We're using Flux Substitution in combination with tk export in order to pass in some externally managed references and template secrets out of other secrets

e.g. the tanka rendered manifest

apiVersion: v1
kind: Secret
metadata:
  name: test
stringData:
  TEST_INT: ${SOME_INT}

with the variable SOME_INT="1234" would be substituted to

apiVersion: v1
kind: Secret
metadata:
  name: test
stringData:
  TEST_INT: 1234

which is not a valid Kubernetes secret. With Kustomize I used to prevent this by quoting those references:

apiVersion: v1
kind: Secret
metadata:
  name: test
stringData:
  TEST_INT: "${SOME_INT}"

Is this something worth exploring Tanka or an edge case you don't want to support? As mitigation we're now setting SOME_INT="'1234'" which is not very elegant :-)