It was raised by Nuru (@Nuru) that 100.64.0.0/10 is actually reserved address space. This also happens to be the kops default fornonMasqueradeCIDR: 100.64.0.0/10. So this has been in use for by kops as the default for around 2 years, and since a lot of people are using it, it should be reasonably well vetted and supported. Just be aware that it could be a bad idea to use it. The address is routable, and it routes to the carrier's NAT pool, so if it ever gets out of the cluster it will cause weird and potentially very hard-to-diagnose problems.