TLS secrets does not follow standard Kubernetes TLS secret format

Certificate created using cert manager and with kubectl create secret tls will generate a standardized secret like:

data:
  ca.crt: <redacted>
  tls.key: <redacted>
  tls.crt: <redacted>

Because the Conourse Helm Chart does not comply to this standard, it makes it impossible to have certificate provisioners automatically feed secrets to concourse. Certificate data needs to be manually duplicated and is not a safe practice.

An example would be https://github.com/concourse/concourse-chart/blob/94c54aa054fe53c5603114e881c26f38b3598d4a/templates/web-deployment.yaml#L300

- name: CONCOURSE_TLS_CERT
  value: "{{ .Values.web.tlsSecretsPath }}/client.cert"
- name: CONCOURSE_TLS_KEY
  value: "{{ .Values.web.tlsSecretsPath }}/client.key"

Sadly, I don't see an easy fix to this as it would involved refactoring all secret management for the entire helm chart. Maybe that could be considered for a future new major or minor version.

Start with templates/web-deployment.yaml, especially the CONCOURSE_TLS_CERT and CONCOURSE_TLS_KEY references, then trace how TLS secrets are managed across the chart. Compare the rendered secret keys with the Kubernetes TLS secret format; done means certificate provisioners can supply the standard secret without manual duplication.