to the web service.
    ##
    ## Example:
    ##
    ##   prometheus.io/probe: "true"
    ##   prometheus.io/probe_path: "/"
    ##
    ## When using `web.service.type: LoadBalancer` in AWS, enable HTTPS with an ACM cert:
    ##
    ##   service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:eu-west-1:123456789:certificate/abc123-abc123-abc123-abc123"
    ##   service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
    ##   service.beta.kubernetes.io/aws-load-balancer-backend-port: "atc"
    ##   service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
    ##
    annotations: {}

    ## When using `web.service.type: LoadBalancer`, whitelist the load balancer to particular IPs
    ## Example:
    ##   - 192.168.1.10/32
    ##
    loadBalancerSourceRanges:

    ## When using `web.service.type: NodePort`, sets the nodePort for atc
    ##
    atcNodePort:

    ## When using `web.service.type: NodePort`, sets the nodePort for atc tls
    ##
    atcTlsNodePort:

    ## When using `web.service.type: NodePort`, sets the nodePort for tsa
    ##
    tsaNodePort:

  ## Ingress configuration.
  ## Ref: https://kubernetes.io/docs/user-guide/ingress/
  ##
  ingress:
    ## Enable Ingress.
    ##
    enabled: false

    ## Annotations to be added to the web ingress.
    ## Example:
    ##   kubernetes.io/ingress.class: nginx
    ##   kubernetes.io/tls-acme: 'true'
    ##
    annotations: {}

    ## Hostnames.
    ## Must be provided if Ingress is enabled.
    ## Example:
    ##   - concourse.domain.com
    ##
    hosts:

    ## TLS configuration.
    ## Secrets must be manually created in the namespace.
    ## Example:
    ##   - secretName: concourse-web-tls
    ##     hosts:
    ##       - concourse.domain.com
    ##
    tls:

## Configuration values for Concourse Worker components.
## For more information regarding the characteristics of
## Concourse Workers, see https://concourse-ci.org/concourse-worker.html
##
worker:

  ## Enable or disable the worker component.
  ## This can allow users to create web only releases by setting this to false
  ##
  enabled: true

  ## Override the components name (defaults to worker).
  ##
  nameOverride:

  ## Removes any previous state created in `concourse.worker.workDir`.
  ##
  cleanUpWorkDirOnStart: true

  ## Number of replicas.
  ##
  replicas: 2

  ## Array of extra containers to run alongside the Concourse worker
  ## container.
  ##
  ## Example:
  ##
  ## - name: myapp-container
  ##   image: busybox
  ##   command: ['sh', '-c', 'echo Hello && sleep 3600']
  ##
  sidecarContainers: []

  ## Minimum number of workers available after an eviction
  ## Ref: https://kubernetes.io/docs/admin/disruptions/
  ##
  minAvailable: 1

  ## Configures the liveness probe used to determine if the Worker component is up.
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
  ##
  livenessProbe:
    failureThreshold: 5
    initialDelaySeconds: 10
    periodSeconds: 15
    timeoutSeconds: 3
    httpGet:
      path: /
      port: worker-hc

  ## Configures the readiness probes.
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
  ##
  readinessProbe: {}

  ## Configure resource requests and limits.
  ## Ref: https://kubernetes.io/docs/user-guide/compute-resources/
  ##
  resources:
    requests:
      cpu: "100m"
      memory: "512Mi"

  ## Configure additional environment variables for the
  ## worker container(s)
  ##
  ## Example:
  ##
  ##   - name: CONCOURSE_NAME
  ##     value: "anything"
  ##
  env: []

  ## For managing where secrets should be mounted for worker agents
  ##
  keySecretsPath: "/concourse-keys"

  ## Configure additional volumeMounts for the
  ## worker container(s)
  ##
  ## Example:
  ##   - name: concourse-baggageclaim
  ##     mountPath: /baggageclaim
  ##
  additionalVolumeMounts: []

  ## Additional Labels to be added to the worker pods.
  ##
  ## Example:
  ##   key1: "value1"
  ##   key2: "value2"
  ##
  ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  ##
  labels: {}

  ## Annotations to be added to the worker pods.
  ##
  ## Example:
  ##
  ##   iam.amazonaws.com/role: arn:aws:iam::123456789012:role/concourse
  ##
  annotations: {}

  ## Node selector for the worker nodes.
  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
  ##
  nodeSelector: {}

  ## Additional affinities to add to the worker pods.
  ## Useful if you prefer to run workers on non-spot instances, for example.
  ##
  ## Example:
  ##
  ##   nodeAffinity:
  ##     preferredDuringSchedulingIgnoredDuringExecution:
  ##       - weight: 50
  ##         preference:
  ##           matchExpressions:
  ##             - key: spot
  ##               operator: NotIn
  ##               values:
  ##                 - "true"
  ##
  additionalAffinities: {}

  ## Configure additional volumes for the
  ## worker container(s).
  ## Example:
  ##
  ##  - name: concourse-baggageclaim
  ##    hostPath:
  ##      path: /dev/nvme0n1
  ##      type: BlockDevice
  ##
  ##
  ## As a special exception, this allows taking over the `concourse-work-dir`
  ## volume (from the default emptyDir) if `persistence.enabled` is false:
  ##
  ##   additionalVolumes:
  ##     - name: concourse-work-dir
  ##       hostPath:
  ##         path: /mnt/locally-mounted-fast-disk/concourse
  ##         type: DirectoryOrCreate
  ##
  additionalVolumes: []

  ## Whether the workers should be forced to run on separate nodes.
  ## This is accomplished by setting their AntiAffinity with requiredDuringSchedulingIgnoredDuringExecution as opposed to preferred
  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity-beta-feature
  ##
  hardAntiAffinity: false

  ## Tolerations for the worker nodes.
  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  ## For example:
  ##
  ##   - key: "toleration=key"
  ##     operator: "Equal"
  ##     value: "value"
  ##     effect: "NoSchedule"
  ##
  tolerations: []

  ## Time to allow the pod to terminate before being forcefully terminated. This should provide time for
  ## the worker to retire, i.e. drain its tasks. See https://concourse-ci.org/worker-internals.html for worker
  ## lifecycle semantics.
  ##
  terminationGracePeriodSeconds: 60

  ## Strategy for StatefulSet updates (requires Kubernetes 1.6+)
  ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset
  ##
  updateStrategy: RollingUpdate

  ## Pod Management strategy (requires Kubernetes 1.7+)
  ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
  ##
  ## "OrderedReady" is default. "Parallel" means worker pods will launch or terminate
  ## in parallel.
  ##
  podManagementPolicy: Parallel

  ## When persistance is disabled this value will be used to limit the emptyDir volume size
  ## Ref: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
  ##
  ## Example: 20Gi
  ##
  emptyDirSize:

## Persistent Volume Storage configuration.
## Ref: https://kubernetes.io/docs/user-guide/persistent-volumes
##
persistence:
  ## Enable persistence using Persistent Volume Claims.
  ##
  enabled: true

  ## Worker Persistence configuration.
  ##
  worker:
    ## concourse data Persistent Volume Storage Class
    ## If defined, storageClassName: <storageClass>
    ## If set to "-", storageClassName: "", which disables dynamic provisioning
    ## If undefined (the default) or set to null, no storageClassName spec is
    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
    ##   GKE, AWS & OpenStack)
    ##
    storageClass:

    ## Persistent Volume Access Mode.
    ##
    accessMode: ReadWriteOnce

    ## Persistent Volume Storage Size.
    ##
    size: 20Gi

## Configuration values for the postgresql dependency.
## Ref: https://github.com/helm/charts/blob/master/stable/postgresql/README.md
##
postgresql:

  ## Use the PostgreSQL chart dependency.
  ##
  ## Set to false if bringing your own PostgreSQL, and set the corresponding `secrets`
  ## fields that correspond to the PostgreSQL variables that `concourse web` should use
  ## to connect to.
  ##
  ## Should be set to false if using the chart as a worker only deployment.
  ##
  enabled: true

  ### PostgreSQL User to create.
  ##
  postgresqlUsername: concourse

  ## PostgreSQL Password for the new user.
  ## If not set, a random 10 characters password will be used.
  ##
  postgresqlPassword: concourse

  ## PostgreSQL Database to create.
  ##
  postgresqlDatabase: concourse

  ## Persistent Volume Storage configuration for PostgreSQL.
  ##
  ## Ref: https://kubernetes.io/docs/user-guide/persistent-volumes
  ##
  persistence:
    ## Enable PostgreSQL persistence using Persistent Volume Claims.
    ##
    enabled: true

    ## Persistent Volume Storage Class to be used by PersistentVolumes created
    ## for PostgreSQL.
    ##
    ## If defined, storageClassName: <storageClass>
    ## If set to "-", storageClassName: "", which disables dynamic provisioning
    ## If undefined (the default) or set to null, no storageClassName spec is
    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
    ##   GKE, AWS & OpenStack)
    ##
    storageClass:

    ## Persistent Volume Access Mode.
    ##
    accessModes:
      - ReadWriteOnce

    ## Persistent Volume Storage Size.
    ##
    size: 8Gi

## For Kubernetes RBAC support:
##
rbac:
  ## Enable the creation of RBAC resources.
  ##
  create: true

  ## RBAC Version
  ##
  apiVersion: v1beta1

  ## The name of the service account to use for web pods if rbac.create is false
  ##
  webServiceAccountName: default

  ## The name of the service account to use for worker pods if rbac.create is false
  ##
  workerServiceAccountName: default

## For managing secrets using Helm
##
secrets:
  ## Create the secret resource from the following values. Set this to
  ## false to manage these secrets outside Helm.
  ##
  create: true

  ## Array of team names and public keys for team external workers.
  ##
  ## Example:
  ## - team: main
  ##   key: |-
  ##     ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYBQ9fG6IML+qsFaMh1Pl+81wyUwRilHdfhItAiAsLVQsOwI5+V4pn5aLhHPBuRQqIqYmbkZ7I1VUIN1+90PVJ3X7l9qqanb85AHMtLujw1j9u0zDyH2XHgpUloknUQzUSLIZjjU3Hn3Uo/XikF+vT8104isO7Ym8Xp7sIcRuvOQ3nuRsFVCRogxpLTVHD/k57rwYVqWWLaKLwvx01ZVXOq4GHk/BVaKa9ODC/dNgbZMfwvVVXuf7/NFGmSMyXb49Si4aoP4Gn7jAX6GngBbm/bgKqO0skQy/ggQm/YVF+s5q4EhleMBLVJKD1VpM5LeLDFpiu/y4bVd8wUcgK+QQ9 Concourse
  ##
  ## Make sure to chack the security caveats here: https://concourse-ci.org/teams-caveats.html
  ## Extra Reads: https://github.com/concourse/concourse/issues/1865#issuecomment-464166994
  ## https://concourse-ci.org/global-resources.html#complications-with-reusing-containers
  ##
  teamAuthorizedKeys:

  ## List of `username:password` or `username:bcrypted_password` combinations for all your local concourse users.
  ##
  localUsers: "test:test"

  ## The TLS certificate and private key for the web component to be able to terminate
  ## TLS connections.
  ##
  webTlsCert:
  webTlsKey:

  ## Concourse Host Keys.
  ## Ref: https://concourse-ci.org/install.html#generating-keys
  ##
  hostKey: |-
    -----BEGIN RSA PRIVATE KEY-----
    MIIEogIBAAKCAQEA2AUPXxuiDC/qrBWjIdT5fvNcMlMEYpR3X4SLQIgLC1ULDsCO
    fleKZ+Wi4RzwbkUKiKmJm5GeyNVVCDdfvdD1Sd1+5faqmp2/OQBzLS7o8NY/btMw
    8h9lx4KVJaJJ1EM1EiyGY41Nx591KP14pBfr0/NdOIrDu2JvF6e7CHEbrzkN57kb
    BVQkaIMaS01Rw/5Oe68GFalli2ii8L8dNWVVzquBh5PwVWimvTgwv3TYG2TH8L1V
    V7n+/zRRpkjMl2+PUouGqD+Bp+4wF+hp4AW5v24CqjtLJEMv4IEJv2FRfrOauBIZ
    XjAS1SSg9VaTOS3iwxaYrv8uG1XfMFHICvkEPQIDAQABAoIBAG87W8jrX6vK2Jm3
    ooJ/OeFmymiXWsCwFi+2/kVCR/2T0tfLyxO/W+NX2WD1F9CP+HaaZeMXPp3HS7up
    V8FT4ZohVYBwXTS0WYyucKApcYThrVQRpzhldnEfClGQmVeVK7Sp/KEyV4Sc1SVA
    L2i/cI142N2Ohm7spquVkLcuFsVINzZ0fXCv25dTqbkEgjTJzNdBzyFXvc4z0Mt9
    gW14M7mz+YKYOfsCxIEm438fC9b16C96yIFBdN+/jaP8pmb2RoIE2D0F8bj5K1hR
    YyGFKMOU4e6cYq59iWfubKuu2WNJEBk/5aO7x7Xu2S0k8wIYlwxFuu4LfR2Kvizu
    +mFVf3kCgYEA9e0+40tJGpOPM8hAB3DwXjYc8lCuyYf3z30T3RqVNCUVSWnlaj/s
    3ENi6+Ng3u+Zs8cR2CFou+jAClTyWLuSnI9yACD0eyW9n4bzYMUbgdC6vneLjpzx
    wWR9Xv5RmZVly7xWuqcgEeEf8RNcYI3oXby0laF3EObvuAx/4ETIkFcCgYEA4N42
    w1UEWGopWBIIXYHkEPHQuF0SxR2CZyh9ExTeSxFphyibkcHRjDW+t91ZLnSm5k1N
    TOdYuc0ApBV3U+TexeFvDI94L/Oze6Ht5MatRQz8kRwMFGJL3TrpbgTmWdfG05Ad
    oiScJzwY16oJXnKusxik7V+gCCNNE0/2UuMnY4sCgYAEf82pvOPef5qcGOrK+A79
    ukG3UTCRcVJgUmp9nhHivVbxW+WdlwPPV9BEfol0KrAGMPsrmBjhbzWsOregVfYt
    tRYh2HiAlEUu2Po06AZDzrzL5UYBWu+1WRBOH5sAk1IkcxKnIY2dph++elszTQVW
    SbCIGEckYQU7ucbRJJECywKBgBb4vHFx8vKxTa3wkagzx7+vZFohL/SxEgxFx5k2
    bYsPqU8kZ9gZC7YeG3CfDShAxHgMd5QeoiLA/YrFop4QaG2gnP6UfXuwkqpTnYDc
    hwDh1b9hNR6z9/oOtaAGoh2VfHtKYqyYvtcHPaZyeWiLoKstHlQdi7SpHouVhJ1t
    FS4HAoGAGy+56+zvdROjJy9A2Mn/4BvWrsu4RSQILBJ6Hb4TpF46p2fn0rwqyhOj
    Occs+xkdEsI9w5phXzIEeOq2LqvWHDPxtdLpxOrrmx4AftAWdM8S1+OqTpzHihK1
    y1ZOrWfvON+XjWFFAEej/CpQZkNUkTzjTtSC0dnfAveZlasQHdI=
    -----END RSA PRIVATE KEY-----

  hostKeyPub: |-
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYBQ9fG6IML+qsFaMh1Pl+81wyUwRilHdfhItAiAsLVQsOwI5+V4pn5aLhHPBuRQqIqYmbkZ7I1VUIN1+90PVJ3X7l9qqanb85AHMtLujw1j9u0zDyH2XHgpUloknUQzUSLIZjjU3Hn3Uo/XikF+vT8104isO7Ym8Xp7sIcRuvOQ3nuRsFVCRogxpLTVHD/k57rwYVqWWLaKLwvx01ZVXOq4GHk/BVaKa9ODC/dNgbZMfwvVVXuf7/NFGmSMyXb49Si4aoP4Gn7jAX6GngBbm/bgKqO0skQy/ggQm/YVF+s5q4EhleMBLVJKD1VpM5LeLDFpiu/y4bVd8wUcgK+QQ9 Concourse

  ## Concourse Session Signing Keys.
  ## Ref: https://concourse-ci.org/install.html#generating-keys
  ##
  sessionSigningKey: |-
    -----BEGIN RSA PRIVATE KEY-----
    MIIEowIBAAKCAQEAwLql/rUIaI+PX7Tl3FWcTee4sQf8/daakALXx955tPwkhqlY
    e4T2V84p/ylFvNWpM4vfcMYKfMY0JLKgAgBvJhCytSkDBhTBoWmN6yE0AB11P9En
    lIZRBWNYqaC2cSge2ZD8qOSnwfFhnQAW8+7pE+ElJAVh7dtdF3A478H50lIigq8I
    zMWp2EGJpFC7/Uu36oIL/03MNGCmrH1jvtTuJiAMQUZYyL1ReBkvvHOzw9i4HXPy
    SMVtcllm4NBs2aVPtwhr2kwSkLt8t1bPdRn6OIyEAw5WktzAKaiZnkTvj6g3xzdp
    zKcrdlBr9aznlNvoSinBUfvtwyFmvFN1HHbA9wIDAQABAoIBAE7G/DrUfI9gvtX7
    90jMpYsigFe8UCjho2PiBZlo0o6r0bJJXiV+/8J8PqZRlHPPUc4EClzqVjcSPRYS
    /VxUGRqSELoD/Xxq14rGvn+xnrO9VsOzFl6bWFq/dOpBCtHN+G4t2VifvgKES8YE
    11z19sdta+UBXjn/RFnkQSGfRCI3QqTaYvjxevt0uWlyPmqkFPQQw8bvHIXzoB+B
    rzeiMa++nMvbX5pAH9XA0BvhyuH3fHidTUwiVBpkMcpLWtjP0A0JTsecDdbinDDq
    un2EIo8zMWRwKQN/JnUxsi8AUEigBTCUqeDgREXtW62uvFkSpcVMXwmVityLYIVy
    qnVLUCECgYEA6IwXkP1qnSfcNeoVI/ypDuz1/kdqcjSPhLYe+jdiLLoFkMW9AlDm
    lzwNaWlTFD9ygo+NjJCo63/A8HCm55sajws5hZ6r20vdZcKFMk9h0qF5oVA7lkQ2
    gvG2WaznuU7KkqhfP+pXhiLgZKoJkst/+g7r6uHpredwDY6hxeBK4vsCgYEA1CqH
    8ywC5qUo/36kQg/TU2adN/YEHdJAAbU23EVrGQSVmnXW08H2NLFk0tsxrwoNnbgp
    PIk2J7BimbJvbND17ibr4GAklDTsR8aJkDl+0JgNCAK9N07qVt1s7FXzhg95jUL9
    EQW55z60GAJpecqNwA4Jsa8P852N0355Obp92TUCgYBkOBvf7JcJ66fHxH4f6D+j
    oxPQ5k5Fsck4VJS9GSlCRVkor09ptBvsiYDuMOoRC9b51YwXTDDAbWplNOd5YSrt
    AtVjdKJz/BoKRO7KY9Owxs54au+DLxqfDDSeKRokjoRW+CE0lnXp5RX3zCAcF3+r
    8MpTi9D9lYSBEzs84BDmCQKBgQCMcH6/K3HcJJVn0fd+tyUGftUw9sswxjySJNbk
    pZrH263/qWMDls+Xf5kire9MU1ZCAWZiaN0NFoed/2wcVpGEDAV0548u/30r4bKr
    YjOcdhmiJNYFJ1qdF0MDib2CDvpB1IbZXrX46RujDO2urbJ435HxKNVhR/had8xc
    tyKYxQKBgCVDhN0MhnlUQJVZfX42APmF4gQg0r3sfL/NGXjEjMIKKFe5a88eZVHr
    L8x1+dp0q7czC8a/l1DUuiwDKl8OEpxLsGCq/J/wAfrSMPifu6EUlbUwlJOPdgha
    +p/KFAelHXJ2w/8yackAcarh35VP7ixhuvxswHNdgvfsBTFcjn30
    -----END RSA PRIVATE KEY-----

  ## Concourse Worker Keys.
  ## Ref: https://concourse-ci.org/install.html#generating-keys
  ##
  workerKey: |-
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEAuPehUmBXAQCoA7TLAQCYhf+vzcZVyj+VGXnMhLHnWLk7dRjo
    CU8GgNamdS5h7G3ywxOvKA3YjOLr8XyOMLS4c+e8N7tIzlMWdiXhe0lcBH9Z1ai5
    +Bof3/BlDUBksiKdc1A+QcfX6tDwMkOO5re1H4vOK3H/Cype58wCB03HYNgb05ED
    fW1Bj2qvz29VtmyjwEMuDs100iMqwCfPUx9oxXmmX8sUBRmw/Y1Rx/8pdKIjKw3m
    kWIHHBOSCPimO1qC47Aa8v/UH9hERCykyuFHiBiKlnIvZWm9bYvhsRTz4gt5KzRY
    6OI0oVeHlLOHDSK48Da8VWij15lOqO2Nx6WssQIDAQABAoIBADET22UNFOi6MNpS
    5S5N5ypezlnOD0NLnZcV3zMyNQ0wkNsgEakuo64Zxi7/cJIYFjq2hVoeWl//cdUw
    VFYODYcLbMBo3AeKukH9CRf6PgUfeUmcrENtQxnbIiTi+hTd5GMNXod7rAmtCJ59
    mHQVOGS3ZqvWYnKm+mmMktk3RPinynX/A4y3WHPacuAS58HM09Ck43WcHMxbGpsL
    /gZpICyFYZ2DviM+AHyWGcmw7LJrpC0QHo6+BAFMs4xlUecNgVIFUpfOoAcfsdtG
    K9j4AbuZ47iFisbay+1pyg/7O5eRTdGVQRtc7PBMOjea5jGsfmlDmdn1ZS50ykun
    ANfoQ5UCgYEA9Ak73PRy9nLlRkt4OBCF/4fwThUCMedsnWaVjQBMJYim4FB2ivF5
    cKdWt3y/RZI85KKYu0EXhLEoSIEAfz057R8t3QdVK4tZx6B47UFjBjCYeVMtwHDQ
    prxQiOPHIHCplBNFuGzA5VXL9gQLRD+ek0uOy2GJJ0Wu1xyeouI+SW8CgYEAwgkO
    TOtOogqmcAALjWgeeQiZetflSKbJlpQNhmCPAMm0SFI8eF4SpRXLzd41VC2mLIwT
    L3tjc7/8ocXoElFM4L0fo9Lx/SHFH4JEn5FT0PXPmvsF2JRhsXJFLJSihxF/91Xs
    2aBcQILPFzLcrI6OFUakNwGTU/CIxpkzRvQrG98CgYEAzNVnUuo4CNadzagRK3Xr
    E3Yl5VRK+FpY17FAfA6w25xc/dFr/un61e0Po4no/ltmEz7LVfmn5O/ScTEemq5o
    jbjrBShfe+JGpIH0nqiQlqR5hvSjZXEMIbfVHWGbRYZrQGgA0HEwZA7k2QXB8zI3
    R0lXfSzMM5OQ0uwp12xxfa8CgYBHILq1R6zTicPpWprhg0FobNaWSX4rW7iaEjvC
    /rJtP4Nu33Z7SUDcc1j6ZnJ2ISXBPrfpt/mE/OPHCZ1A2bysxadLjpBWkoKIQmCV
    fdiTyQgJb+t8sSf+vDzPUs0hZjDaogzo2ff3TfxMLMDoIHnFItgfsdwn8QyygIZj
    hC4pUQKBgQDqsxnkI6yXFE5gshnW7H8zqKNlzKd/dZEL6e+lRz4R3UY/KcEkRAfq
    Yi3cwo9fE3U3kSmpl5MQwUjWm/BZ7JyueoY/4ndwaFPgc34IKsgJ0wau9pZiQAB1
    DxpOSF+BR71Jx3sxvIdCODNTtm645j5yrZVnJAuMPofo5XFmunDoJA==
    -----END RSA PRIVATE KEY-----

  workerKeyPub: |-
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC496FSYFcBAKgDtMsBAJiF/6/NxlXKP5UZecyEsedYuTt1GOgJTwaA1qZ1LmHsbfLDE68oDdiM4uvxfI4wtLhz57w3u0jOUxZ2JeF7SVwEf1nVqLn4Gh/f8GUNQGSyIp1zUD5Bx9fq0PAyQ47mt7Ufi84rcf8LKl7nzAIHTcdg2BvTkQN9bUGPaq/Pb1W2bKPAQy4OzXTSIyrAJ89TH2jFeaZfyxQFGbD9jVHH/yl0oiMrDeaRYgccE5II+KY7WoLjsBry/9Qf2ERELKTK4UeIGIqWci9lab1ti+GxFPPiC3krNFjo4jShV4eUs4cNIrjwNrxVaKPXmU6o7Y3Hpayx Concourse

  ## Secrets for DB access
  ##
  postgresUser:
  postgresPassword:
  postgresCaCert:
  postgresClientCert:
  postgresClientKey:

  ## Secrets for DB encryption
  ##
  encryptionKey:
  oldEncryptionKey:

  ## Secrets for SSM AWS access
  ##
  awsSsmAccessKey:
  awsSsmSecretKey:
  awsSsmSessionToken:

  ## Secrets for Secrets Manager AWS access
  ##
  awsSecretsmanagerAccessKey:
  awsSecretsmanagerSecretKey:
  awsSecretsmanagerSessionToken:

  ## Secrets for using CredHub as a credential manager.
  ##
  ## Value of PEM-encoded CA cert file to use to verify the CredHub server SSL cert.
  ##
  credhubCaCert:

  ## Client ID for CredHub authorization.
  ##
  credhubClientId:

  ## Client secret for CredHub authorization.
  ##
  credhubClientSecret:

  ## Client cert for Credhub authorization
  ##
  credhubClientCert:

  ## Client key for Credhub authorization
  ##
  credhubClientKey:

  ## Secrets for CF OAuth
  ##
  cfClientId:
  cfClientSecret:
  cfCaCert:

  ## Secrets for BitbucketCloud OAuth.
  ##
  bitbucketCloudClientId:
  bitbucketCloudClientSecret:

  ## Secrets for GitHub OAuth.
  ##
  githubClientId:
  githubClientSecret:
  githubCaCert:

  ## Secrets for GitLab OAuth.
  ##
  gitlabClientId:
  gitlabClientSecret:

  ## Secrets for LDAP Auth.
  ##
  ldapCaCert:

  ## Secrets for generic OAuth.
  ##
  oauthClientId:
  oauthClientSecret:
  oauthCaCert:

  ## Secrets for oidc OAuth.
  ##
  oidcClientId:
  oidcClientSecret:
  oidcCaCert:

  ## Secrets for using Hashcorp Vault as a credential manager.
  ##
  ## if the Vault server is using a self-signed certificate, provide the CA public key.
  ## the value will be written to /concourse-vault/ca.cert
  ##
  vaultCaCert:

  ## initial periodic token issued for concourse
  ## Ref: https://www.vaultproject.io/docs/concepts/tokens.html#periodic-tokens
  ##
  vaultClientToken:

  ## vault authentication parameters
  ## Parameter to pass when logging in via the backend
  ## Required for "approle" authenication method
  ## e.g. "role_id:x,secret_id:x"
  ## Ref: https://concourse-ci.org/vault-credential-manager.html#vault-approle-auth
  ##
  vaultAuthParam:

  ## provide the client certificate for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend
  ## the value will be written to /concourse-vault/client.cert
  ## make sure to also set credentialManager.vault.authBackend to `cert`
  ##
  vaultClientCert:

  ## provide the client key for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend
  ## the value will be written to /concourse-vault/client.key
  ## make sure to also set credentialManager.vault.authBackend to `cert`
  ##
  vaultClientKey:

  ## If influxdb metrics are enabled and authentication is required,
  ## provide a password here to authenticate with the influxdb server configured.
  ##
  influxdbPassword:

  ## SSL certificate used to verify the Syslog server for draining build logs.
  ##
  syslogCaCert:
