nil pointer dereference in ValidateClusterUpdate when old cluster is nil

/kind bug **1. What `kops` version are you running?** Latest master (confirmed in source). **2. What Kubernetes version are you running?** N/A **3. What cloud provider are you using?** N/A **4. What commands did you run? What is the simplest way to reproduce this issue?** ``` go validation.ValidateClusterUpdate(cluster, nil, nil, nil) ``` **5. What happened after the commands executed?** ``` panic: runtime error: invalid memory address or nil pointer dereference k8s.io/kops/pkg/apis/kops/validation.ValidateClusterUpdate(...) pkg/apis/kops/validation/cluster.go:39 ``` **6. What did you expect to happen?** ValidateClusterUpdate should handle a nil old cluster gracefully and return validation errors for the new cluster only. **7. Please provide your cluster manifest.** N/A **8. Please run the commands with most verbose logging by adding the `-v 10` flag.** N/A **9. Anything else do we need to know?** Root cause: cluster.go:39 iterates over `old.Spec.EtcdClusters` without a nil guard: ``` go for _, etcdCluster := range old.Spec.EtcdClusters { ``` Fix: add an early return before the etcd cluster validation block: ``` go if old == nil { return allErrs } ``` If this is accepted, I am happy to submit a PR with the fix.