Red Hat adds BGP cloud connector for direct VM networking on OpenShift Service on AWS

Red Hat has introduced BGP cloud connector for Red Hat OpenShift Service on AWS (ROSA), available on cluster versions 4.22 and later, to solve a long-standing networking limitation for cloud-based virtualization. The feature allows traffic to reach OpenShift Virtualization guest VMs using their own IP addresses from within the AWS VPC and beyond, eliminating the need for NodePort Services or Routes that previously obscured VM identities.

The connector works by having cluster worker nodes act as routers between the VPC and in-cluster ClusterUserDefinedNetworks (CUDNs), using Border Gateway Protocol to advertise routes to Amazon VPC Route Server. Route Server maintains VPC route tables and handles failover by redirecting traffic to healthy workers when gateway nodes drop offline. This enables use cases including source-IP-based firewall rules, Active Directory Dynamic DNS, and clustered software like older Valkey versions that require consistent IP visibility across network boundaries.

How BGP cloud connector routes VM traffic

• BGP route advertisement: Cluster worker nodes use Border Gateway Protocol to advertise CUDN IP ranges to Amazon VPC Route Server, which propagates them into VPC route tables for direct Layer 3 routing.
• Single active gateway per prefix: VPC route tables support only one route per IP prefix, so Route Server publishes one worker node at a time as the active router for a given CUDN, with automatic failover to healthy nodes via BGP failure detection.
• NAT elimination: Traffic reaches guest VMs directly without Network Address Translation on worker node IPs, preserving the VM's original source IP address for external systems.
• AWS network integration: The VPC can connect to corporate networks through existing AWS services like Transit Gateway or Direct Connect, extending end-to-end connectivity to VMs without architectural redesign.
• Operator-based deployment: Setup requires installing and configuring a dedicated operator, with product documentation covering VPC configuration and first VM deployment.

Why it matters

This development matters for organizations running hybrid or multi-cloud virtualization workloads, as it removes a forced architectural compromise that pushed cloud VMs toward container-like networking abstractions. For Linux system administrators and platform engineers, it preserves traditional VM networking semantics in AWS, reducing migration friction from on-premise OpenShift Virtualization deployments and enabling security policies and clustered applications that depend on stable, visible IP addresses.