Validating YAML Block Scalar

[nw-code]

Hi all, I'm just starting out in cue and was hoping to get some assistance. I'm using k8s (EKS) pretty heavily and am keen to put cue to work to help - primarily with validation. However, I've hit a bit of a wall trying to validate the aws-auth ConfigMap.

This is an example of my ConfigMap (aws-auth.yaml):

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::012345678912:role/eks-main-workers
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
    - rolearn: arn:aws:iam::012345678912:role/ci-infra
      username: ci-infra
      groups:
        - system:masters

I've come up with the following cue (aws-auth.cue) in an effort to validate the above:

import "encoding/yaml"

#awsMapRole: {
    rolearn:  =~"^arn:aws:iam::[0-9]{12}:role/[\\w+=,.@-]{1,64}$"
    username: =~"^[\\w:{}-]+$"
    groups: [...string]
}

apiVersion: "v1"
kind:       "ConfigMap"
metadata: {
    name:      "aws-auth"
    namespace: "kube-system"
}

data: mapRoles: yaml.Validate([...#awsMapRole])

This is the result I get:

$ cue version
cue version v0.4.3 darwin/amd64

$ cue vet aws-auth.yaml aws-auth.cue
data.mapRoles: invalid value "- rolearn: arn:aws:iam::012345678912:role/eks-main-workers\n  username: system:node:{{EC2PrivateDNSName}}\n  groups:\n    - system:bootstrappers\n    - system:nodes\n- rolearn: arn:aws:iam::012345678912:role/ci-infra\n  username: ci-infra\n  groups:\n    - system:masters\n" (does not satisfy encoding/yaml.Validate([])): non-concrete argument 1:
    ./aws-auth.cue:16:17
    ./aws-auth.yaml:7:14

Via some experimentation, I've discovered that the following change to aws-auth.cue works when vetted against the above aws-auth.yaml example:

$ diff -u aws-auth.cue aws-auth-fix.cue 
--- aws-auth.cue        2023-02-21 09:28:51
+++ aws-auth-fix.cue    2023-02-21 09:29:18
@@ -15,4 +15,4 @@
        namespace: "kube-system"
 }
 
-data: mapRoles: yaml.Validate([...#awsMapRole])
+data: mapRoles: yaml.Validate([#awsMapRole, #awsMapRole])

However, the 'fix' obviously isn't suitable given that the number of entries in the aws-auth.yaml is not static - i.e. I've had to tailor my cue configuration to this specific example aws-auth.yaml.

Would really appreciate any feedback, suggestions regarding this. I'm pretty new to cue so hopefully I'm just missing something simple.

Kind regards

Nick