Strange issue with kustomize-mutating-webhook during bootstrap

[pipitonelabs]

Just admiring your wonderful work, experimenting with a fresh Talos install here. During the task flux:bootstrap process, I received this error. Would be grateful if you could provide any insight on this?

✗ Kustomization/flux-system/kustomize-mutating-webhook dry-run failed: failed to create typed patch object (flux-system/kustomize-mutating-webhook; kustomize.toolkit.fluxcd.io/v1, Kind=Kustomization): .metadata.labels.substitution.flux/enabled: expected string, got &value.valueUnstructured{Value:true} task: Failed to run task "flux:bootstrap": exit status 1

I was able to get around this by editing the ks.yaml located at kubernetes/clusters/cluster-0/kustomize-mutating-webhook/ks.yaml on line 9 to be:

substitution.flux/enabled: "true"

instead of

substitution.flux/enabled: true

Great setup here!

[xunholy]

Thanks @tslamars - I'm considering removing that label now I have the mutating webhook, I'll likely just set it up so that everything in flux-system refs the resources directly (ConfigMap and Secret) and all other resources I'll remove it, the only reason I've left it currently is it's also doing the SOPs decryption patch but I will probably just hardcode that into each ks.yaml resource.

[hiSandog]

Kubernetes labels are string-valued even when YAML accepts a bare boolean, so quoting "true" is the correct manifest shape. This could be caught before bootstrap by rendering the Kustomization and running schema validation (or a small policy that rejects non-string label values) in CI. Keeping the label while the webhook still depends on it is fine; the important part is preventing YAML scalar coercion from reaching the typed patch step.