Say where the string coercion has to happen

A ConfigMap's data values must be strings and this template cannot enforce it:
kustomize re-serialises before Flux substitutes, stripping quotes and !!str
alike, so a value that looks numeric or boolean parses as one and the apply
fails on the type. The quotes have to be inside the substituted value.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/configmap.yaml

@@ -1,7 +1,14 @@
-# Every substituted value is quoted. A ConfigMap's data values must be strings,
-# and an unquoted ${VAR} that resolves to a number or a boolean becomes one in
-# YAML — the apply then fails on the type, naming a field the operator never
-# wrote a type for.
+# A ConfigMap's data values must be **strings**, and this file cannot enforce
+# that: kustomize re-serialises before Flux substitutes, stripping both quotes
+# and an `!!str` tag, so `${VAR}` is always bare by the time a value lands in it.
+# A value that then looks like a number or a boolean parses as one and the apply
+# fails on the type.
+#
+# So any value substituted here that is not obviously text must carry its own
+# quotes in the substitution map:
+#
+#     EXECUTIONS_MAX_AGE_HOURS: '"336"'
+#     BLOCK_ENV_ACCESS: '"false"'
 #
 # Nothing here is sensitive. The two values that are — the database password and
 # the credential encryption key — arrive through n8n-secrets.
@@ -11,15 +18,15 @@ metadata:
   name: n8n-config
   namespace: ${NAMESPACE}
 data:
-  GENERIC_TIMEZONE: "${TIMEZONE}"
-  TZ: "${TIMEZONE}"
+  GENERIC_TIMEZONE: ${TIMEZONE}
+  TZ: ${TIMEZONE}
   NODE_ENV: production
 
   # What n8n believes it is reachable at. It goes into the webhook URLs it
   # generates and into the links it puts in its own UI, so it must be the
   # ingress host and not the Service — a webhook advertised as `n8n` inside the
   # cluster is a webhook nothing outside can call.
-  N8N_HOST: "${N8N_HOSTNAME}"
+  N8N_HOST: ${N8N_HOSTNAME}
   N8N_PORT: "5678"
   N8N_PROTOCOL: https
   WEBHOOK_URL: https://${N8N_HOSTNAME}/
@@ -33,7 +40,7 @@ data:
   # The default is to keep every execution for ever, which turns the database
   # into a log. Two weeks is long enough to debug a failed run.
   EXECUTIONS_DATA_PRUNE: "true"
-  EXECUTIONS_DATA_MAX_AGE: "${EXECUTIONS_MAX_AGE_HOURS}"
+  EXECUTIONS_DATA_MAX_AGE: ${EXECUTIONS_MAX_AGE_HOURS}
   N8N_DIAGNOSTICS_ENABLED: "false"
   N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
   N8N_RUNNERS_ENABLED: "true"
@@ -42,4 +49,4 @@ data:
   # workflow without being stored in the workflow JSON. n8n blocks it by
   # default, and that default is right wherever more than one team can write a
   # workflow: any workflow can then read any variable in the pod.
-  N8N_BLOCK_ENV_ACCESS_IN_NODE: "${BLOCK_ENV_ACCESS}"
+  N8N_BLOCK_ENV_ACCESS_IN_NODE: ${BLOCK_ENV_ACCESS}