postBuild substituteFrom secret envsubst error YAMLToJSON

[rcarre]

Describe the bug

Flux kustomization postBuild failing with error message postBuild 'post build failed for ''sourceSecret'': envsubst error: YAMLToJSON: yaml: line 8: did not find expected alphabetic or numeric character'

The postBuild substitution works fine with secret values not starting with character * in plain text

However when encoded in base64, there is no special character but who knows the way Flux does manage the secret value substitution: in plain text (then we have special characters) or in base64 ?

Steps to reproduce

Here is the source yaml secret snippet

apiVersion: v1
data:
  password: KlFyMU4nSylAbSNXLSR7eTtkbCg=
kind: Secret
metadata:
  name: sourceSecret
  namespace: myNamespace

Here is yaml Flux kusto snippet

---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
 name: myService
 namespace: myNamespace
spec:
 path: ./myPath
 postBuild:
   substituteFrom:
   - kind: Secret
     name: sourceSecret

Here is the target yaml secret snippet

---
apiVersion: v1
kind: Secret
metadata:
  name: targetSecret
stringData:
  password: ${password}
type: Opaque

Expected behavior

Expected the target secret workload

---
apiVersion: v1
data:
  password: KlFyMU4nSylAbSNXLSR7eTtkbCg=
kind: Secret
metadata:
  name: targetSecret
type: Opaque

Screenshots and recordings

Also gave a try with this target secret yaml syntax

---
apiVersion: v1
kind: Secret
metadata:
  name: targetSecret
stringData:
  password: ${quote}${password}${quote}
type: Opaque

### OS / Distro

N/A

### Flux version

2.3.0

### Flux check

N/A

### Git provider

_No response_

### Container Registry provider

_No response_

### Additional context

_No response_

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

[rcarre]

Does anyone have an idea at which step and the way I should escape the leading * for password key value ? Thx

[JordanP]

I have the same issue with dns, trying to pass a wildcard dns name that starts with *.