diff --git a/api/v1beta1/common_openstacknet.go b/api/v1beta1/common_openstacknet.go
index 94fb68df..05c415e0 100644
--- a/api/v1beta1/common_openstacknet.go
+++ b/api/v1beta1/common_openstacknet.go
@@ -124,6 +124,10 @@ func AddOSNetConfigRefLabel(
 		}
 	}
 
+	if _, ok := labels[shared.OpenStackNetConfigReconcileLabel]; !ok {
+		return labels, fmt.Errorf("OpenStackNet %s misses OpenStackNetConfig owner reference", subnetName)
+	}
+
 	return labels, nil
 }
 
diff --git a/api/v1beta1/openstackipset_webhook.go b/api/v1beta1/openstackipset_webhook.go
index 2af6c251..fffc7da2 100644
--- a/api/v1beta1/openstackipset_webhook.go
+++ b/api/v1beta1/openstackipset_webhook.go
@@ -76,7 +76,17 @@ var _ webhook.Validator = &OpenStackIPSet{}
 func (r *OpenStackIPSet) ValidateCreate() error {
 	openstackipsetlog.Info("validate create", "name", r.Name)
 
-	// TODO(user): fill in your validation logic upon object creation.
+	//
+	// Fail early on create if osnetcfg ist not found
+	//
+	_, err := GetOsNetCfg(webhookClient, r.GetNamespace(), r.GetLabels()[shared.OpenStackNetConfigReconcileLabel])
+	if err != nil {
+		return fmt.Errorf("error getting OpenStackNetConfig %s - %s: %w",
+			r.GetLabels()[shared.OpenStackNetConfigReconcileLabel],
+			r.Name,
+			err)
+	}
+
 	return nil
 }