Move our validation to the apimachinery style. And then add a validation that we specify IDs either for all subnets or no subnets.