SupportConsoleDevelopersStart a trialContact

Chapter 4. Network verification for Red Hat OpenShift Service on AWS clusters

Network verification checks run automatically when you deploy a Red Hat OpenShift Service on AWS cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster. The checks validate your network configuration and highlight errors, enabling you to resolve configuration issues before cluster deployment. You can also run the network verification checks manually to validate the configuration for an existing cluster.

When you deploy a Red Hat OpenShift Service on AWS cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster, network verification runs automatically. This helps you identify and resolve configuration issues before cluster deployment.

When you prepare to install your cluster by using Red Hat OpenShift Cluster Manager, the automatic checks run after you input a subnet into a subnet ID field on the Virtual Private Cloud (VPC) subnet settings page. If you create your cluster by using the ROSA CLI (rosa) with the interactive mode, the checks run after you provide the required VPC network information. If you use the CLI without the interactive mode, the checks begin immediately before cluster creation.

When you add a machine pool with a subnet that is new to your cluster, the automatic network verification checks the subnet to ensure that network connectivity is available before provisioning the machine pool.

After automatic network verification completes, the system sends a record to the service log. The record provides the results of the verification check, including any network configuration errors. You can resolve the identified issues before a deployment and the deployment has a greater chance of success.

You can also run the network verification manually for an existing cluster to verify the network configuration after making configuration changes. For steps to run the network verification checks manually, see Running the network verification manually.

4.2. Scope of the network verification checks
Copy link

The network verification includes checks for each of the following requirements:

  • The parent Virtual Private Cloud (VPC) exists.
  • All specified subnets belong to the VPC.
  • The VPC has enableDnsSupport enabled.
  • The VPC has enableDnsHostnames enabled.

4.3. Automatic network verification bypassing
Copy link

You can bypass the automatic network verification if you want to deploy a Red Hat OpenShift Service on AWS cluster with known network configuration issues into an existing Virtual Private Cloud (VPC).

If you bypass the network verification when you create a cluster, the cluster has a limited support status. After installation, you can resolve the issues and then manually run the network verification. The verification removes the limited support status after it succeeds.

When you install a cluster into an existing VPC by using Red Hat OpenShift Cluster Manager, you can bypass the automatic verification by selecting Bypass network verification on the Virtual Private Cloud (VPC) subnet settings page.

You can manually run the network verification checks for an existing Red Hat OpenShift Service on AWS cluster by using the ROSA CLI (rosa).

To run the network verification, you can specify either a cluster name or a set of Virtual Private Cloud (VPC) subnet IDs.

Prerequisites

  • You have installed and configured the latest ROSA CLI (rosa) on your installation host.
  • You have an existing Red Hat OpenShift Service on AWS cluster.
  • You are the cluster owner or you have the cluster editor role.

Procedure

  • Option 1: Verify the network configuration by specifying the cluster name. The subnet IDs are automatically detected. Replace <cluster_name> with the name of your cluster: 

    $ rosa verify network --cluster <cluster_name>

    Example output

    I: Verifying the following subnet IDs are configured correctly: [subnet-03146b9b52b6024cb subnet-03146b9b52b2034cc]
I: subnet-03146b9b52b6024cb: pending
I: subnet-03146b9b52b2034cc: passed
I: Run the following command to wait for verification to all subnets to complete:
rosa verify network --watch --status-only --region us-east-1 --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc

    • Ensure that verification to all subnets completes: 

      $ rosa verify network --watch \
                      --status-only \
                      --region <region_name> \
                      --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc
      • The watch flag causes the command to complete after all the subnets under test are in a failed or passed state.
      • The status-only flag does not trigger a run of network verification but returns the current state, for example, subnet-123 (verification still in-progress). By default, without this option, a call to this command always triggers a verification of the specified subnets.
      • Use the region flag to provide a specific AWS region that overrides the AWS_REGION environment variable.

      • Use the subnet-ids flag to enter a list of subnet IDs separated by commas to verify. If any of the subnets do not exist, the error message Network verification for subnet 'subnet-<subnet_number> not found displays and the system does not check subnets.

        Example output

        I: Checking the status of the following subnet IDs: [subnet-03146b9b52b6024cb subnet-03146b9b52b2034cc]
I: subnet-03146b9b52b6024cb: passed
I: subnet-03146b9b52b2034cc: passed

        Tip

        To output the full list of verification tests, you can include the --debug argument when you run the rosa verify network command.

  • Option 2: Verify the network configuration by specifying the VPC subnets IDs. Replace <region_name> with your AWS region and <AWS_account_ID> with your AWS account ID: 

    $ rosa verify network --subnet-ids 03146b9b52b6024cb,subnet-03146b9b52b2034cc --region <region_name> --role-arn arn:aws:iam::<AWS_account_ID>:role/my-Installer-Role

    Example output

    I: Verifying the following subnet IDs are configured correctly: [subnet-03146b9b52b6024cb subnet-03146b9b52b2034cc]
I: subnet-03146b9b52b6024cb: pending
I: subnet-03146b9b52b2034cc: passed
I: Run the following command to wait for verification to all subnets to complete:
rosa verify network --watch --status-only --region us-east-1 --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc

    • Ensure that verification to all subnets completes: 

      $ rosa verify network --watch --status-only --region us-east-1 --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc

      Example output

      I: Checking the status of the following subnet IDs: [subnet-03146b9b52b6024cb subnet-03146b9b52b2034cc]
I: subnet-03146b9b52b6024cb: passed
I: subnet-03146b9b52b2034cc: passed

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top