constraint tags are the equivalent of syntax:expression: in the old style templates.
Constraint can be a regex or a call to an external validator, possible with an argument. Validators are stored in ${vyos_libexecdir}/validators
The new syntax:
<properties> <constraintErrorMessage>Foo should be "bar", "baz", or a number within 0-9000 range</constraintErrorMessage> <constraint> <regex>^(bar|baz)$</regex> </constraint> <constraint> <validator name="numeric" argument="--range 0-9000"/> </constraint> </properties>