diff --git a/cmd/cue/cmd/testdata/script/def_openapi.txt b/cmd/cue/cmd/testdata/script/def_openapi.txt
index 892d449..fc38380 100644
--- a/cmd/cue/cmd/testdata/script/def_openapi.txt
+++ b/cmd/cue/cmd/testdata/script/def_openapi.txt
@@ -117,30 +117,30 @@
 -- expect-yaml-out --
 openapi: 3.0.0
 info:
-    title: Some clever title.
-    version: v1
+  title: Some clever title.
+  version: v1
 paths: {}
 components:
-    schemas:
-        Bar:
-            type: object
-            required:
-              - foo
-            properties:
-                foo:
-                    $ref: '#/components/schemas/Foo'
-        Foo:
-            type: object
-            required:
-              - a
-              - b
-            properties:
-                a:
-                    type: integer
-                b:
-                    type: integer
-                    minimum: 0
-                    exclusiveMaximum: 10
+  schemas:
+    Bar:
+      type: object
+      required:
+      - foo
+      properties:
+        foo:
+          $ref: '#/components/schemas/Foo'
+    Foo:
+      type: object
+      required:
+      - a
+      - b
+      properties:
+        a:
+          type: integer
+        b:
+          type: integer
+          minimum: 0
+          exclusiveMaximum: 10
 -- expect-cue-out --
 openapi: "3.0.0"
 info: {
diff --git a/doc/tutorial/kubernetes/testdata/manual.out b/doc/tutorial/kubernetes/testdata/manual.out
index 4f0b732..4328753 100644
--- a/doc/tutorial/kubernetes/testdata/manual.out
+++ b/doc/tutorial/kubernetes/testdata/manual.out
@@ -5236,18 +5236,18 @@
             data: {
                 "alerts.yaml": """
         receivers:
-          - name: pager
-            slack_configs:
-              - text: |-
-                    {{ range .Alerts }}{{ .Annotations.description }}
-                    {{ end }}
-                channel: '#cloudmon'
-                send_resolved: true
+        - name: pager
+          slack_configs:
+          - text: |-
+              {{ range .Alerts }}{{ .Annotations.description }}
+              {{ end }}
+            channel: '#cloudmon'
+            send_resolved: true
         route:
-            receiver: pager
-            group_by:
-              - alertname
-              - cluster
+          receiver: pager
+          group_by:
+          - alertname
+          - cluster
         
         """
             }
@@ -5340,18 +5340,18 @@
     alertmanager: {
         "alerts.yaml": """
         receivers:
-          - name: pager
-            slack_configs:
-              - text: |-
-                    {{ range .Alerts }}{{ .Annotations.description }}
-                    {{ end }}
-                channel: '#cloudmon'
-                send_resolved: true
+        - name: pager
+          slack_configs:
+          - text: |-
+              {{ range .Alerts }}{{ .Annotations.description }}
+              {{ end }}
+            channel: '#cloudmon'
+            send_resolved: true
         route:
-            receiver: pager
-            group_by:
-              - alertname
-              - cluster
+          receiver: pager
+          group_by:
+          - alertname
+          - cluster
         
         """
     }
@@ -6052,229 +6052,229 @@
             data: {
                 "alert.rules": """
         groups:
-          - name: rules.yaml
-            rules:
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} of job {{ $labels.job }} has been down for
-                        more than 30 seconds.'
-                    summary: Instance {{$labels.app}} down
-                alert: InstanceDown
-                expr: up == 0
-                for: 30s
-              - labels:
-                    severity: page
-                annotations:
-                    description: If one more etcd peer goes down the cluster will be unavailable
-                    summary: etcd cluster small
-                alert: InsufficientPeers
-                expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
-                for: 3m
-              - labels:
-                    severity: page
-                annotations:
-                    summary: No ETCD master elected.
-                alert: EtcdNoMaster
-                expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
-                for: 1s
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value
-                        }} times in 5m.'
-                    summary: Pod for {{$labels.container}} restarts too often
-                alert: PodRestart
-                expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
-                    > 2
-                for: 1m
+        - name: rules.yaml
+          rules:
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} of job {{ $labels.job }} has been down for more
+                than 30 seconds.'
+              summary: Instance {{$labels.app}} down
+            alert: InstanceDown
+            expr: up == 0
+            for: 30s
+          - labels:
+              severity: page
+            annotations:
+              description: If one more etcd peer goes down the cluster will be unavailable
+              summary: etcd cluster small
+            alert: InsufficientPeers
+            expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
+            for: 3m
+          - labels:
+              severity: page
+            annotations:
+              summary: No ETCD master elected.
+            alert: EtcdNoMaster
+            expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
+            for: 1s
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value }}
+                times in 5m.'
+              summary: Pod for {{$labels.container}} restarts too often
+            alert: PodRestart
+            expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
+              > 2
+            for: 1m
         
         """
                 "prometheus.yml": """
         global:
-            scrape_interval: 15s
+          scrape_interval: 15s
         rule_files:
-          - /etc/prometheus/alert.rules
+        - /etc/prometheus/alert.rules
         alerting:
-            alertmanagers:
-              - scheme: http
-                static_configs:
-                  - targets:
-                      - alertmanager:9093
+          alertmanagers:
+          - scheme: http
+            static_configs:
+            - targets:
+              - alertmanager:9093
         scrape_configs:
-          - scheme: https
-            job_name: kubernetes-apiservers
-            kubernetes_sd_configs:
-              - role: endpoints
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                  - __meta_kubernetes_service_name
-                  - __meta_kubernetes_endpoint_port_name
-                action: keep
-                regex: default;kubernetes;https
-          - scheme: https
-            job_name: kubernetes-nodes
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics
-          - scheme: https
-            job_name: kubernetes-cadvisor
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
-          - job_name: kubernetes-service-endpoints
-            kubernetes_sd_configs:
-              - role: endpoints
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scrape
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scheme
-                action: replace
-                regex: (https?)
-                target_label: __scheme__
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_path
-                action: replace
-                regex: (.+)
-                target_label: __metrics_path__
-              - source_labels:
-                  - __address__
-                  - __meta_kubernetes_service_annotation_prometheus_io_port
-                action: replace
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                action: replace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_service_name
-                action: replace
-                target_label: kubernetes_name
-          - job_name: kubernetes-services
-            kubernetes_sd_configs:
-              - role: service
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_probe
-                action: keep
-                regex: true
-              - source_labels:
-                  - __address__
-                target_label: __param_target
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_service_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-ingresses
-            kubernetes_sd_configs:
-              - role: ingress
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_ingress_annotation_prometheus_io_probe
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_ingress_scheme
-                  - __address__
-                  - __meta_kubernetes_ingress_path
-                regex: (.+);(.+);(.+)
-                target_label: __param_target
-                replacement: ${1}://${2}${3}
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_ingress_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_ingress_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-pods
-            kubernetes_sd_configs:
-              - role: pod
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_scrape
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_path
-                action: replace
-                regex: (.+)
-                target_label: __metrics_path__
-              - source_labels:
-                  - __address__
-                  - __meta_kubernetes_pod_annotation_prometheus_io_port
-                action: replace
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_pod_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                action: replace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_pod_name
-                action: replace
-                target_label: kubernetes_pod_name
+        - scheme: https
+          job_name: kubernetes-apiservers
+          kubernetes_sd_configs:
+          - role: endpoints
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_namespace
+            - __meta_kubernetes_service_name
+            - __meta_kubernetes_endpoint_port_name
+            action: keep
+            regex: default;kubernetes;https
+        - scheme: https
+          job_name: kubernetes-nodes
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics
+        - scheme: https
+          job_name: kubernetes-cadvisor
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
+        - job_name: kubernetes-service-endpoints
+          kubernetes_sd_configs:
+          - role: endpoints
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scrape
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scheme
+            action: replace
+            regex: (https?)
+            target_label: __scheme__
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_path
+            action: replace
+            regex: (.+)
+            target_label: __metrics_path__
+          - source_labels:
+            - __address__
+            - __meta_kubernetes_service_annotation_prometheus_io_port
+            action: replace
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            action: replace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_service_name
+            action: replace
+            target_label: kubernetes_name
+        - job_name: kubernetes-services
+          kubernetes_sd_configs:
+          - role: service
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_probe
+            action: keep
+            regex: true
+          - source_labels:
+            - __address__
+            target_label: __param_target
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_service_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-ingresses
+          kubernetes_sd_configs:
+          - role: ingress
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_ingress_annotation_prometheus_io_probe
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_ingress_scheme
+            - __address__
+            - __meta_kubernetes_ingress_path
+            regex: (.+);(.+);(.+)
+            target_label: __param_target
+            replacement: ${1}://${2}${3}
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_ingress_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_ingress_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-pods
+          kubernetes_sd_configs:
+          - role: pod
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_scrape
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_path
+            action: replace
+            regex: (.+)
+            target_label: __metrics_path__
+          - source_labels:
+            - __address__
+            - __meta_kubernetes_pod_annotation_prometheus_io_port
+            action: replace
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_pod_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            action: replace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_pod_name
+            action: replace
+            target_label: kubernetes_pod_name
         
         """
             }
@@ -6374,229 +6374,229 @@
     prometheus: {
         "alert.rules": """
         groups:
-          - name: rules.yaml
-            rules:
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} of job {{ $labels.job }} has been down for
-                        more than 30 seconds.'
-                    summary: Instance {{$labels.app}} down
-                alert: InstanceDown
-                expr: up == 0
-                for: 30s
-              - labels:
-                    severity: page
-                annotations:
-                    description: If one more etcd peer goes down the cluster will be unavailable
-                    summary: etcd cluster small
-                alert: InsufficientPeers
-                expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
-                for: 3m
-              - labels:
-                    severity: page
-                annotations:
-                    summary: No ETCD master elected.
-                alert: EtcdNoMaster
-                expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
-                for: 1s
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value
-                        }} times in 5m.'
-                    summary: Pod for {{$labels.container}} restarts too often
-                alert: PodRestart
-                expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
-                    > 2
-                for: 1m
+        - name: rules.yaml
+          rules:
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} of job {{ $labels.job }} has been down for more
+                than 30 seconds.'
+              summary: Instance {{$labels.app}} down
+            alert: InstanceDown
+            expr: up == 0
+            for: 30s
+          - labels:
+              severity: page
+            annotations:
+              description: If one more etcd peer goes down the cluster will be unavailable
+              summary: etcd cluster small
+            alert: InsufficientPeers
+            expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
+            for: 3m
+          - labels:
+              severity: page
+            annotations:
+              summary: No ETCD master elected.
+            alert: EtcdNoMaster
+            expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
+            for: 1s
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value }}
+                times in 5m.'
+              summary: Pod for {{$labels.container}} restarts too often
+            alert: PodRestart
+            expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
+              > 2
+            for: 1m
         
         """
         "prometheus.yml": """
         global:
-            scrape_interval: 15s
+          scrape_interval: 15s
         rule_files:
-          - /etc/prometheus/alert.rules
+        - /etc/prometheus/alert.rules
         alerting:
-            alertmanagers:
-              - scheme: http
-                static_configs:
-                  - targets:
-                      - alertmanager:9093
+          alertmanagers:
+          - scheme: http
+            static_configs:
+            - targets:
+              - alertmanager:9093
         scrape_configs:
-          - scheme: https
-            job_name: kubernetes-apiservers
-            kubernetes_sd_configs:
-              - role: endpoints
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                  - __meta_kubernetes_service_name
-                  - __meta_kubernetes_endpoint_port_name
-                action: keep
-                regex: default;kubernetes;https
-          - scheme: https
-            job_name: kubernetes-nodes
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics
-          - scheme: https
-            job_name: kubernetes-cadvisor
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
-          - job_name: kubernetes-service-endpoints
-            kubernetes_sd_configs:
-              - role: endpoints
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scrape
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scheme
-                action: replace
-                regex: (https?)
-                target_label: __scheme__
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_path
-                action: replace
-                regex: (.+)
-                target_label: __metrics_path__
-              - source_labels:
-                  - __address__
-                  - __meta_kubernetes_service_annotation_prometheus_io_port
-                action: replace
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                action: replace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_service_name
-                action: replace
-                target_label: kubernetes_name
-          - job_name: kubernetes-services
-            kubernetes_sd_configs:
-              - role: service
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_probe
-                action: keep
-                regex: true
-              - source_labels:
-                  - __address__
-                target_label: __param_target
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_service_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-ingresses
-            kubernetes_sd_configs:
-              - role: ingress
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_ingress_annotation_prometheus_io_probe
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_ingress_scheme
-                  - __address__
-                  - __meta_kubernetes_ingress_path
-                regex: (.+);(.+);(.+)
-                target_label: __param_target
-                replacement: ${1}://${2}${3}
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_ingress_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_ingress_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-pods
-            kubernetes_sd_configs:
-              - role: pod
-            relabel_configs:
-              - source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_scrape
-                action: keep
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_path
-                action: replace
-                regex: (.+)
-                target_label: __metrics_path__
-              - source_labels:
-                  - __address__
-                  - __meta_kubernetes_pod_annotation_prometheus_io_port
-                action: replace
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_pod_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                action: replace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_pod_name
-                action: replace
-                target_label: kubernetes_pod_name
+        - scheme: https
+          job_name: kubernetes-apiservers
+          kubernetes_sd_configs:
+          - role: endpoints
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_namespace
+            - __meta_kubernetes_service_name
+            - __meta_kubernetes_endpoint_port_name
+            action: keep
+            regex: default;kubernetes;https
+        - scheme: https
+          job_name: kubernetes-nodes
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics
+        - scheme: https
+          job_name: kubernetes-cadvisor
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
+        - job_name: kubernetes-service-endpoints
+          kubernetes_sd_configs:
+          - role: endpoints
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scrape
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scheme
+            action: replace
+            regex: (https?)
+            target_label: __scheme__
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_path
+            action: replace
+            regex: (.+)
+            target_label: __metrics_path__
+          - source_labels:
+            - __address__
+            - __meta_kubernetes_service_annotation_prometheus_io_port
+            action: replace
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            action: replace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_service_name
+            action: replace
+            target_label: kubernetes_name
+        - job_name: kubernetes-services
+          kubernetes_sd_configs:
+          - role: service
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_probe
+            action: keep
+            regex: true
+          - source_labels:
+            - __address__
+            target_label: __param_target
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_service_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-ingresses
+          kubernetes_sd_configs:
+          - role: ingress
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_ingress_annotation_prometheus_io_probe
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_ingress_scheme
+            - __address__
+            - __meta_kubernetes_ingress_path
+            regex: (.+);(.+);(.+)
+            target_label: __param_target
+            replacement: ${1}://${2}${3}
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_ingress_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_ingress_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-pods
+          kubernetes_sd_configs:
+          - role: pod
+          relabel_configs:
+          - source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_scrape
+            action: keep
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_path
+            action: replace
+            regex: (.+)
+            target_label: __metrics_path__
+          - source_labels:
+            - __address__
+            - __meta_kubernetes_pod_annotation_prometheus_io_port
+            action: replace
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_pod_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            action: replace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_pod_name
+            action: replace
+            target_label: kubernetes_pod_name
         
         """
     }
diff --git a/doc/tutorial/kubernetes/testdata/quick.out b/doc/tutorial/kubernetes/testdata/quick.out
index 38b396e..a678e55 100644
--- a/doc/tutorial/kubernetes/testdata/quick.out
+++ b/doc/tutorial/kubernetes/testdata/quick.out
@@ -2476,18 +2476,18 @@
         data: {
             "alerts.yaml": """
         receivers:
-          - name: pager
-            slack_configs:
-              - text: |-
-                    {{ range .Alerts }}{{ .Annotations.description }}
-                    {{ end }}
-                channel: '#cloudmon'
-                send_resolved: true
+        - name: pager
+          slack_configs:
+          - text: |-
+              {{ range .Alerts }}{{ .Annotations.description }}
+              {{ end }}
+            channel: '#cloudmon'
+            send_resolved: true
         route:
-            receiver: pager
-            group_by:
-              - alertname
-              - cluster
+          receiver: pager
+          group_by:
+          - alertname
+          - cluster
         
         """
         }
@@ -2888,229 +2888,229 @@
         data: {
             "alert.rules": """
         groups:
-          - name: rules.yaml
-            rules:
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} of job {{ $labels.job }} has been down for
-                        more than 30 seconds.'
-                    summary: Instance {{$labels.app}} down
-                alert: InstanceDown
-                expr: up == 0
-                for: 30s
-              - labels:
-                    severity: page
-                annotations:
-                    description: If one more etcd peer goes down the cluster will be unavailable
-                    summary: etcd cluster small
-                alert: InsufficientPeers
-                expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
-                for: 3m
-              - labels:
-                    severity: page
-                annotations:
-                    summary: No ETCD master elected.
-                alert: EtcdNoMaster
-                expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
-                for: 1s
-              - labels:
-                    severity: page
-                annotations:
-                    description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value
-                        }} times in 5m.'
-                    summary: Pod for {{$labels.container}} restarts too often
-                alert: PodRestart
-                expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
-                    > 2
-                for: 1m
+        - name: rules.yaml
+          rules:
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} of job {{ $labels.job }} has been down for more
+                than 30 seconds.'
+              summary: Instance {{$labels.app}} down
+            alert: InstanceDown
+            expr: up == 0
+            for: 30s
+          - labels:
+              severity: page
+            annotations:
+              description: If one more etcd peer goes down the cluster will be unavailable
+              summary: etcd cluster small
+            alert: InsufficientPeers
+            expr: count(up{job=\"etcd\"} == 0) > (count(up{job=\"etcd\"}) / 2 - 1)
+            for: 3m
+          - labels:
+              severity: page
+            annotations:
+              summary: No ETCD master elected.
+            alert: EtcdNoMaster
+            expr: sum(etcd_server_has_leader{app=\"etcd\"}) == 0
+            for: 1s
+          - labels:
+              severity: page
+            annotations:
+              description: '{{$labels.app}} {{ $labels.container }} resturted {{ $value }}
+                times in 5m.'
+              summary: Pod for {{$labels.container}} restarts too often
+            alert: PodRestart
+            expr: (max_over_time(pod_container_status_restarts_total[5m]) - min_over_time(pod_container_status_restarts_total[5m]))
+              > 2
+            for: 1m
         
         """
             "prometheus.yml": """
         global:
-            scrape_interval: 15s
+          scrape_interval: 15s
         rule_files:
-          - /etc/prometheus/alert.rules
+        - /etc/prometheus/alert.rules
         alerting:
-            alertmanagers:
-              - scheme: http
-                static_configs:
-                  - targets:
-                      - alertmanager:9093
+          alertmanagers:
+          - scheme: http
+            static_configs:
+            - targets:
+              - alertmanager:9093
         scrape_configs:
-          - scheme: https
-            job_name: kubernetes-apiservers
-            kubernetes_sd_configs:
-              - role: endpoints
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: keep
-                source_labels:
-                  - __meta_kubernetes_namespace
-                  - __meta_kubernetes_service_name
-                  - __meta_kubernetes_endpoint_port_name
-                regex: default;kubernetes;https
-          - scheme: https
-            job_name: kubernetes-nodes
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics
-          - scheme: https
-            job_name: kubernetes-cadvisor
-            kubernetes_sd_configs:
-              - role: node
-            tls_config:
-                ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-            bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-            relabel_configs:
-              - action: labelmap
-                regex: __meta_kubernetes_node_label_(.+)
-              - target_label: __address__
-                replacement: kubernetes.default.svc:443
-              - source_labels:
-                  - __meta_kubernetes_node_name
-                regex: (.+)
-                target_label: __metrics_path__
-                replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
-          - job_name: kubernetes-service-endpoints
-            kubernetes_sd_configs:
-              - role: endpoints
-            relabel_configs:
-              - action: keep
-                source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scrape
-                regex: true
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_scheme
-                regex: (https?)
-                target_label: __scheme__
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_path
-                regex: (.+)
-                target_label: __metrics_path__
-              - action: replace
-                source_labels:
-                  - __address__
-                  - __meta_kubernetes_service_annotation_prometheus_io_port
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_service_name
-                target_label: kubernetes_name
-          - job_name: kubernetes-services
-            kubernetes_sd_configs:
-              - role: service
-            relabel_configs:
-              - action: keep
-                source_labels:
-                  - __meta_kubernetes_service_annotation_prometheus_io_probe
-                regex: true
-              - source_labels:
-                  - __address__
-                target_label: __param_target
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_service_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_service_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-ingresses
-            kubernetes_sd_configs:
-              - role: ingress
-            relabel_configs:
-              - action: keep
-                source_labels:
-                  - __meta_kubernetes_ingress_annotation_prometheus_io_probe
-                regex: true
-              - source_labels:
-                  - __meta_kubernetes_ingress_scheme
-                  - __address__
-                  - __meta_kubernetes_ingress_path
-                regex: (.+);(.+);(.+)
-                target_label: __param_target
-                replacement: ${1}://${2}${3}
-              - target_label: __address__
-                replacement: blackbox-exporter.example.com:9115
-              - source_labels:
-                  - __param_target
-                target_label: app
-              - action: labelmap
-                regex: __meta_kubernetes_ingress_label_(.+)
-              - source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - source_labels:
-                  - __meta_kubernetes_ingress_name
-                target_label: kubernetes_name
-            metrics_path: /probe
-            params:
-                module:
-                  - http_2xx
-          - job_name: kubernetes-pods
-            kubernetes_sd_configs:
-              - role: pod
-            relabel_configs:
-              - action: keep
-                source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_scrape
-                regex: true
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_pod_annotation_prometheus_io_path
-                regex: (.+)
-                target_label: __metrics_path__
-              - action: replace
-                source_labels:
-                  - __address__
-                  - __meta_kubernetes_pod_annotation_prometheus_io_port
-                regex: ([^:]+)(?::\\d+)?;(\\d+)
-                target_label: __address__
-                replacement: $1:$2
-              - action: labelmap
-                regex: __meta_kubernetes_pod_label_(.+)
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_namespace
-                target_label: kubernetes_namespace
-              - action: replace
-                source_labels:
-                  - __meta_kubernetes_pod_name
-                target_label: kubernetes_pod_name
+        - scheme: https
+          job_name: kubernetes-apiservers
+          kubernetes_sd_configs:
+          - role: endpoints
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: keep
+            source_labels:
+            - __meta_kubernetes_namespace
+            - __meta_kubernetes_service_name
+            - __meta_kubernetes_endpoint_port_name
+            regex: default;kubernetes;https
+        - scheme: https
+          job_name: kubernetes-nodes
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics
+        - scheme: https
+          job_name: kubernetes-cadvisor
+          kubernetes_sd_configs:
+          - role: node
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+          - action: labelmap
+            regex: __meta_kubernetes_node_label_(.+)
+          - target_label: __address__
+            replacement: kubernetes.default.svc:443
+          - source_labels:
+            - __meta_kubernetes_node_name
+            regex: (.+)
+            target_label: __metrics_path__
+            replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
+        - job_name: kubernetes-service-endpoints
+          kubernetes_sd_configs:
+          - role: endpoints
+          relabel_configs:
+          - action: keep
+            source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scrape
+            regex: true
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_scheme
+            regex: (https?)
+            target_label: __scheme__
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_path
+            regex: (.+)
+            target_label: __metrics_path__
+          - action: replace
+            source_labels:
+            - __address__
+            - __meta_kubernetes_service_annotation_prometheus_io_port
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_service_name
+            target_label: kubernetes_name
+        - job_name: kubernetes-services
+          kubernetes_sd_configs:
+          - role: service
+          relabel_configs:
+          - action: keep
+            source_labels:
+            - __meta_kubernetes_service_annotation_prometheus_io_probe
+            regex: true
+          - source_labels:
+            - __address__
+            target_label: __param_target
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_service_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_service_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-ingresses
+          kubernetes_sd_configs:
+          - role: ingress
+          relabel_configs:
+          - action: keep
+            source_labels:
+            - __meta_kubernetes_ingress_annotation_prometheus_io_probe
+            regex: true
+          - source_labels:
+            - __meta_kubernetes_ingress_scheme
+            - __address__
+            - __meta_kubernetes_ingress_path
+            regex: (.+);(.+);(.+)
+            target_label: __param_target
+            replacement: ${1}://${2}${3}
+          - target_label: __address__
+            replacement: blackbox-exporter.example.com:9115
+          - source_labels:
+            - __param_target
+            target_label: app
+          - action: labelmap
+            regex: __meta_kubernetes_ingress_label_(.+)
+          - source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - source_labels:
+            - __meta_kubernetes_ingress_name
+            target_label: kubernetes_name
+          metrics_path: /probe
+          params:
+            module:
+            - http_2xx
+        - job_name: kubernetes-pods
+          kubernetes_sd_configs:
+          - role: pod
+          relabel_configs:
+          - action: keep
+            source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_scrape
+            regex: true
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_pod_annotation_prometheus_io_path
+            regex: (.+)
+            target_label: __metrics_path__
+          - action: replace
+            source_labels:
+            - __address__
+            - __meta_kubernetes_pod_annotation_prometheus_io_port
+            regex: ([^:]+)(?::\\d+)?;(\\d+)
+            target_label: __address__
+            replacement: $1:$2
+          - action: labelmap
+            regex: __meta_kubernetes_pod_label_(.+)
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_namespace
+            target_label: kubernetes_namespace
+          - action: replace
+            source_labels:
+            - __meta_kubernetes_pod_name
+            target_label: kubernetes_pod_name
         
         """
         }
diff --git a/internal/encoding/yaml/encode.go b/internal/encoding/yaml/encode.go
index b0a247d..d9742e7 100644
--- a/internal/encoding/yaml/encode.go
+++ b/internal/encoding/yaml/encode.go
@@ -15,6 +15,7 @@
 package yaml
 
 import (
+	"bytes"
 	"math/big"
 	"strings"
 
@@ -45,7 +46,14 @@
 	if err != nil {
 		return nil, err
 	}
-	return yaml.Marshal(y)
+	w := &bytes.Buffer{}
+	enc := yaml.NewEncoder(w)
+	// Use idiomatic indentation.
+	enc.SetIndent(2)
+	if err = enc.Encode(y); err != nil {
+		return nil, err
+	}
+	return w.Bytes(), nil
 }
 
 func encode(n ast.Node) (y *yaml.Node, err error) {
diff --git a/internal/encoding/yaml/encode_test.go b/internal/encoding/yaml/encode_test.go
index 33d478a..b90447c 100644
--- a/internal/encoding/yaml/encode_test.go
+++ b/internal/encoding/yaml/encode_test.go
@@ -51,18 +51,18 @@
 		`,
 		out: `
 seq:
-  - 1
-  - 2
-  - 3
-  - a: 1
-    b: 2
+- 1
+- 2
+- 3
+- a: 1
+  b: 2
 a:
-    b:
-        c: 3
+  b:
+    c: 3
 b:
-    x: 0
-    y: 1
-    z: 2
+  x: 0
+  y: 1
+  z: 2
 		`,
 	}, {
 		name: "oneLineFields",
@@ -136,8 +136,8 @@
 
 # head 3
 f3:
-    # struct doc
-    a: 1
+  # struct doc
+  a: 1
 f4: {} # line 4
 
 # Trailing
@@ -229,16 +229,16 @@
 		}`,
 		out: `
 receivers:
-  - name: pager
-    slack_configs:
-      - text: |-
-            {{ range .Alerts }}{{ .Annotations.description }}
-            {{ end }}
-        channel: '#cloudmon'
-        send_resolved: true
+- name: pager
+  slack_configs:
+  - text: |-
+      {{ range .Alerts }}{{ .Annotations.description }}
+      {{ end }}
+    channel: '#cloudmon'
+    send_resolved: true
 route:
-    receiver: pager
-    group_by: [alertname, cluster]
+  receiver: pager
+  group_by: [alertname, cluster]
 		`,
 	}}
 	for _, tc := range testCases {