concourse:
  web:
    externalUrl: https://ci.nono.io
    localAuth:
      enabled: false
    vault:
      enabled: true
      url: https://vault.nono.io:443
      authBackend: approle
      useAuthParam: true
    auth:
      duration: 240h
      mainTeam:
        github:
          org: blabbertabber
      github:
        enabled: true
web:
  ingress:
    enabled: true
    annotations:
      cert-manager.io/issuer: letsencrypt-prod
      kubernetes.io/ingress.class: nginx
    hosts:
    - ci.nono.io
    tls:
    - hosts:
      - ci.nono.io
      secretName: ci.nono.io
worker:
  # The following should be `true` (default) for almost everyone. I don't want workers
  # because I bring my own worker separately, which is on vSphere not GKE.
  enabled: false
secrets:
  # If the value is "change-me", that means it's overridden from the command line,
  # e.g. "helm upgrade ci-nono-io concourse/concourse ... --set secrets.hostKey='xxx' ... "
  localUsers:
  githubClientId: fc24016a9c3267843698
  githubClientSecret: change-me
  hostKey: change-me
  hostKeyPub: change-me
  workerKey: change-me
  workerKeyPub: change-me
  sessionSigningKey: change-me
  vaultAuthParam: change-me

concourse:
  web:
    externalUrl: https://ci.nono.io
    localAuth:
      enabled: false
    kubernetes:
      enabled: false
    vault:
      enabled: true
      url: https://vault.nono.io:443
      authBackend: approle
      useAuthParam: true
    auth:
      duration: 240h
      mainTeam:
        github:
          org: blabbertabber
      github:
        enabled: true
web:
  ingress:
    enabled: true
    annotations:
      cert-manager.io/issuer: letsencrypt-prod
      kubernetes.io/ingress.class: nginx
    hosts:
    - ci.nono.io
    tls:
    - hosts:
      - ci.nono.io
      secretName: ci.nono.io
worker:
  # The following should be `true` (default) for almost everyone. I don't want workers
  # because I bring my own worker separately, which is on vSphere not GKE.
  enabled: false
secrets:
  # If the value is "change-me", that means it's overridden from the command line,
  # e.g. "helm upgrade ci-nono-io concourse/concourse ... --set secrets.hostKey='xxx' ... "
  localUsers:
  githubClientId: fc24016a9c3267843698
  githubClientSecret: change-me
  hostKey: change-me
  hostKeyPub: change-me
  workerKey: change-me
  workerKeyPub: change-me
  sessionSigningKey: change-me
  vaultAuthParam: change-me

Enable Concourse to access Vault's secrets
Enable Concourse to access Vault's secrets

The new helm chart broke our secrets, causing the secrets to be
incorrectly pulled from k8s instead of Vault.

We fix it by disabling k8s as a secrets store for Concourse.

Fixes:
```
failed to interpolate task config: undefined vars: ozymandias-secret
```
```
{"timestamp":"2022-07-06T20:00:15.608982778Z","level":"info","source":"atc","message":"atc.credential-manager.secret-not-found","data":{"name":"kubernetes","namespace":"ci-main","secret-name":"ozymandias-pipeline.ozymandias-secret","session":"7"}}
```
