diff --git a/bindata/network/ovn-kubernetes/common/001-crd.yaml b/bindata/network/ovn-kubernetes/common/001-crd.yaml
index d609c793cc..82343e3f8d 100644
--- a/bindata/network/ovn-kubernetes/common/001-crd.yaml
+++ b/bindata/network/ovn-kubernetes/common/001-crd.yaml
@@ -3503,6 +3503,14 @@ spec:
                   rule: '!has(self.infrastructureSubnets) || !has(self.reservedSubnets)
                     || self.infrastructureSubnets.all(infra, !self.reservedSubnets.exists(reserved,
                     cidr(infra).containsCIDR(reserved) || cidr(reserved).containsCIDR(infra)))'
+                - message: infrastructureSubnets must be a masked network address
+                    (no host bits set)
+                  rule: '!has(self.infrastructureSubnets) || self.infrastructureSubnets.all(s,
+                    isCIDR(s) && cidr(s) == cidr(s).masked())'
+                - message: reservedSubnets must be a masked network address (no
+                    host bits set)
+                  rule: '!has(self.reservedSubnets) || self.reservedSubnets.all(s,
+                    isCIDR(s) && cidr(s) == cidr(s).masked())'
 {{- end }}
               layer3:
                 description: Layer3 is the Layer3 topology configuration.
@@ -4021,6 +4029,14 @@ spec:
                       rule: '!has(self.infrastructureSubnets) || !has(self.reservedSubnets)
                         || self.infrastructureSubnets.all(infra, !self.reservedSubnets.exists(reserved,
                         cidr(infra).containsCIDR(reserved) || cidr(reserved).containsCIDR(infra)))'
+                    - message: infrastructureSubnets must be a masked network address
+                        (no host bits set)
+                      rule: '!has(self.infrastructureSubnets) || self.infrastructureSubnets.all(s,
+                        isCIDR(s) && cidr(s) == cidr(s).masked())'
+                    - message: reservedSubnets must be a masked network address (no
+                        host bits set)
+                      rule: '!has(self.reservedSubnets) || self.reservedSubnets.all(s,
+                        isCIDR(s) && cidr(s) == cidr(s).masked())'
 {{- end }}
                   layer3:
                     description: Layer3 is the Layer3 topology configuration.