Add validations and unit tests

AdarshK15 · AdarshK15 · commit 684188c83eb8 · 2026-01-20T10:22:26.000Z
diff --git a/community/modules/compute/gke-nodeset/metadata.yaml b/community/modules/compute/gke-nodeset/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2025 Google LLC
+# Copyright 2026 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -25,3 +25,17 @@ ghpc:
       vars: [slurm_cluster_name]
       pattern: "^[a-z](?:[a-z0-9]{0,9})$"
     error_message: "'slurm_cluster_name' must contain only lowercase letters and numbers, start with a letter, and be 1-10 characters long."
+  - validator: range
+    inputs:
+      vars: [network_storage]
+      min: 1
+      max: 1
+      length_check: true
+    error_message: "The 'network_storage' list must contain exactly one element."
+  - validator: range
+    inputs:
+      vars: [filestore_id]
+      min: 1
+      max: 1
+      length_check: true
+    error_message: "The 'filestore_id' list must contain exactly one element."
diff --git a/community/modules/compute/mig/metadata.yaml b/community/modules/compute/mig/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -19,3 +19,10 @@ spec:
     - compute.googleapis.com
 ghpc:
   inject_module_id: ghpc_module_id
+  validators:
+  - validator: range
+    inputs:
+      vars: [versions]
+      min: 1
+      length_check: true
+    error_message: "The 'versions' list must contain at least one version."
diff --git a/community/modules/compute/notebook/metadata.yaml b/community/modules/compute/notebook/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,3 +18,13 @@ spec:
     services:
     - notebooks.googleapis.com
     - storage.googleapis.com
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [mount_runner.args]
+      min: 5
+      max: 5
+      length_check: true
+      delimiter: " "
+    error_message: "The 'mount_runner.args' field must contain exactly 5 elements."
diff --git a/community/modules/database/slurm-cloudsql-federation/metadata.yaml b/community/modules/database/slurm-cloudsql-federation/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -19,3 +19,10 @@ spec:
     - bigqueryconnection.googleapis.com
     - sqladmin.googleapis.com
     - servicenetworking.googleapis.com
+ghpc:
+  validators:
+  - validator: regex
+    inputs:
+      vars: [network_id]
+      pattern: ^projects/[^/]+/global/networks/[^/]+$
+    error_message: "The network id must be provided in the following format: projects/<project_id>/global/networks/<network_name>."
diff --git a/community/modules/internal/slurm-gcp/nodeset_tpu/metadata.yaml b/community/modules/internal/slurm-gcp/nodeset_tpu/metadata.yaml
@@ -0,0 +1,29 @@
+# Copyright 2026 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [node_count_static]
+      min: 0
+      length_check: false
+    error_message: "The 'node_count_static' value must be at least 0."
+  - validator: range
+    inputs:
+      vars: [node_count_dynamic_max]
+      min: 0
+      length_check: false
+    error_message: "The 'node_count_dynamic_max' value must be at least 0."
diff --git a/community/modules/scheduler/htcondor-access-point/metadata.yaml b/community/modules/scheduler/htcondor-access-point/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,3 +18,11 @@ spec:
     services:
     - compute.googleapis.com
     - storage.googleapis.com
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [zones]
+      max: 2
+      length_check: true
+    error_message: "The 'zones' list must contain at most 2 zones."
diff --git a/docs/blueprint-validation.md b/docs/blueprint-validation.md
@@ -121,6 +121,24 @@ ghpc:
       error_message: "partition_name must be lowercase alphanumeric and max 10 characters."
 ```
 
+### Range Validator
+The `range` validator ensures that input variables (or their computed lengths/segment counts) fall within a specified numerical minimum and/or maximum. It supports validating individual numeric values, the number of elements in a list, or the count of segments in a delimited string (when an optional delimiter is specified). The optional length_check field (defaulting to false) determines whether to validate the value itself or the count of its elements/segments.
+
+**Example definition in `metadata.yaml`:**
+
+```yaml
+ghpc:
+validators:
+  - validator: range
+    inputs:
+      vars: [mount_runner.args]
+      min: 5
+      max: 5
+      length_check: true
+      delimiter: " "
+    error_message: "The 'mount_runner.args' field must contain exactly 5 elements."
+```
+
 Unlike blueprint-level validators, these are intrinsic to the module and ensure that the module receives data in the exact format required for its internal logic to function.
 
 ## Skipping or Disabling Validators
diff --git a/modules/file-system/filestore/metadata.yaml b/modules/file-system/filestore/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,3 +17,12 @@ spec:
   requirements:
     services:
     - file.googleapis.com
+
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [size_gb]
+      min: 1024
+      length_check: false
+    error_message: "The 'size_gb' value must be at least 1024 GiB. See https://cloud.google.com/filestore/docs/service-tiers for details."
diff --git a/modules/network/multivpc/metadata.yaml b/modules/network/multivpc/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2024 "Google LLC"
+# Copyright 2026 "Google LLC"
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,3 +17,12 @@ spec:
   requirements:
     services:
     - compute.googleapis.com
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [network_count]
+      min: 2
+      max: 8
+      length_check: false
+    error_message: "The 'network_count' must be between 2 and 8. Use the standard Toolkit module at 'modules/network/vpc' for count = 1."
diff --git a/pkg/validators/metadata_validator_helpers.go b/pkg/validators/metadata_validator_helpers.go
@@ -1,4 +1,4 @@
-// Copyright 2025, 2026 "Google LLC"
+// Copyright 2026 "Google LLC"
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -64,7 +64,7 @@ func evaluateAndFlatten(val cty.Value) []cty.Value {
 
 // getModuleSettingValues retrieves a cty.Value from module settings using a dot-separated path,
 // evaluates expressions via bp.Eval and returns flattened slice + path for errors.
-func getModuleSettingValues(bp config.Blueprint, group config.Group, modIdx int, mod config.Module, settingName string) (cty.Value, config.Path, error) {
+func getModuleSettingValues(bp config.Blueprint, group config.Group, modIdx int, mod config.Module, settingName string) ([]cty.Value, config.Path, error) {
 	var nilPath config.Path
 
 	// Determine canonical path for this module.setting in the blueprint.
@@ -76,7 +76,7 @@ func getModuleSettingValues(bp config.Blueprint, group config.Group, modIdx int,
 
 	if bp.YamlCtx != nil {
 		if _, ok := bp.YamlCtx.Pos(path); !ok {
-			return cty.NilVal, nilPath, fmt.Errorf("setting %q not present in blueprint YAML for module %q", settingName, mod.ID)
+			return nil, nilPath, fmt.Errorf("setting %q not present in blueprint YAML for module %q", settingName, mod.ID)
 		}
 	}
 
@@ -85,7 +85,9 @@ func getModuleSettingValues(bp config.Blueprint, group config.Group, modIdx int,
 	if evaledVal, err := bp.Eval(val); err == nil {
 		val = evaledVal
 	}
-	return val, path, nil
+	values := evaluateAndFlatten(val)
+
+	return values, path, nil
 }
 
 // parseStringList normalizes an input that may be a single string, []interface{} or nil into []string.
@@ -116,7 +118,7 @@ func parseStringList(v interface{}) ([]string, bool) {
 // Target represents a resolved target (module-setting or blueprint var) for validation.
 type Target struct {
 	Name        string
-	Value       cty.Value
+	Values      []cty.Value
 	Path        config.Path
 	IsBlueprint bool // true if came from blueprint vars, false if module.settings
 }
@@ -144,7 +146,7 @@ func parseIntInput(inputs map[string]interface{}, key string) (*int, error) {
 // processModuleSettings processes a list of names interpreted as module settings.
 func processModuleSettings(bp config.Blueprint, mod config.Module, group config.Group, modIdx int, list []string, optional bool, handler func(Target) error) error {
 	for _, s := range list {
-		value, path, err := getModuleSettingValues(bp, group, modIdx, mod, s)
+		values, path, err := getModuleSettingValues(bp, group, modIdx, mod, s)
 		if err != nil {
 			if optional {
 				continue
@@ -155,7 +157,7 @@ func processModuleSettings(bp config.Blueprint, mod config.Module, group config.
 				Path: missingPath,
 			}
 		}
-		if err := handler(Target{Name: s, Value: value, Path: path, IsBlueprint: false}); err != nil {
+		if err := handler(Target{Name: s, Values: values, Path: path, IsBlueprint: false}); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/validators/metadata_validators.go b/pkg/validators/metadata_validators.go
@@ -1,4 +1,4 @@
-// Copyright 2025, 2026 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -54,8 +54,7 @@ func (r *RegexValidator) Validate(
 	}
 
 	// helper: validate flattened cty.Values against regex, returning first error
-	validateValues := func(value cty.Value, path config.Path) error {
-		values := evaluateAndFlatten(value)
+	validateValues := func(values []cty.Value, path config.Path) error {
 		for _, val := range values {
 			if val.Type() != cty.String {
 				continue
@@ -73,7 +72,7 @@ func (r *RegexValidator) Validate(
 
 	// iterate targets using shared logic
 	err = IterateRuleTargets(bp, mod, rule, group, modIdx, func(t Target) error {
-		return validateValues(t.Value, t.Path)
+		return validateValues(t.Values, t.Path)
 	})
 	return err
 }
@@ -100,8 +99,7 @@ func (v *AllowedEnumValidator) normalizeAllowed(allowedRaw interface{}) ([]strin
 }
 
 // checkValues iterates through cty.Values to ensure they exist within the allowed set, handling nulls and casing.
-func (v *AllowedEnumValidator) checkValues(value cty.Value, path config.Path, allowedSet map[string]struct{}, allowedList []string, caseSensitive bool, allowNull bool, errMsg string) error {
-	values := evaluateAndFlatten(value)
+func (v *AllowedEnumValidator) checkValues(values []cty.Value, path config.Path, allowedSet map[string]struct{}, allowedList []string, caseSensitive bool, allowNull bool, errMsg string) error {
 	for _, val := range values {
 		if val.IsNull() {
 			if allowNull {
@@ -191,7 +189,7 @@ func (v *AllowedEnumValidator) Validate(
 
 	// 4. Iterate and validate user-provided values
 	return IterateRuleTargets(bp, mod, rule, group, modIdx, func(t Target) error {
-		return v.checkValues(t.Value, t.Path, allowedSet, allowedList, caseSensitive, allowNull, rule.ErrorMessage)
+		return v.checkValues(t.Values, t.Path, allowedSet, allowedList, caseSensitive, allowNull, rule.ErrorMessage)
 	})
 }
 
@@ -219,24 +217,23 @@ func (r *RangeValidator) checkBounds(value int, min *int, max *int, customErrMsg
 
 // validateTarget applies range validation to a given cty.Value.
 func (r *RangeValidator) validateTarget(
-	value cty.Value,
+	values []cty.Value,
 	path config.Path,
 	min *int,
 	max *int,
 	lengthCheck bool,
+	delimiter *string,
 	customErrMsg string) error {
-
 	if lengthCheck {
-		if !value.Type().IsListType() && !value.Type().IsTupleType() {
-			return config.BpError{
-				Err:  fmt.Errorf("length_check can only be used with list types, not %s", value.Type().FriendlyName()),
-				Path: path,
-			}
+		if delimiter != nil && len(values) > 0 {
+			stringVal := values[0].AsString()
+			segments := strings.Split(stringVal, *delimiter)
+			return r.checkBounds(len(segments), min, max, customErrMsg, path)
 		}
-		return r.checkBounds(value.LengthInt(), min, max, customErrMsg, path)
+
+		return r.checkBounds(len(values), min, max, customErrMsg, path)
 	}
 
-	values := evaluateAndFlatten(value)
 	for _, val := range values {
 		if val.IsNull() || !val.IsKnown() {
 			continue
@@ -283,12 +280,29 @@ func (r *RangeValidator) Validate(
 		}
 	}
 
+	if min != nil && max != nil && *max < *min {
+		return config.BpError{
+			Err:  fmt.Errorf("range validator for module %q must have 'min' less than or equal to 'max' defined", mod.ID),
+			Path: modPath,
+		}
+	}
+
 	checkListLength, err := parseBoolInput(rule.Inputs, "length_check", false)
 	if err != nil {
 		return config.BpError{Err: fmt.Errorf("validation rule for module %q: %v", mod.ID, err), Path: modPath}
 	}
 
+	delimiterRaw, hasDelimiter := rule.Inputs["delimiter"]
+	var delimiter *string
+	if hasDelimiter {
+		delim, ok := delimiterRaw.(string)
+		if !ok {
+			return config.BpError{Err: fmt.Errorf("validation rule for module %q: 'delimiter' must be a string", mod.ID), Path: modPath}
+		}
+		delimiter = &delim
+	}
+
 	return IterateRuleTargets(bp, mod, rule, group, modIdx, func(t Target) error {
-		return r.validateTarget(t.Value, t.Path, min, max, checkListLength, rule.ErrorMessage)
+		return r.validateTarget(t.Values, t.Path, min, max, checkListLength, delimiter, rule.ErrorMessage)
 	})
 }
diff --git a/pkg/validators/metadata_validators_test.go b/pkg/validators/metadata_validators_test.go
