code: func (r *ImportCAConfigsRPC) SetupConfigValidation(rules *validation.RuleSet) {
  	// Validate CA config protos are well-formed.
  	rules.Add("services/${appid}", configFile, func(ctx *validation.Context, configSet, path string, content []byte) error {
  		cfg := &admin.TokenServerConfig{}
  		if err := proto.UnmarshalText(string(content), cfg); err != nil {
  			ctx.Errorf("not a valid TokenServerConfig proto message - %s", err)
  			return nil
  		}
  		// These are needed to validate unique_ids are not reused. If this call
  		// fails, the validation callback will be retried.
  		idToCN, err := LoadCAUniqueIDToCNMap(ctx.Context)
  		if err != nil {
  			return errors.Annotate(err, "can't load unique_id map").Tag(transient.Tag).Err()
  		}
  		validateCAConfigs(ctx, cfg, idToCN)
  		return nil
  	})
  
  	// Validate the CA certificates are well-formed.
  	rules.Add("services/${appid}", `regex:certs/.*\.pem`, func(ctx *validation.Context, configSet, path string, content []byte) error {
  		if _, _, err := decodeCACert(string(content)); err != nil {
  			ctx.Errorf("bad CA certificate file - %s", err)
  		}
  		return nil
  	})
  }
docs: // SetupConfigValidation registers the config validation rules.