Previous logic used calicoctl.sh create --skip-exists, which
allowed setting initial values, but not permitting changes.