feat(validations): Add early range based pattern validation (GoogleCloudPlatform#5115)

AdarshK15 · web-flow · commit 7ec39e998a09 · 2026-01-29T08:50:19.000+05:30
diff --git a/community/modules/compute/gke-nodeset/metadata.yaml b/community/modules/compute/gke-nodeset/metadata.yaml
@@ -25,3 +25,17 @@ ghpc:
       vars: [slurm_cluster_name]
       pattern: "^[a-z](?:[a-z0-9]{0,9})$"
     error_message: "'slurm_cluster_name' must contain only lowercase letters and numbers, start with a letter, and be 1-10 characters long."
+  - validator: range
+    inputs:
+      vars: [network_storage]
+      min: 1
+      max: 1
+      length_check: true # Validates the list's length instead of its elements.
+    error_message: "The 'network_storage' list must contain exactly one element."
+  - validator: range
+    inputs:
+      vars: [filestore_id]
+      min: 1
+      max: 1
+      length_check: true # Validates the list's length instead of its elements.
+    error_message: "The 'filestore_id' list must contain exactly one element."
diff --git a/community/modules/compute/mig/metadata.yaml b/community/modules/compute/mig/metadata.yaml
@@ -19,3 +19,10 @@ spec:
     - compute.googleapis.com
 ghpc:
   inject_module_id: ghpc_module_id
+  validators:
+  - validator: range
+    inputs:
+      vars: [versions]
+      min: 1
+      length_check: true # Validates the list's length instead of its elements.
+    error_message: "The 'versions' list must contain at least one version."
diff --git a/community/modules/compute/notebook/metadata.yaml b/community/modules/compute/notebook/metadata.yaml
@@ -18,3 +18,10 @@ spec:
     services:
     - notebooks.googleapis.com
     - storage.googleapis.com
+ghpc:
+  validators:
+  - validator: regex
+    inputs:
+      vars: [mount_runner.args]
+      pattern: "^[^ ]+( [^ ]+){4}$"
+    error_message: "The 'mount_runner.args' field must contain exactly 5 elements."
diff --git a/community/modules/database/slurm-cloudsql-federation/metadata.yaml b/community/modules/database/slurm-cloudsql-federation/metadata.yaml
@@ -19,3 +19,10 @@ spec:
     - bigqueryconnection.googleapis.com
     - sqladmin.googleapis.com
     - servicenetworking.googleapis.com
+ghpc:
+  validators:
+  - validator: regex
+    inputs:
+      vars: [network_id]
+      pattern: "^projects/[^/]+/global/networks/[^/]+$"
+    error_message: "The network id must be provided in the following format: projects/<project_id>/global/networks/<network_name>."
diff --git a/community/modules/internal/slurm-gcp/nodeset_tpu/metadata.yaml b/community/modules/internal/slurm-gcp/nodeset_tpu/metadata.yaml
@@ -0,0 +1,27 @@
+# Copyright 2026 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [node_count_static]
+      min: 0
+    error_message: "The 'node_count_static' value must be at least 0."
+  - validator: range
+    inputs:
+      vars: [node_count_dynamic_max]
+      min: 0
+    error_message: "The 'node_count_dynamic_max' value must be at least 0."
diff --git a/community/modules/scheduler/htcondor-access-point/metadata.yaml b/community/modules/scheduler/htcondor-access-point/metadata.yaml
@@ -18,3 +18,11 @@ spec:
     services:
     - compute.googleapis.com
     - storage.googleapis.com
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [zones]
+      max: 2
+      length_check: true # Validates the list's length instead of its elements.
+    error_message: "The 'zones' list must contain at most 2 zones."
diff --git a/community/modules/scheduler/schedmd-slurm-gcp-v6-controller/metadata.yaml b/community/modules/scheduler/schedmd-slurm-gcp-v6-controller/metadata.yaml
@@ -21,6 +21,12 @@ spec:
     - storage.googleapis.com
 ghpc:
   validators:
+  - validator: range
+    inputs:
+      vars: [static_ips]
+      max: 1
+      length_check: true # Validates the list's length instead of its elements.
+    error_message: "The Slurm modules supports 0 or 1 static IPs on controller instance."
   - validator: regex
     inputs:
       vars: [slurm_cluster_name]
diff --git a/docs/blueprint-validation.md b/docs/blueprint-validation.md
@@ -121,6 +121,23 @@ ghpc:
       error_message: "partition_name must be lowercase alphanumeric and max 10 characters."
 ```
 
+### Range Validator
+The `range` validator ensures input variables either their values or lengths fall within specified numerical minimum and/or maximum bounds. It supports validating individual numeric values, lists of numeric values, and the number of elements in a list. The optional length_check field (defaulting to false) determines whether to validate the values themselves or the length of the variable.
+
+**Example definition in `metadata.yaml`:**
+
+```yaml
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [versions]
+      min: 1
+      max: 8
+      length_check: true # enables validation of the list's length rather than the individual values it contains.
+    error_message: "The 'versions' list must contain at least one version."
+```
+
 Unlike blueprint-level validators, these are intrinsic to the module and ensure that the module receives data in the exact format required for its internal logic to function.
 
 ## Skipping or Disabling Validators
diff --git a/modules/compute/gke-node-pool/metadata.yaml b/modules/compute/gke-node-pool/metadata.yaml
@@ -25,3 +25,13 @@ ghpc:
       vars: [name]
       pattern: "^[a-z]([-a-z0-9]{0,34}[a-z0-9])?$"
     error_message: "'name' must start with a lowercase letter, followed by up to 34 lowercase letters, numbers, or hyphens, and cannot end with a hyphen."
+  - validator: range
+    inputs:
+      vars: [local.upgrade_settings.max_surge]
+      min: 0
+    error_message: "'max_surge' value must be at least 0."
+  - validator: range
+    inputs:
+      vars: [local.upgrade_settings.max_unavailable]
+      min: 0
+    error_message: "'max_unavailable' value must be at least 0."
diff --git a/modules/file-system/filestore/metadata.yaml b/modules/file-system/filestore/metadata.yaml
@@ -20,6 +20,18 @@ spec:
 
 ghpc:
   validators:
+  - validator: range
+    inputs:
+      vars: [size_gb]
+      min: 1024
+    error_message: "The 'size_gb' value must be at least 1024 GiB. See https://cloud.google.com/filestore/docs/service-tiers for details."
+
+  - validator: regex
+    inputs:
+      vars: [network_id]
+      pattern: ^projects/[^/]+/global/networks/[^/]+$
+    error_message: "The network id must be provided in the following format: projects/<project_id>/global/networks/<network_name>."
+
   - validator: allowed_enum
     inputs:
       vars: [filestore_tier]
diff --git a/modules/file-system/parallelstore/metadata.yaml b/modules/file-system/parallelstore/metadata.yaml
@@ -17,3 +17,10 @@ spec:
   requirements:
     services:
     - parallelstore.googleapis.com
+ghpc:
+  validators:
+  - validator: regex
+    inputs:
+      vars: [network_id]
+      pattern: ^projects/[^/]+/global/networks/[^/]+$
+    error_message: "The network id must be provided in the following format: projects/<project_id>/global/networks/<network_name>."
diff --git a/modules/network/multivpc/metadata.yaml b/modules/network/multivpc/metadata.yaml
@@ -17,3 +17,11 @@ spec:
   requirements:
     services:
     - compute.googleapis.com
+ghpc:
+  validators:
+  - validator: range
+    inputs:
+      vars: [network_count]
+      min: 2
+      max: 8
+    error_message: "The 'network_count' must be between 2 and 8. Use the standard Toolkit module at 'modules/network/vpc' for count = 1."
diff --git a/modules/scheduler/gke-cluster/metadata.yaml b/modules/scheduler/gke-cluster/metadata.yaml
@@ -17,3 +17,11 @@ spec:
   requirements:
     services:
     - container.googleapis.com
+
+ghpc:
+  validators:
+  - validator: regex
+    inputs:
+      vars: [network_id]
+      pattern: ^projects/[^/]+/global/networks/[^/]+$
+    error_message: "The network id must be provided in the following format: projects/<project_id>/global/networks/<network_name>."
diff --git a/pkg/validators/metadata_validator_helpers.go b/pkg/validators/metadata_validator_helpers.go
@@ -123,6 +123,26 @@ type Target struct {
 	IsBlueprint bool // true if came from blueprint vars, false if module.settings
 }
 
+// parseIntInput parses an integer from the input map and returns a pointer.
+// It returns nil if the key is not found.
+func parseIntInput(inputs map[string]interface{}, key string) (*int, error) {
+	v, ok := inputs[key]
+	if !ok {
+		return nil, nil
+	}
+
+	var val int
+	switch t := v.(type) {
+	case int:
+		val = t
+	case float64:
+		val = int(t)
+	default:
+		return nil, fmt.Errorf("'%s' must be an integer, not %T", key, v)
+	}
+	return &val, nil
+}
+
 // processModuleSettings processes a list of names interpreted as module settings.
 func processModuleSettings(bp config.Blueprint, mod config.Module, group config.Group, modIdx int, list []string, optional bool, handler func(Target) error) error {
 	for _, s := range list {
diff --git a/pkg/validators/metadata_validators.go b/pkg/validators/metadata_validators.go
@@ -192,3 +192,106 @@ func (v *AllowedEnumValidator) Validate(
 		return v.checkValues(t.Values, t.Path, allowedSet, allowedList, caseSensitive, allowNull, rule.ErrorMessage)
 	})
 }
+
+// RangeValidator implements the RuleValidator interface for the 'range' validation type.
+type RangeValidator struct{}
+
+// checkBounds validates a single integer value against the optional minimum and maximum bounds.
+func (r *RangeValidator) checkBounds(value int, min *int, max *int, customErrMsg string, path config.Path) error {
+	if min != nil && value < *min {
+		msg := customErrMsg
+		if msg == "" {
+			msg = fmt.Sprintf("value %d is less than the minimum allowed value of %d", value, *min)
+		}
+		return config.BpError{Err: fmt.Errorf("%s", msg), Path: path}
+	}
+	if max != nil && value > *max {
+		msg := customErrMsg
+		if msg == "" {
+			msg = fmt.Sprintf("value %d is greater than the maximum allowed value of %d", value, *max)
+		}
+		return config.BpError{Err: fmt.Errorf("%s", msg), Path: path}
+	}
+	return nil
+}
+
+// validateTarget applies range validation to a list of cty.Values.
+func (r *RangeValidator) validateTarget(
+	values []cty.Value,
+	path config.Path,
+	min *int,
+	max *int,
+	lengthCheck bool,
+	customErrMsg string) error {
+	if lengthCheck {
+		return r.checkBounds(len(values), min, max, customErrMsg, path)
+	}
+
+	for _, val := range values {
+		if val.IsNull() || !val.IsKnown() {
+			continue
+		}
+		if val.Type() == cty.Number {
+			f, _ := val.AsBigFloat().Float64()
+			if f != float64(int64(f)) {
+				return config.BpError{
+					Err:  fmt.Errorf("range validator only supports integer numbers, not %v", f),
+					Path: path,
+				}
+			}
+			if err := r.checkBounds(int(f), min, max, customErrMsg, path); err != nil {
+				return err
+			}
+		} else {
+			return config.BpError{
+				Err:  fmt.Errorf("range validator only supports numbers, not %s", val.Type().FriendlyName()),
+				Path: path,
+			}
+		}
+	}
+	return nil
+}
+
+// Validate checks if the variables specified in the rule fall within the specified numeric range or length constraints.
+func (r *RangeValidator) Validate(
+	bp config.Blueprint,
+	mod config.Module,
+	rule modulereader.ValidationRule,
+	group config.Group,
+	modIdx int) error {
+
+	modPath := config.Root.Groups.At(bp.GroupIndex(group.Name)).Modules.At(modIdx).Source
+
+	min, err := parseIntInput(rule.Inputs, "min")
+	if err != nil {
+		return config.BpError{Err: fmt.Errorf("validation rule for module %q: %v", mod.ID, err), Path: modPath}
+	}
+
+	max, err := parseIntInput(rule.Inputs, "max")
+	if err != nil {
+		return config.BpError{Err: fmt.Errorf("validation rule for module %q: %v", mod.ID, err), Path: modPath}
+	}
+
+	if min == nil && max == nil {
+		return config.BpError{
+			Err:  fmt.Errorf("range validator for module %q must have at least one of 'min' or 'max' defined", mod.ID),
+			Path: modPath,
+		}
+	}
+
+	if min != nil && max != nil && *max < *min {
+		return config.BpError{
+			Err:  fmt.Errorf("range validator for module %q must have 'min' less than or equal to 'max' defined", mod.ID),
+			Path: modPath,
+		}
+	}
+
+	checkListLength, err := parseBoolInput(rule.Inputs, "length_check", false)
+	if err != nil {
+		return config.BpError{Err: fmt.Errorf("validation rule for module %q: %v", mod.ID, err), Path: modPath}
+	}
+
+	return IterateRuleTargets(bp, mod, rule, group, modIdx, func(t Target) error {
+		return r.validateTarget(t.Values, t.Path, min, max, checkListLength, rule.ErrorMessage)
+	})
+}
diff --git a/pkg/validators/metadata_validators_test.go b/pkg/validators/metadata_validators_test.go
diff --git a/pkg/validators/registry.go b/pkg/validators/registry.go
