Impossible to build IPv6 cluster into existing AWS VPC/Subnets

/kind bug **1. What `kops` version are you running? The command `kops version`, will display this information.** ``` Client version: 1.34.1 (git-v1.34.1) ``` **2. What Kubernetes version are you running? `kubectl version` will print the version if a cluster is running or provide the Kubernetes version specified as a `kops` flag.** None yet, trying to start `1.34.5` **3. What cloud provider are you using?** AWS **4. What commands did you run? What is the simplest way to reproduce this issue?** Have an existing VPC with subnets. The private subnets have no IPv4 CIDR assigned. This should be fine as per: https://kops.sigs.k8s.io/networking/ipv6/ **5. What happened after the commands executed?** Kops complains that I am not specifying a CIDR range for the private subnets. ``` $ kops update cluster --name [[my cluster]] -v 2 I0316 16:23:09.459776 1691898 factory.go:99] state store s3://[[by bucket]] I0316 16:23:09.459822 1691898 s3context.go:350] unable to read /sys/devices/virtual/dmi/id/product_uuid, assuming not running on EC2: open /sys/devices/virtual/dmi/id/product_uuid: permission denied I0316 16:23:09.459827 1691898 s3context.go:192] defaulting region to "us-east-1" I0316 16:23:10.660012 1691898 s3context.go:228] found bucket in region "eu-west-1" I0316 16:23:11.398967 1691898 aws_utils.go:51] Querying EC2 for all valid regions I0316 16:23:12.600020 1691898 aws_cloud.go:1959] Querying EC2 for all valid zones in region "eu-west-1" I0316 16:23:13.192096 1691898 update_cluster.go:362] error checking control plane running version, assuming no k8s upgrade in progress: cannot load kubecfg settings for "[[my cluster]]": context "[[my cluster]]" does not exist I0316 16:23:13.318746 1691898 channel.go:143] Loading channel from "https://raw.githubusercontent.com/kubernetes/kops/master/channels/stable" I0316 16:23:13.345353 1691898 populate_cluster_spec.go:389] Defaulted ServiceClusterIPRange to fd00:5e4f:ce::/108 I0316 16:23:13.345391 1691898 aws_cloud.go:1836] Calling DescribeVPC for VPC "[[my vpc]]" I0316 16:23:13.409394 1691898 aws_cloud.go:2076] Calling DescribeSubnets for subnets in VPC "[[my vpc]]" Error: Subnet "[[my subnet]]" did not have CIDR ``` **6. What did you expect to happen?** For KOPS to proceed without this error. **7. Please provide your cluster manifest. Execute `kops get --name my.example.com -o yaml` to display your cluster manifest. You may want to remove your cluster name and other sensitive information.** ```yaml apiVersion: kops/v1alpha2 kind: Cluster metadata: name: [[my cluster]] spec: api: dns: {} authorization: rbac: {} channel: stable cloudProvider: aws configBase: s3://[[my bucket]] etcdClusters: - etcdMembers: - instanceGroup: masters-eu-west-1c name: eu-west-1c name: main - etcdMembers: - instanceGroup: masters-eu-west-1c name: eu-west-1c name: events fileAssets: - name: audit-policy-file path: /srv/kubernetes/audit-policy.yaml roles: - Master content: | apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: None iam: allowContainerRegistry: true legacy: false kubeAPIServer: auditPolicyFile: /srv/kubernetes/audit-policy.yaml auditLogPath: "-" kubeControllerManager: horizontalPodAutoscalerTolerance: 0.2 horizontalPodAutoscalerSyncPeriod: 30s kubelet: anonymousAuth: false authorizationMode: Webhook authenticationTokenWebhook: true enforceNodeAllocatable: "pods" kubeProxy: enabled: false kubernetesApiAccess: - "::/0" # ignore this I removed the real CIDR kubernetesVersion: "1.34.5" masterInternalName: [[my internal name]] masterPublicName: [[my external name]] networkCIDR: "[[my vpc IPv4 CIDR]]" networkID: "[[my vpc ID]]" networking: cilium: {} nodeTerminationHandler: enableSQSTerminationDraining: false nonMasqueradeCIDR: "::/0" sshAccess: - "::/0" # removed subnets: - id: [[my first private subnet id]] name: [[my first private subnet name]] ipv6CIDR: [[my first private subnet IPv6 CIDR]] type: "Private" zone: eu-west-1a - id: [[my second private subnet id]] name: [[my second private subnet name]] ipv6CIDR: [[my second private subnet IPv6 CIDR]] type: "Private" zone: eu-west-1b - id: [[my third private subnet id]] name: [[my third private subnet name]] ipv6CIDR: [[my third private subnet IPv6 CIDR]] type: "Private" zone: eu-west-1c - id: [[my first public subnet id]] name: [[my first public subnet name]] cidr: [[my first public subnet IPv4 CIDR]] ipv6CIDR: [[my first public subnet IPv6 CIDR]] type: "Public" zone: eu-west-1a - id: [[my second public subnet id]] name: [[my second public subnet name]] cidr: [[my second public subnet IPv4 CIDR]] ipv6CIDR: [[my second public subnet IPv6 CIDR]] type: "Public" zone: eu-west-1b - id: [[my third public subnet id]] name: [[my third public subnet name]] cidr: [[my third public subnet IPv4 CIDR]] ipv6CIDR: [[my third public subnet IPv6 CIDR]] type: "Public" zone: eu-west-1c topology: dns: type: "None" # ?? masters: "public" nodes: "private" ``` **8. Please run the commands with most verbose logging by adding the `-v 10` flag. Paste the logs into this report, or in a gist and provide the gist link here.** See above. **9. Anything else do we need to know?** Could be something I am missing, but I've tried all sorts. ``` cidr: null cidr: "" cidr "null" cidr: "127.0.0.1/32" cidr: "[[cidr in my vpc that isn't assigned to anything]]" ```` All fail, with the bottom one failing during update moaning about an immutable field. Feels like KOPS just doesn't support this (IPv6 existing VPC)