The ingress CIDRs are going to be dynamic, and in general we don't want to leave old ingress rules around. Fix #21895