Constraints narrow a value

In HCL, every rule is a validation block with its own message. The value arrives from another file, and OpenTofu tests it when you plan.

variable "bucket_name" {
  type = string
  validation {
    condition     = can(regex("^[a-z0-9-]{3,63}$", var.bucket_name))
    error_message = "Use 3 to 63 lowercase letters, digits or hyphens."
  }
}

variable "port" {
  type = number
  validation {
    condition     = var.port >= 1 && var.port <= 65535
    error_message = "Use a port from 1 to 65535."
  }
}

The same two rules in CUE are two fields.

rules: https: port: int & >=1 & <=65535
buckets: audit: name: =~"^[a-z0-9-]{3,63}$"

The HCL takes 15 lines and the CUE takes 2. In CUE the rule is a value that you write on the field, next to the value it judges. The CUE has no error_message: pravo builds the message from the rule that failed, as the next sections show.

The operator & joins two values into one value that satisfies both. >=1, <=65535 and =~"^[a-z0-9-]{3,63}$" are values too. Each one is a bound: a value that allows only some numbers or some text. A field that carries a bound allows only what the bound allows.

package estate

3

Error: -e "int & >=1 & <=10 & 0": invalid value 0 (out of bound >=1):
    1:7
    1:20


Error: -e "int & >=1 & <=10 & 11": invalid value 11 (out of bound <=10):
    1:13
    1:20


Error: -e "int & >=1 & <=10 & \"3\"": conflicting values int and "3" (mismatched types int and string):
    1:1
    1:20

Warm-up

Start from the estate

Work in the directory from A4. If you start here, write these three files.

package estate

buckets: {
	logs: {
		name:           "logs"
		versioning:     true // keep old versions
		encrypted:      true
		retention_days: 365
		tags: owner: "platform"
	}
	uploads: {
		name:           "uploads"
		versioning:     false
		encrypted:      true
		retention_days: 30
		tags: owner: "web"
	}
}

package estate

rules: {
	https: {
		port:     443
		protocol: "tcp"
	}
	ssh: {
		port:     22
		protocol: "tcp"
	}
}

package estate

buckets: uploads: tags: cost_center: "4711"

buckets: uploads: tags: env: "prod"

Save the output.

A bound on a number

The platform team limits every port to the integers from 1 to 65535. It keeps its limits in a file of its own.

package estate

rules: https: port: int & >=1 & <=65535

rules: ssh: port: int & >=1 & <=65535

Both ports are inside the bound, so the data does not change.

same

A bound changes nothing for a value that meets it. It matters when a value does not.

Break it

Someone sets the port of the ssh rule to 70000. Replace rules.cue.

package estate

rules: {
	https: {
		port:     443
		protocol: "tcp"
	}
	ssh: {
		port:     70000
		protocol: "tcp"
	}
}

Error: evaluating .:
rules.ssh.port: invalid value 70000 (out of bound <=65535):
    ./limits.cue:5:31
    ./rules.cue:9:13

Read the error from left to right.

• Path. rules.ssh.port is the field that failed.
• Message. invalid value 70000 (out of bound <=65535) names the value and the bound it breaks. The bound is named, so you know which of >=1 and <=65535 rejected it.
• Locations. The first location is the bound that rejected the value: limits.cue, line 5, column 31. The second is the value: rules.cue, line 9.

Put the port back.

package estate

rules: {
	https: {
		port:     443
		protocol: "tcp"
	}
	ssh: {
		port:     22
		protocol: "tcp"
	}
}

A bound is not a type

A bound allows every number in its range. Write a scratch file with a bound and a value of 22.5.

package float

port: >=1 & <=65535
port: 22.5

port: 22.5

The file is valid and the value is not a port. Add int.

package float

port: int & >=1 & <=65535
port: 22.5

Error: evaluating ./float:
port: conflicting values int and 22.5 (mismatched types int and float):
    ./float/f.cue:3:7
    ./float/f.cue:4:7

The message names both sides of the clash: the type int and the value 22.5. The reason follows in brackets, mismatched types int and float. This is why the limits above start with int &.

Bounds on text

A regular expression is a bound too. The operator =~ accepts only text that matches it. Write a scratch file with a bucket name that does not match.

package names

name: =~"^[a-z0-9-]{3,63}$"
name: "Logs_Bucket"

Error: evaluating ./names:
name: invalid value "Logs_Bucket" (out of bound =~"^[a-z0-9-]{3,63}$"):
    ./names/n.cue:3:7
    ./names/n.cue:4:7

The message reads as it did for the port. The bound is named, with its regular expression, and the first location is the bound. The expression means 3 to 63 characters, each a lowercase letter, a digit or a hyphen.

5
5
5
5
5
"a1"
"a1"

The two rules for ports repeat. Every bucket name needs the same rule. A8 and A9 write each rule once.

Exercise

package estate

buckets: audit: {
	name:       string
	versioning: true
}

fixture() {
  if pravo eval -e "buckets.audit.name & \"$1\"" > /dev/null 2>&1; then got=valid; else got=invalid; fi
  [ "$got" = "$2" ] || { echo "$1 should be $2"; exit 1; }
}
fixture logs valid
fixture my-bucket-01 valid
fixture abc valid
fixture ab invalid
fixture Logs invalid
fixture my_bucket invalid
echo ok

ab should be invalid

package estate

rules: https: port: int & >=1 & <=65535

rules: ssh: port: int & >=1 & <=65535

buckets: audit: name: =~"^[a-z0-9-]{3,63}$"

Recap

• & joins two values into one that satisfies both. A bound such as >=1 is a value, so a rule is a value written on the field.
• A bound that rejects a value is named in the error. The first location is the bound, and the second is the value.
• A numeric bound allows decimals. Add int when the field is a whole number.

The next lesson offers choices and a default.