diff --git a/.asf.yaml b/.asf.yaml
index 3b2f7691d136..f27b5afa4258 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -16,7 +16,6 @@
 # under the License.
 
 # https://cwiki.apache.org/confluence/display/INFRA/git+-+.asf.yaml+features
----
 github:
   description: "Apache CloudStack is an opensource Infrastructure as a Service (IaaS) cloud computing platform"
   homepage: https://cloudstack.apache.org/
@@ -57,8 +56,26 @@ github:
     - Damans227
     - jmsperu
     - GaOrtiga
+    - bhouse-nexthop
 
-  protected_branches: ~
+  protected_branches:
+
+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true
+
+  copilot_code_review:
+    enabled: true
+    review_drafts: true
+    review_on_push: true
 
 notifications:
   commits: commits@cloudstack.apache.org
diff --git a/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md b/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md
deleted file mode 100644
index 72d61b434efa..000000000000
--- a/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-# Report formatting guidelines
----
-
-## Report Structure Guidelines
-
-### 1. Header Levels
-**Use h3 (###) or lower for all headers in your issue report to maintain proper document hierarchy.**
-
-When creating GitHub issues or discussions:
-- Use `###` (h3) for main sections (e.g., "### Test Summary")
-- Use `####` (h4) for subsections (e.g., "#### Device-Specific Results")
-- Never use `##` (h2) or `#` (h1) in reports - these are reserved for titles
-
-### 2. Progressive Disclosure
-**Wrap detailed test results in `<details><summary>Section Name</summary>` tags to improve readability and reduce scrolling.**
-
-Use collapsible sections for:
-- Verbose details (full test logs, raw data)
-- Secondary information (minor warnings, extra context)
-- Per-item breakdowns when there are many items
-
-Always keep critical information visible (summary, critical issues, key metrics).
-
-### 3. Report Structure Pattern
-
-1. **Overview**: 1-2 paragraphs summarizing key findings
-2. **Critical Information**: Show immediately (summary stats, critical issues)
-3. **Details**: Use `<details><summary>Section Name</summary>` for expanded content
-4. **Context**: Add helpful metadata (workflow run, date, trigger)
-
-### Design Principles (Airbnb-Inspired)
-
-Reports should:
-- **Build trust through clarity**: Most important info immediately visible
-- **Exceed expectations**: Add helpful context like trends, comparisons
-- **Create delight**: Use progressive disclosure to reduce overwhelm
-- **Maintain consistency**: Follow patterns across all reports
-
-### Example Report Structure
-
-```markdown
-### Summary
-- Key metric 1: value
-- Key metric 2: value
-- Status: ✅/⚠️/❌
-
-### Critical Issues
-[Always visible - these are important]
-
-<details>
-<summary>View Detailed Results</summary>
-
-[Comprehensive details, logs, traces]
-
-</details>
-
-<details>
-<summary>View All Warnings</summary>
-
-[Minor issues and potential problems]
-
-</details>
-
-### Recommendations
-[Actionable next steps - keep visible]
-```
-
-## Workflow Run References
-
-- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`
-- Include up to 3 most relevant run URLs at end under `**References:**`
-- Do NOT add footer attribution (system adds automatically)
diff --git a/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md b/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md
deleted file mode 100644
index bc08afb42be9..000000000000
--- a/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-# Report formatting guidelines
----
-
-## Report Structure Guidelines
-
-### 1. Header Levels
-**Use h3 (###) or lower for all headers in your issue report to maintain proper document hierarchy.**
-
-When creating GitHub issues or discussions:
-- Use `###` (h3) for main sections (e.g., "### Test Summary")
-- Use `####` (h4) for subsections (e.g., "#### Device-Specific Results")
-- Never use `##` (h2) or `#` (h1) in reports - these are reserved for titles
-
-### 2. Progressive Disclosure
-**Wrap detailed test results in `<details><summary><b>Section Name</b></summary>` tags to improve readability and reduce scrolling.**
-
-Use collapsible sections for:
-- Verbose details (full test logs, raw data)
-- Secondary information (minor warnings, extra context)
-- Per-item breakdowns when there are many items
-
-Always keep critical information visible (summary, critical issues, key metrics).
-
-### 3. Report Structure Pattern
-
-1. **Overview**: 1-2 paragraphs summarizing key findings
-2. **Critical Information**: Show immediately (summary stats, critical issues)
-3. **Details**: Use `<details><summary><b>Section Name</b></summary>` for expanded content
-4. **Context**: Add helpful metadata (workflow run, date, trigger)
-
-### Design Principles (Airbnb-Inspired)
-
-Reports should:
-- **Build trust through clarity**: Most important info immediately visible
-- **Exceed expectations**: Add helpful context like trends, comparisons
-- **Create delight**: Use progressive disclosure to reduce overwhelm
-- **Maintain consistency**: Follow patterns across all reports
-
-### Example Report Structure
-
-```markdown
-### Summary
-- Key metric 1: value
-- Key metric 2: value
-- Status: ✅/⚠️/❌
-
-### Critical Issues
-[Always visible - these are important]
-
-<details>
-<summary><b>View Detailed Results</b></summary>
-
-[Comprehensive details, logs, traces]
-
-</details>
-
-<details>
-<summary><b>View All Warnings</b></summary>
-
-[Minor issues and potential problems]
-
-</details>
-
-### Recommendations
-[Actionable next steps - keep visible]
-```
-
-## Workflow Run References
-
-- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`
-- Include up to 3 most relevant run URLs at end under `**References:**`
-- Do NOT add footer attribution (system adds automatically)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4eb508f5f6f8..62b816719c7b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,7 +28,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9d03bf1209b..63484def8f9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
     if: github.repository == 'apache/cloudstack'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -251,7 +251,7 @@ jobs:
                   smoke/test_list_storage_pools
                   smoke/test_list_volumes"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -348,7 +348,7 @@ jobs:
           echo -e "Simulator CI Test Results: (only failures listed)\n"
           python3 ./tools/marvin/xunit-reader.py integration-test-results/
 
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: jacoco-coverage.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a2d581dcac20..f6bc65ad4b5b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,16 +35,16 @@ jobs:
         language: ["actions"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "Security"
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/daily-issue-triage.lock.yml
similarity index 90%
rename from .github/workflows/issue-triage-agent.lock.yml
rename to .github/workflows/daily-issue-triage.lock.yml
index 3acf91dcc1ef..bd07aeefd811 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/daily-issue-triage.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"3cfe810a6f1f402ae902098f1dc14b99a4281a5986d58b76e96eec1a2fde7646","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"919fb17c7928e5e96d9c0a2854670a42f9c5f6cfc2059b46009bb3c23640d0ca","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"46d564922b082d0db93244972e8005ea6904ee5f","version":"v0.76.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55","digest":"sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55","digest":"sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55","digest":"sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.19","digest":"sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4","digest":"sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -16,18 +16,17 @@
 #
 # This file was automatically generated by gh-aw (v0.76.1). DO NOT EDIT.
 #
-# To update this file, edit github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115 and run:
+# To update this file, edit githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 and run:
 #   gh aw compile
 # Not all edits will cause changes to this file.
 #
 # For more information: https://github.github.com/gh-aw/introduction/overview/
 #
+# Scheduled daily triage that processes untriaged CloudStack issues in batches.
+# Detects duplicates, filters spam, and assigns CloudStack-specific labels
+# (type:*, component:*, Severity:*, status:*), then posts a structured triage report.
 #
-# Source: github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115
-#
-# Resolved workflow manifest:
-#   Imports:
-#     - github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
+# Source: githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
 #
 # Secrets used:
 #   - COPILOT_GITHUB_TOKEN
@@ -36,13 +35,12 @@
 #   - GITHUB_TOKEN
 #
 # Custom actions used:
-#   - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+#   - actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 #   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 #   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
 #   - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
 #   - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-#   - github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+#   - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
 #
 # Container images used:
 #   - ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731
@@ -52,10 +50,10 @@
 #   - ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4
 #   - node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
 
-name: "Issue Triage Agent"
+name: "Daily Issue Triage"
 on:
   schedule:
-  - cron: "49 14 * * 1-5"
+  - cron: "26 13 * * 1-5"
     # Friendly format: daily around 14:00 on weekdays (scattered)
   workflow_dispatch:
     inputs:
@@ -70,7 +68,7 @@ permissions: {}
 concurrency:
   group: "gh-aw-${{ github.workflow }}"
 
-run-name: "Issue Triage Agent"
+run-name: "Daily Issue Triage"
 
 jobs:
   activation:
@@ -92,13 +90,13 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_SETUP_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-issue-triage.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_BODY_MODIFIED: "false"
@@ -112,7 +110,7 @@ jobs:
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AGENT_VERSION: "1.0.52"
           GH_AW_INFO_CLI_VERSION: "v0.76.1"
-          GH_AW_INFO_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_INFO_WORKFLOW_NAME: "Daily Issue Triage"
           GH_AW_INFO_EXPERIMENTAL: "false"
           GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
           GH_AW_INFO_STAGED: "false"
@@ -121,9 +119,8 @@ jobs:
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_AWMG_VERSION: ""
           GH_AW_INFO_FIREWALL_TYPE: "squid"
-          GH_AW_INFO_FRONTMATTER_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_INFO_FRONTMATTER_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
           GH_AW_INFO_BODY_MODIFIED: "false"
-          GH_AW_INFO_FRONTMATTER_EMOJI: "🔧"
           GH_AW_COMPILED_STRICT: "true"
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -138,7 +135,7 @@ jobs:
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
       - name: Checkout .github and .agents folders
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -163,7 +160,7 @@ jobs:
         id: check-lock-file
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_WORKFLOW_FILE: "issue-triage-agent.lock.yml"
+          GH_AW_WORKFLOW_FILE: "daily-issue-triage.lock.yml"
           GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
         with:
           script: |
@@ -197,20 +194,20 @@ jobs:
         run: |
           bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
           {
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_7c51e8f15cc7af75_EOF'
           <system>
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_7c51e8f15cc7af75_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_7c51e8f15cc7af75_EOF'
           <safe-output-tools>
-          Tools: add_comment, add_labels, missing_tool, missing_data, noop
+          Tools: add_comment(max:10), add_labels(max:10), missing_tool, missing_data, noop
           </safe-output-tools>
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_7c51e8f15cc7af75_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_7c51e8f15cc7af75_EOF'
           <github-context>
           The following GitHub context information is available for this workflow:
           {{#if github.actor}}
@@ -239,14 +236,12 @@ jobs:
           {{/if}}
           </github-context>
 
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_7c51e8f15cc7af75_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_7c51e8f15cc7af75_EOF'
           </system>
-          {{#runtime-import .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md}}
-          {{#runtime-import .github/workflows/shared/noop-reminder.md}}
-          {{#runtime-import .github/workflows/issue-triage-agent.md}}
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          {{#runtime-import .github/workflows/daily-issue-triage.md}}
+          GH_AW_PROMPT_7c51e8f15cc7af75_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -326,8 +321,7 @@ jobs:
   agent:
     needs: activation
     runs-on: ubuntu-latest
-    permissions:
-      issues: read
+    permissions: read-all
     concurrency:
       group: "gh-aw-copilot-${{ github.workflow }}"
     env:
@@ -336,9 +330,10 @@ jobs:
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
-      GH_AW_WORKFLOW_ID_SANITIZED: issuetriageagent
+      GH_AW_WORKFLOW_ID_SANITIZED: dailyissuetriage
     outputs:
       agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
+      checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
       effective_tokens_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.effective_tokens_rate_limit_error || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
@@ -354,15 +349,15 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_SETUP_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-issue-triage.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_BODY_MODIFIED: "false"
@@ -376,7 +371,7 @@ jobs:
             echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
           } >> "$GITHUB_OUTPUT"
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Create gh-aw temp directory
@@ -398,27 +393,44 @@ jobs:
           SERVER_URL_STRIPPED="${SERVER_URL#https://}"
           git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
           echo "Git configured with standard GitHub Actions identity"
+      - name: Checkout PR branch
+        id: checkout-pr
+        if: |
+          github.event.pull_request || github.event.issue.pull_request
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+        with:
+          github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
+            await main();
       - name: Install GitHub Copilot CLI
         run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.52
         env:
           GH_HOST: github.com
       - name: Install AWF binary
         run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.55
-      - name: Determine automatic lockdown mode for GitHub MCP Server
-        id: determine-automatic-lockdown
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
+      - name: Parse integrity filter lists
+        id: parse-guard-vars
         env:
-          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
-          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
-        with:
-          script: |
-            const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
-            await determineAutomaticLockdown(github, context, core);
+          GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
+          GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
+          GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
       - name: Download activation artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: activation
           path: /tmp/gh-aw
+      - name: Restore agent config folders from base branch
+        if: steps.checkout-pr.outcome == 'success'
+        env:
+          GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
+          GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
       - name: Restore inline sub-agents from activation artifact
         env:
           GH_AW_SUB_AGENT_DIR: ".github/agents"
@@ -435,16 +447,16 @@ jobs:
           mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF'
-          {"add_comment":{"max":1},"add_labels":{"allowed":["bug","feature","enhancement","documentation","question","help-wanted","good-first-issue"]},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF
+          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_09fd9551c3cd7278_EOF'
+          {"add_comment":{"max":10,"target":"*"},"add_labels":{"max":10,"target":"*"},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_09fd9551c3cd7278_EOF
       - name: Generate Safe Outputs Tools
         env:
           GH_AW_TOOLS_META_JSON: |
             {
               "description_suffixes": {
-                "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.",
-                "add_labels": " CONSTRAINTS: Only these labels are allowed: [\"bug\" \"feature\" \"enhancement\" \"documentation\" \"question\" \"help-wanted\" \"good-first-issue\"]."
+                "add_comment": " CONSTRAINTS: Maximum 10 comment(s) can be added. Target: *. Supports reply_to_id for discussion threading.",
+                "add_labels": " CONSTRAINTS: Maximum 10 label(s) can be added. Target: *."
               },
               "repo_params": {},
               "dynamic_tools": []
@@ -619,8 +631,6 @@ jobs:
           GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
-          GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }}
-          GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }}
           GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -eo pipefail
@@ -639,8 +649,6 @@ jobs:
           export DEBUG="*"
 
           export GH_AW_ENGINE="copilot"
-          export GH_AW_MCP_CLI_SERVERS='["safeoutputs"]'
-          echo GH_AW_MCP_CLI_SERVERS='["safeoutputs"]' >> "$GITHUB_ENV"
           MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
           MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
           case "${DOCKER_HOST:-}" in
@@ -653,7 +661,7 @@ jobs:
 
           mkdir -p /home/runner/.copilot
           GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
-          cat << GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+          cat << GH_AW_MCP_CONFIG_37cac1d5ee0c175c_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
               "github": {
@@ -667,8 +675,11 @@ jobs:
                 },
                 "guard-policies": {
                   "allow-only": {
-                    "min-integrity": "$GITHUB_MCP_GUARD_MIN_INTEGRITY",
-                    "repos": "$GITHUB_MCP_GUARD_REPOS"
+                    "approval-labels": ${{ steps.parse-guard-vars.outputs.approval_labels }},
+                    "blocked-users": ${{ steps.parse-guard-vars.outputs.blocked_users }},
+                    "min-integrity": "none",
+                    "repos": "all",
+                    "trusted-users": ${{ steps.parse-guard-vars.outputs.trusted_users }}
                   }
                 }
               },
@@ -694,7 +705,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF
+          GH_AW_MCP_CONFIG_37cac1d5ee0c175c_EOF
       - name: Mount MCP servers as CLIs
         id: mount-mcp-clis
         continue-on-error: true
@@ -719,7 +730,7 @@ jobs:
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
         # Copilot CLI tool arguments (sorted):
-        timeout-minutes: 5
+        timeout-minutes: 60
         run: |
           set -o pipefail
           printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
@@ -906,6 +917,8 @@ jobs:
             /tmp/gh-aw/sandbox/agent/logs/
             /tmp/gh-aw/redacted-urls.log
             /tmp/gh-aw/mcp-logs/
+            /tmp/gh-aw/proxy-logs/
+            !/tmp/gh-aw/proxy-logs/proxy-tls/
             /tmp/gh-aw/agent_usage.json
             /tmp/gh-aw/agent-stdio.log
             /tmp/gh-aw/pre-agent-audit.txt
@@ -937,7 +950,7 @@ jobs:
       issues: write
       pull-requests: write
     concurrency:
-      group: "gh-aw-conclusion-issue-triage-agent"
+      group: "gh-aw-conclusion-daily-issue-triage"
       cancel-in-progress: false
       queue: max
     outputs:
@@ -948,15 +961,15 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_SETUP_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-issue-triage.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_BODY_MODIFIED: "false"
@@ -981,9 +994,9 @@ jobs:
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
           GH_AW_NOOP_MAX: "1"
-          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_NOOP_REPORT_AS_ISSUE: "true"
@@ -999,9 +1012,9 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
           GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
@@ -1018,9 +1031,9 @@ jobs:
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
           GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
-          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
@@ -1034,9 +1047,9 @@ jobs:
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
           GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
-          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
@@ -1050,15 +1063,16 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
-          GH_AW_WORKFLOW_ID: "issue-triage-agent"
+          GH_AW_WORKFLOW_ID: "daily-issue-triage"
           GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
           GH_AW_ENGINE_ID: "copilot"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
+          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
           GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
           GH_AW_EFFECTIVE_TOKENS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.effective_tokens_rate_limit_error || 'false' }}
           GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
@@ -1072,7 +1086,7 @@ jobs:
           GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
           GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
           GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
-          GH_AW_TIMEOUT_MINUTES: "5"
+          GH_AW_TIMEOUT_MINUTES: "60"
           GH_AW_MAX_EFFECTIVE_TOKENS: "25000000"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
@@ -1098,15 +1112,15 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_SETUP_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-issue-triage.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_BODY_MODIFIED: "false"
@@ -1127,7 +1141,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
       - name: Checkout repository for patch context
         if: needs.agent.outputs.has_patch == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       # --- Threat Detection ---
@@ -1175,8 +1189,8 @@ jobs:
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          WORKFLOW_NAME: "Issue Triage Agent"
-          WORKFLOW_DESCRIPTION: "No description provided"
+          WORKFLOW_NAME: "Daily Issue Triage"
+          WORKFLOW_DESCRIPTION: "Scheduled daily triage that processes untriaged CloudStack issues in batches.\nDetects duplicates, filters spam, and assigns CloudStack-specific labels\n(type:*, component:*, Severity:*, status:*), then posts a structured triage report."
           HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
         with:
           script: |
@@ -1299,18 +1313,17 @@ jobs:
       pull-requests: write
     timeout-minutes: 15
     env:
-      GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/issue-triage-agent"
+      GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/daily-issue-triage"
       GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
       GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
       GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
       GH_AW_ENGINE_ID: "copilot"
       GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
       GH_AW_ENGINE_VERSION: "1.0.52"
-      GH_AW_WORKFLOW_EMOJI: "🔧"
-      GH_AW_WORKFLOW_ID: "issue-triage-agent"
-      GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-      GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
-      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+      GH_AW_WORKFLOW_ID: "daily-issue-triage"
+      GH_AW_WORKFLOW_NAME: "Daily Issue Triage"
+      GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9"
+      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/d7c1dc4b72b00607a67caaffdcc216cb64379cf9/workflows/daily-issue-triage.md"
     outputs:
       code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
       code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
@@ -1323,15 +1336,15 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
           trace-id: ${{ needs.activation.outputs.setup-trace-id }}
           parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
         env:
-          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_SETUP_WORKFLOW_NAME: "Daily Issue Triage"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-issue-triage.lock.yml@${{ github.ref }}
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AWF_VERSION: "v0.25.55"
           GH_AW_INFO_BODY_MODIFIED: "false"
@@ -1368,7 +1381,7 @@ jobs:
           GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_API_URL: ${{ github.api_url }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"allowed\":[\"bug\",\"feature\",\"enhancement\",\"documentation\",\"question\",\"help-wanted\",\"good-first-issue\"]},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":10,\"target\":\"*\"},\"add_labels\":{\"max\":10,\"target\":\"*\"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/daily-issue-triage.md b/.github/workflows/daily-issue-triage.md
new file mode 100644
index 000000000000..719dca1f3c63
--- /dev/null
+++ b/.github/workflows/daily-issue-triage.md
@@ -0,0 +1,171 @@
+---
+description: |
+  Scheduled daily triage that processes untriaged CloudStack issues in batches.
+  Detects duplicates, filters spam, and assigns CloudStack-specific labels
+  (type:*, component:*, Severity:*, status:*), then posts a structured triage report.
+
+name: Daily Issue Triage
+
+on:
+  schedule: daily around 14:00 on weekdays
+  workflow_dispatch:
+
+permissions: read-all
+
+network: defaults
+
+safe-outputs:
+  add-labels:
+    target: "*"
+    max: 10
+  add-comment:
+    target: "*"
+    max: 10
+
+tools:
+  web-fetch:
+  github:
+    toolsets: [issues, labels]
+    min-integrity: none
+
+source: githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
+timeout-minutes: 60
+---
+
+# Daily Issue Triage
+
+<!-- Note - this file can be customized to your needs. Replace this section directly, or add further instructions here. After editing run 'gh aw compile' -->
+
+You are a batch triage assistant for GitHub issues in **${{ github.repository }}** (Apache CloudStack). Your task is to find untriaged issues and triage them one by one. Your triage comments are written for maintainers reviewing the triage, not for the issue author.
+
+Do not make assumptions beyond what the issue content supports. Do not invent missing context.
+
+## Step 1: Find untriaged issues
+
+Use the `search_issues` tool to find open issues that need triage. An issue is considered untriaged if it has **no labels applied**.
+
+Query: `repo:${{ github.repository }} is:issue is:open no:label`
+
+Paginate through all results to find untriaged issues. Do not stop at the first page.
+
+From the results, filter out:
+- Issues that already have a triage comment (look for "🎯 Triage report" in comments). **Never retriage an issue that has already been triaged.**
+- Issues created by bots (unless they look like real user issues).
+- Issues that have any labels already applied (even if they weren't applied by this workflow).
+
+Process the **oldest untriaged issues first**. Note: this workflow is capped at 10 label-sets and 10 comments per run, so the backlog will drain over several daily runs — that is intentional.
+
+## Step 2: Fetch labels (once)
+
+Before triaging any issues, fetch the list of labels available in this repository using the `list_labels` tool. Use this live list for all issues in the batch — only apply labels that actually exist in the repository.
+
+CloudStack uses a prefixed label taxonomy. Choose from these families:
+
+- **Type** (pick the single best one): `type:bug`, `type:new-feature`, `type:enhancement`, `type:improvement`, `type:regression`, `type:security`, `type:question`, `type:config`, `type:cleanup`
+- **Component** (apply when clearly identifiable; more than one is allowed): e.g. `component:kvm`, `component:vmware`, `component:XenServer`, `component:api`, `component:UI`, `component:networking`, `component:virtual-router`, `component:management-server`, `component:primary-storage`, `component:secondary-storage`, `component:kubernetes`, `component:database`, and others — use the full list returned by `list_labels`.
+- **Severity** (bugs only, when assessable): `Severity:BLOCKER`, `Severity:Critical`, `Severity:Major`, `Severity:Minor`, `Severity:Trivial`
+- **Duplicate / invalid**: `status:duplicate`, `status:invalid`
+- **Help wanted / newcomer-friendly**: `status:Help-wanted`
+
+## Step 3: Triage each issue
+
+For each untriaged issue, perform the following steps:
+
+### 3a: Gather context
+
+1. Retrieve the full issue content using the `get_issue` tool.
+2. Fetch any comments on the issue using the `get_issue_comments` tool.
+3. Search for similar issues using the `search_issues` tool.
+
+### 3b: Spam and quality check
+
+**Spam and invalid issues:** If the issue is obviously spam, bot-generated, gibberish, or a test issue:
+- Apply the `status:invalid` label.
+- **Do not close the issue** — closing is a human decision. Note in the report that it looks like spam/invalid so a maintainer can act.
+- Move to the next issue.
+
+**Incomplete issues:** If the issue lacks enough detail for meaningful triage, add a comment that politely asks the author to provide the missing information:
+- For bugs: steps to reproduce, expected vs actual behavior, logs/errors, environment details (CloudStack version, hypervisor, etc.).
+- For other issue types: equivalent details that would make the report actionable.
+- Apply a `type:question` label if appropriate.
+- Be specific about what is missing and why it is needed.
+- Move to the next issue.
+
+### 3c: Select labels
+
+- Be cautious with labels; they can trigger automation.
+- Choose a single `type:*` label that best reflects the issue's nature.
+- Add `component:*` label(s) when the affected area is clear from the content.
+- Add a `Severity:*` label for bugs when severity can be reasonably assessed.
+- Do not apply labels that do not exist in the repository.
+- It is better to under-label than to speculatively add labels.
+
+### 3d: Detect duplicates and related issues
+
+- Review the similar issues found in Step 3a.
+- Classify matches as:
+  - **Duplicate** (high confidence): the issue describes the same problem as an existing open issue. Include up to 3.
+  - **Related**: similar domain or adjacent problem, but not a duplicate. Include up to 3.
+- If a high-confidence duplicate is found, apply the `status:duplicate` label.
+- If no similar issues are found, state that explicitly in your report.
+
+### 3e: Assess coding agent suitability
+
+Assess whether the issue is suitable for automated coding agent assignment:
+- **Suitable**: clear requirements, sufficient context, well-defined success criteria, self-contained scope.
+- **Needs more info**: potentially suitable but missing details needed to start.
+- **Not suitable**: requires investigation, design decisions, extensive coordination, or policy/architectural choices.
+
+### 3f: Additional analysis
+
+- Search the web for relevant documentation, error messages, or known solutions if applicable.
+- Write notes, debugging strategies, and/or reproduction steps relevant to the issue.
+- Suggest resources or links that might help resolve the issue.
+
+### 3g: Apply results and post comment
+
+Apply all triage results for this issue:
+- Use `update_issue` to apply the chosen labels.
+- Add an issue comment with the triage report using the format below.
+
+Then move to the next issue.
+
+## Processing order
+
+1. Fetch available labels (Step 2, once at the start).
+2. Find untriaged issues (Step 1).
+3. For each issue (oldest first), run Step 3 (gather, check, label, detect duplicates, comment).
+
+## Comment format
+
+Use this structure for each triage comment. Use collapsed sections to keep it tidy.
+
+```markdown
+## 🎯 Triage report
+
+{2-3 sentence summary to help a maintainer quickly grasp the issue.}
+
+### 📊 Assessment
+
+| Dimension | Value | Reasoning |
+|---|---|---|
+| **Type** | [type:* label or "none"] | [brief] |
+| **Component** | [component:* label(s) or "none"] | [brief] |
+| **Severity** | [Severity:* label or "n/a"] | [brief] |
+| **Labels** | [all labels applied or "none"] | [brief] |
+| **Coding agent** | [Suitable / Needs more info / Not suitable] | [brief] |
+
+### 🔗 Similar issues
+
+- issue-url (duplicate/related) — [brief explanation]
+
+<details><summary>💡 Notes and suggestions</summary>
+
+{Debugging strategies, reproduction steps, resource links, sub-task checklists, nudges for the team.}
+
+</details>
+```
+
+If no similar issues were found, omit the "Similar issues" section. If there are no notes to add, omit the collapsed section.
+
+**Important**: Never close issues. Only apply labels and post comments.
diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index 7c3d20a166ea..0992d3b67de0 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"ae44897dc32d20c421588b31a279653abf436964ad86c58885e0edbfbb2f0416","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"bcecce6f1d9f8df2b3eca9eb7bb1fdbac13c396c240a2dc802a96546f435b969","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot","agent_model":"claude-haiku-4.5"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"46d564922b082d0db93244972e8005ea6904ee5f","version":"v0.76.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55","digest":"sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55","digest":"sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55","digest":"sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.19","digest":"sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4","digest":"sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -36,12 +36,12 @@
 #   - GITHUB_TOKEN
 #
 # Custom actions used:
-#   - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+#   - actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 #   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 #   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
 #   - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
 #   - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-#   - github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+#   - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
 #
 # Container images used:
 #   - ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731
@@ -91,7 +91,7 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
@@ -107,7 +107,7 @@ jobs:
         env:
           GH_AW_INFO_ENGINE_ID: "copilot"
           GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
-          GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_INFO_MODEL: "claude-haiku-4.5"
           GH_AW_INFO_VERSION: "1.0.52"
           GH_AW_INFO_AGENT_VERSION: "1.0.52"
           GH_AW_INFO_CLI_VERSION: "v0.76.1"
@@ -136,7 +136,7 @@ jobs:
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
       - name: Checkout .github and .agents folders
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -195,20 +195,20 @@ jobs:
         run: |
           bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
           {
-          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          cat << 'GH_AW_PROMPT_eeb322738661ed58_EOF'
           <system>
-          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          GH_AW_PROMPT_eeb322738661ed58_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          cat << 'GH_AW_PROMPT_eeb322738661ed58_EOF'
           <safe-output-tools>
           Tools: create_issue, missing_tool, missing_data, noop
           </safe-output-tools>
-          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          GH_AW_PROMPT_eeb322738661ed58_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
-          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          cat << 'GH_AW_PROMPT_eeb322738661ed58_EOF'
           <github-context>
           The following GitHub context information is available for this workflow:
           {{#if github.actor}}
@@ -237,12 +237,12 @@ jobs:
           {{/if}}
           </github-context>
 
-          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          GH_AW_PROMPT_eeb322738661ed58_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          cat << 'GH_AW_PROMPT_eeb322738661ed58_EOF'
           </system>
           {{#runtime-import .github/workflows/daily-repo-status.md}}
-          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          GH_AW_PROMPT_eeb322738661ed58_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -352,7 +352,7 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
@@ -374,7 +374,7 @@ jobs:
             echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
           } >> "$GITHUB_OUTPUT"
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Create gh-aw temp directory
@@ -450,9 +450,9 @@ jobs:
           mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_9b6646f0d620a78f_EOF'
+          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_51571b44da85874d_EOF'
           {"create_issue":{"close_older_issues":true,"labels":["report","daily-status"],"max":1,"title_prefix":"[repo-status] "},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_9b6646f0d620a78f_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_51571b44da85874d_EOF
       - name: Generate Safe Outputs Tools
         env:
           GH_AW_TOOLS_META_JSON: |
@@ -658,7 +658,7 @@ jobs:
 
           mkdir -p /home/runner/.copilot
           GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
-          cat << GH_AW_MCP_CONFIG_d075a7f45ab51044_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+          cat << GH_AW_MCP_CONFIG_4b3a7789a6eea081_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
               "github": {
@@ -702,7 +702,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_d075a7f45ab51044_EOF
+          GH_AW_MCP_CONFIG_4b3a7789a6eea081_EOF
       - name: Mount MCP servers as CLIs
         id: mount-mcp-clis
         continue-on-error: true
@@ -750,7 +750,7 @@ jobs:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
           COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+          COPILOT_MODEL: claude-haiku-4.5
           GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
           GH_AW_PHASE: agent
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@@ -957,7 +957,7 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
@@ -1108,7 +1108,7 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
@@ -1137,7 +1137,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
       - name: Checkout repository for patch context
         if: needs.agent.outputs.has_patch == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       # --- Threat Detection ---
@@ -1238,7 +1238,7 @@ jobs:
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
           COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || 'claude-sonnet-4.6' }}
+          COPILOT_MODEL: claude-haiku-4.5
           GH_AW_PHASE: detection
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
           GH_AW_VERSION: v0.76.1
@@ -1312,7 +1312,7 @@ jobs:
       GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
       GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
       GH_AW_ENGINE_ID: "copilot"
-      GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+      GH_AW_ENGINE_MODEL: "claude-haiku-4.5"
       GH_AW_ENGINE_VERSION: "1.0.52"
       GH_AW_WORKFLOW_ID: "daily-repo-status"
       GH_AW_WORKFLOW_NAME: "Repo Status"
@@ -1330,7 +1330,7 @@ jobs:
     steps:
       - name: Setup Scripts
         id: setup
-        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
           job-name: ${{ github.job }}
diff --git a/.github/workflows/daily-repo-status.md b/.github/workflows/daily-repo-status.md
index 8debf5708437..49b553940b8b 100644
--- a/.github/workflows/daily-repo-status.md
+++ b/.github/workflows/daily-repo-status.md
@@ -16,6 +16,10 @@ permissions:
 
 network: defaults
 
+engine:
+  id: copilot
+  model: claude-haiku-4.5
+
 tools:
   github:
     # If in a public repo, setting `lockdown: false` allows
diff --git a/.github/workflows/docker-cloudstack-simulator.yml b/.github/workflows/docker-cloudstack-simulator.yml
index dc00968563d0..ac778a48af54 100644
--- a/.github/workflows/docker-cloudstack-simulator.yml
+++ b/.github/workflows/docker-cloudstack-simulator.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Login to Docker Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USER }}
@@ -47,7 +47,7 @@ jobs:
       - name: Set Docker repository name
         run: echo "DOCKER_REPOSITORY=apache" >> $GITHUB_ENV
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/issue-triage-agent.md b/.github/workflows/issue-triage-agent.md
deleted file mode 100644
index 26c43644618c..000000000000
--- a/.github/workflows/issue-triage-agent.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-on:
-  schedule: daily around 14:00 on weekdays
-  workflow_dispatch: null
-permissions:
-  issues: read
-imports:
-- github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
-safe-outputs:
-  add-comment: {}
-  add-labels:
-    allowed:
-    - bug
-    - feature
-    - enhancement
-    - documentation
-    - question
-    - help-wanted
-    - good-first-issue
-emoji: 🔧
-source: github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115
-strict: true
-timeout-minutes: 5
-tools:
-  cli-proxy: true
-  github:
-    toolsets:
-    - issues
-    - labels
----
-# Issue Triage Agent
-
-List open issues in ${{ github.repository }} that have no labels. For each unlabeled issue, analyze the title and body, then add one of the allowed labels: `bug`, `feature`, `enhancement`, `documentation`, `question`, `help-wanted`, or `good-first-issue`.
-
-Skip issues that:
-- Already have any of these labels
-- Have been assigned to any user (especially non-bot users)
-
-After adding the label to an issue, mention the issue author in a comment using this format (follow shared/reporting.md guidelines):
-
-**Comment Template**:
-```markdown
-### 🏷️ Issue Triaged
-
-Hi @{author}! I've categorized this issue as **{label_name}** based on the following analysis:
-
-**Reasoning**: {brief_explanation_of_why_this_label}
-
-<details>
-<summary>View Triage Details</summary>
-
-#### Analysis
-- **Keywords detected**: {list_of_keywords_that_matched}
-- **Issue type indicators**: {what_made_this_fit_the_category}
-- **Confidence**: {High/Medium/Low}
-
-#### Recommended Next Steps
-- {context_specific_suggestion_1}
-- {context_specific_suggestion_2}
-
-</details>
-
-**References**: [Triage run §{run_id}](https://github.com/github/gh-aw/actions/runs/{run_id})
-```
-
-**Key formatting requirements**:
-- Use h3 (###) for the main heading
-- Keep reasoning visible for quick understanding
-- Wrap detailed analysis in `<details>` tags
-- Include workflow run reference
-- Keep total comment concise (collapsed details prevent noise)
-
-## Batch Comment Optimization
-
-For efficiency, if multiple issues are triaged in a single run:
-1. Add individual labels to each issue
-2. Add a brief comment to each issue (using the template above)
-3. Optionally: Create a discussion summarizing all triage actions for that run
-
-This provides both per-issue context and batch visibility.
-
-## Labels
-
-- `bug`: Indicates a problem or error in the code that needs fixing.
-- `feature`: Represents a new feature request or enhancement to existing functionality.
-- `enhancement`: Suggests improvements to existing features or code.
-- `documentation`: Pertains to issues related to documentation, such as missing or unclear docs.
-- `question`: Used for issues that are asking for clarification or have questions about the project.
-- `help-wanted`: Indicates that the issue is a good candidate for external contributions and help
-- `good-first-issue`: Marks issues that are suitable for newcomers to the project, often with simpler scope.
-
-{{#runtime-import shared/noop-reminder.md}}
diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml
index ad58d07a9894..f48409fbc0c3 100644
--- a/.github/workflows/main-sonar-check.yml
+++ b/.github/workflows/main-sonar-check.yml
@@ -31,7 +31,7 @@ jobs:
     name: Sonar JaCoCo Coverage
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -55,7 +55,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.branch.name=${{ github.ref_name }}
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./client/target/site/jacoco-aggregate/jacoco.xml
           fail_ci_if_error: true
@@ -63,3 +63,5 @@ jobs:
           verbose: true
           name: codecov
           token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Compute Coverage Grade
+        run: bash scripts/coverage-grade.sh client/target/site/jacoco-aggregate/jacoco.xml
diff --git a/.github/workflows/merge-conflict-checker.yml b/.github/workflows/merge-conflict-checker.yml
index f23719f7183a..badf8c4b4c5b 100644
--- a/.github/workflows/merge-conflict-checker.yml
+++ b/.github/workflows/merge-conflict-checker.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Conflict Check
-        uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
+        uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
         with:
           repoToken: "${{ secrets.GITHUB_TOKEN }}"
           dirtyLabel: "status:has-conflicts"
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1ea00be9112f..4de995479c59 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Check Out
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Set up Python
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index a36a956856e7..f8b0aa149324 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -28,7 +28,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup Environment
diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml
index 49a49d009580..fbb3cb9f540d 100644
--- a/.github/workflows/sonar-check.yml
+++ b/.github/workflows/sonar-check.yml
@@ -29,7 +29,7 @@ jobs:
     name: Sonar JaCoCo Coverage
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -57,7 +57,7 @@ jobs:
           HEADREF: ${{ github.event.pull_request.head.ref }}
         run: |
           mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.pullrequest.key="$PR_ID" -Dsonar.pullrequest.branch="$HEADREF" -Dsonar.pullrequest.github.repository=apache/cloudstack -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.summary_comment=true
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./client/target/site/jacoco-aggregate/jacoco.xml
           fail_ci_if_error: true
@@ -65,3 +65,51 @@ jobs:
           verbose: true
           name: codecov
           token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Compute Coverage Grade
+        id: grade
+        run: bash scripts/coverage-grade.sh client/target/site/jacoco-aggregate/jacoco.xml
+      - name: Post Coverage Grade Comment on PR
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const grade     = '${{ steps.grade.outputs.coverage_grade }}';
+            const label     = '${{ steps.grade.outputs.coverage_grade_label }}';
+            const linePct   = '${{ steps.grade.outputs.line_coverage }}';
+            const branchPct = '${{ steps.grade.outputs.branch_coverage }}';
+            const emojiMap  = { A: '🟢', B: '🟡', C: '🟠', D: '🔴', F: '⛔' };
+            const emoji     = emojiMap[grade] ?? '❓';
+            const runUrl    = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+
+            const branchRow = branchPct !== 'N/A'
+              ? `| Branch coverage | **${branchPct}%** |`
+              : '';
+
+            const body = [
+              `## ${emoji} Test Coverage Grade: \`${grade}\` — ${label}`,
+              '',
+              '| Metric | Value |',
+              '|--------|-------|',
+              `| Line coverage   | **${linePct}%** |`,
+              branchRow,
+              '',
+              '### Grade Scale',
+              '| Grade | Line Coverage | Meaning |',
+              '|-------|--------------|---------|',
+              '| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |',
+              '| 🟡 B | 60-79% | Good - almost there, don\'t stop now 😉 |',
+              '| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |',
+              '| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |',
+              '| ⛔ F | < 20%  | Failing - tests? what tests? 🔥 |',
+              '',
+              '> Branch coverage is shown as a secondary signal. Grade is determined by **line coverage**.',
+              `> [View full Actions run](${runUrl})`,
+            ].filter(l => l !== undefined).join('\n');
+
+            await github.rest.issues.createComment({
+              owner:        context.repo.owner,
+              repo:         context.repo.repo,
+              issue_number: context.issue.number,
+              body:         body,
+            });
+            console.log('Posted coverage grade comment');
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index ff27809db8f6..aeccb5624f72 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -59,7 +59,7 @@ jobs:
           npm run lint
           npm run test:unit
 
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: github.repository == 'apache/cloudstack'
         with:
           working-directory: ui
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 755ae125edf0..91537e25267e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -151,7 +151,7 @@ repos:
           ^server/src/test/resources/certs/rsa_self_signed\.key$|
           ^services/console-proxy/rdpconsole/src/test/doc/rdp-key\.pem$|
           ^systemvm/agent/certs/localhost\.key$|
-          ^systemvm/agent/certs/realhostip\.key$|
+          ^systemvm/agent/certs/systemvm\.key$|
           ^test/integration/smoke/test_ssl_offloading\.py$
       - id: end-of-file-fixer
         exclude: \.vhd$|\.svg$
diff --git a/agent/conf/agent.properties b/agent/conf/agent.properties
index ba4a3874664a..0a459d8d4fc5 100644
--- a/agent/conf/agent.properties
+++ b/agent/conf/agent.properties
@@ -78,6 +78,14 @@ zone=default
 # Generated with "uuidgen".
 local.storage.uuid=
 
+# Enable TLS for image server transfers. The keys are read from:
+# cert file = /etc/cloudstack/agent/cloud.crt
+# key file = /etc/cloudstack/agent/cloud.key
+image.server.tls.enabled=true
+
+# The Address for the network interface that the image server listens on. If not specified, it will listen on the Management network.
+#image.server.listen.address=
+
 # Location for KVM virtual router scripts.
 # The path defined in this property is relative to the directory "/usr/share/cloudstack-common/".
 domr.scripts.dir=scripts/network/domr/kvm
diff --git a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
index e69a7efdc9c7..18a6b6df1006 100644
--- a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
+++ b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
@@ -123,6 +123,20 @@ public class AgentProperties{
      */
     public static final Property<String> LOCAL_STORAGE_PATH = new Property<>("local.storage.path", "/var/lib/libvirt/images/");
 
+    /**
+     * Enables TLS on the KVM image server transfer endpoint.<br>
+     * Data type: Boolean.<br>
+     * Default value: <code>true</code>
+     */
+    public static final Property<Boolean> IMAGE_SERVER_TLS_ENABLED = new Property<>("image.server.tls.enabled", true);
+
+    /**
+     * The IP address that the KVM image server listens on.<br>
+     * Data type: String.<br>
+     * Default value: <code>null</code>
+     */
+    public static final Property<String> IMAGE_SERVER_LISTEN_ADDRESS = new Property<>("image.server.listen.address", null, String.class);
+
     /**
      * Directory where Qemu sockets are placed.<br>
      * These sockets are for the Qemu Guest Agent and SSVM provisioning.<br>
diff --git a/api/src/main/java/com/cloud/host/Host.java b/api/src/main/java/com/cloud/host/Host.java
index b52348201516..8b14cfd3a390 100644
--- a/api/src/main/java/com/cloud/host/Host.java
+++ b/api/src/main/java/com/cloud/host/Host.java
@@ -63,6 +63,8 @@ public static String[] toStrings(Host.Type... types) {
     String HOST_OVFTOOL_VERSION = "host.ovftool.version";
     String HOST_VIRTV2V_VERSION = "host.virtv2v.version";
     String HOST_SSH_PORT = "host.ssh.port";
+    String GUEST_OS_CATEGORY_ID = "guest.os.category.id";
+    String GUEST_OS_RULE = "guest.os.rule";
 
     int DEFAULT_SSH_PORT = 22;
 
diff --git a/api/src/main/java/com/cloud/network/NetworkService.java b/api/src/main/java/com/cloud/network/NetworkService.java
index 53692f932a4e..c32bb711c0f2 100644
--- a/api/src/main/java/com/cloud/network/NetworkService.java
+++ b/api/src/main/java/com/cloud/network/NetworkService.java
@@ -232,7 +232,7 @@ Network createPrivateNetwork(String networkName, String displayText, long physic
     /**
      * Requests an IP address for the guest NIC
      */
-    NicSecondaryIp allocateSecondaryGuestIP(long nicId, IpAddresses requestedIpPair) throws InsufficientAddressCapacityException;
+    NicSecondaryIp allocateSecondaryGuestIP(long nicId, IpAddresses requestedIpPair, String description) throws InsufficientAddressCapacityException;
 
     boolean releaseSecondaryIpFromNic(long ipAddressId);
 
diff --git a/api/src/main/java/com/cloud/storage/Storage.java b/api/src/main/java/com/cloud/storage/Storage.java
index 5b3e97698fda..ddf5978497ba 100644
--- a/api/src/main/java/com/cloud/storage/Storage.java
+++ b/api/src/main/java/com/cloud/storage/Storage.java
@@ -170,6 +170,7 @@ public static enum StoragePoolType {
         ISO(false, false, EncryptionSupport.Unsupported), // for iso image
         LVM(false, false, EncryptionSupport.Unsupported), // XenServer local LVM SR
         CLVM(true, false, EncryptionSupport.Unsupported),
+        CLVM_NG(true, false, EncryptionSupport.Hypervisor),
         RBD(true, true, EncryptionSupport.Unsupported), // http://libvirt.org/storage.html#StorageBackendRBD
         SharedMountPoint(true, true, EncryptionSupport.Hypervisor),
         VMFS(true, true, EncryptionSupport.Unsupported), // VMware VMFS storage
diff --git a/api/src/main/java/com/cloud/storage/VolumeApiService.java b/api/src/main/java/com/cloud/storage/VolumeApiService.java
index 1a9bcc6ee98b..43ead8d287b9 100644
--- a/api/src/main/java/com/cloud/storage/VolumeApiService.java
+++ b/api/src/main/java/com/cloud/storage/VolumeApiService.java
@@ -22,6 +22,7 @@
 import java.util.List;
 import java.util.Map;
 
+import com.cloud.dc.DataCenter;
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.offering.DiskOffering;
 import com.cloud.user.Account;
@@ -70,6 +71,10 @@ public interface VolumeApiService {
      */
     Volume allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationException;
 
+    Volume allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long vmId, Long snapshotId, String name,
+           Long cmdSize, Boolean displayVolume, Long cmdMinIops, Long cmdMaxIops, String customId)
+            throws ResourceAllocationException;
+
     /**
      * Creates the volume based on the given criteria
      *
@@ -80,6 +85,8 @@ public interface VolumeApiService {
      */
     Volume createVolume(CreateVolumeCmd cmd);
 
+    Volume createVolume(long volumeId, Long vmId, Long snapshotId, Long storageId, Boolean display);
+
     /**
      * Resizes the volume based on the given criteria
      *
@@ -203,4 +210,6 @@ Volume updateVolume(long volumeId, String path, String state, Long storageId,
     Pair<String, String> checkAndRepairVolume(CheckAndRepairVolumeCmd cmd) throws ResourceAllocationException;
 
     Long getVolumePhysicalSize(Storage.ImageFormat format, String path, String chainInfo);
+
+    Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone, boolean encryptEnabledOnly);
 }
diff --git a/api/src/main/java/com/cloud/user/AccountService.java b/api/src/main/java/com/cloud/user/AccountService.java
index 4145e2b89eb3..fc450e9179c5 100644
--- a/api/src/main/java/com/cloud/user/AccountService.java
+++ b/api/src/main/java/com/cloud/user/AccountService.java
@@ -88,10 +88,16 @@ User createUser(String userName, String password, String firstName, String lastN
 
     Account getActiveAccountById(long accountId);
 
+    Account getActiveAccountByUuid(String accountUuid);
+
     Account getAccount(long accountId);
 
+    Account getAccountByUuid(String accountUuid);
+
     User getActiveUser(long userId);
 
+    User getOneActiveUserForAccount(Account account);
+
     User getUserIncludingRemoved(long userId);
 
     boolean isRootAdmin(Long accountId);
diff --git a/api/src/main/java/com/cloud/vm/NicSecondaryIp.java b/api/src/main/java/com/cloud/vm/NicSecondaryIp.java
index 2856e0aea756..d25627c1782d 100644
--- a/api/src/main/java/com/cloud/vm/NicSecondaryIp.java
+++ b/api/src/main/java/com/cloud/vm/NicSecondaryIp.java
@@ -38,6 +38,8 @@ public interface NicSecondaryIp extends ControlledEntity, Identity, InternalIden
 
     String getIp6Address();
 
+    String getDescription();
+
     long getNetworkId();
 
     long getVmId();
diff --git a/api/src/main/java/com/cloud/vm/VmDetailConstants.java b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
index 9e56bf4f17b2..33cc6da70812 100644
--- a/api/src/main/java/com/cloud/vm/VmDetailConstants.java
+++ b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
@@ -130,4 +130,10 @@ public interface VmDetailConstants {
     String EXTERNAL_DETAIL_PREFIX = "External:";
     String CLOUDSTACK_VM_DETAILS = "cloudstack.vm.details";
     String CLOUDSTACK_VLAN = "cloudstack.vlan";
+
+    // KVM Checkpoints related
+    String ACTIVE_CHECKPOINT_ID = "active.checkpoint.id";
+    String ACTIVE_CHECKPOINT_CREATE_TIME = "active.checkpoint.create.time";
+    String LAST_CHECKPOINT_ID = "last.checkpoint.id";
+    String LAST_CHECKPOINT_CREATE_TIME = "last.checkpoint.create.time";
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 694830ea2f36..2150cfb2200f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -79,6 +79,7 @@ public class ApiConstants {
     public static final String BOOTABLE = "bootable";
     public static final String BIND_DN = "binddn";
     public static final String BIND_PASSWORD = "bindpass";
+    public static final String BLANK_INSTANCE = "blankinstance";
     public static final String BUS_ADDRESS = "busaddress";
     public static final String BYTES_READ_RATE = "bytesreadrate";
     public static final String BYTES_READ_RATE_MAX = "bytesreadratemax";
@@ -220,6 +221,7 @@ public class ApiConstants {
     public static final String DOMAIN_PATH = "domainpath";
     public static final String DOMAIN_ID = "domainid";
     public static final String DOMAIN__ID = "domainId";
+    public static final String DUMMY = "dummy";
     public static final String DURATION = "duration";
     public static final String ELIGIBLE = "eligible";
     public static final String EMAIL = "email";
@@ -263,6 +265,7 @@ public class ApiConstants {
     public static final String FOR_VIRTUAL_NETWORK = "forvirtualnetwork";
     public static final String FOR_SYSTEM_VMS = "forsystemvms";
     public static final String FOR_PROVIDER = "forprovider";
+    public static final String FROM_CHECKPOINT_ID = "fromcheckpointid";
     public static final String FULL_PATH = "fullpath";
     public static final String GATEWAY = "gateway";
     public static final String IP6_GATEWAY = "ip6gateway";
@@ -335,6 +338,7 @@ public class ApiConstants {
     public static final String IS_2FA_VERIFIED = "is2faverified";
 
     public static final String IS_2FA_MANDATED = "is2famandated";
+    public static final String IS_ACTIVE = "isactive";
     public static final String IS_ASYNC = "isasync";
     public static final String IP_AVAILABLE = "ipavailable";
     public static final String IP_LIMIT = "iplimit";
@@ -445,6 +449,7 @@ public class ApiConstants {
     public static final String MAX_VGPU_PER_PHYSICAL_GPU = "maxvgpuperphysicalgpu";
     public static final String GUEST_OS_LIST = "guestoslist";
     public static final String GUEST_OS_COUNT = "guestoscount";
+    public static final String GUEST_OS_RULE = "guestosrule";
     public static final String OS_MAPPING_CHECK_ENABLED = "osmappingcheckenabled";
     public static final String OUTOFBANDMANAGEMENT_POWERSTATE = "outofbandmanagementpowerstate";
     public static final String OUTOFBANDMANAGEMENT_ENABLED = "outofbandmanagementenabled";
@@ -598,6 +603,8 @@ public class ApiConstants {
     public static final String SUITABLE_FOR_VM = "suitableforvirtualmachine";
     public static final String SUPPORTS_STORAGE_SNAPSHOT = "supportsstoragesnapshot";
     public static final String TARGET_IQN = "targetiqn";
+    public static final String TARIFF_ID = "tariffid";
+    public static final String TARIFF_NAME = "tariffname";
     public static final String TASKS_FILTER = "tasksfilter";
     public static final String TEMPLATE_FILTER = "templatefilter";
     public static final String TEMPLATE_ID = "templateid";
@@ -611,6 +618,7 @@ public class ApiConstants {
     public static final String TENANT_NAME = "tenantname";
     public static final String TOTAL = "total";
     public static final String TOTAL_SUBNETS = "totalsubnets";
+    public static final String TO_CHECKPOINT_ID = "tocheckpointid";
     public static final String TOTAL_QUOTA = "totalquota";
     public static final String TYPE = "type";
     public static final String TRUST_STORE = "truststore";
@@ -658,6 +666,7 @@ public class ApiConstants {
     public static final String VIRTUAL_MACHINE_STATE = "vmstate";
     public static final String VIRTUAL_MACHINES = "virtualmachines";
     public static final String USAGE_ID = "usageid";
+    public static final String USAGE_NAME = "usagename";
     public static final String USAGE_TYPE = "usagetype";
     public static final String INCLUDE_TAGS = "includetags";
 
@@ -874,6 +883,7 @@ public class ApiConstants {
     public static final String IS_SOURCE_NAT = "issourcenat";
     public static final String IS_STATIC_NAT = "isstaticnat";
     public static final String ITERATIONS = "iterations";
+    public static final String ITEMS = "items";
     public static final String SORT_BY = "sortby";
     public static final String CHANGE_CIDR = "changecidr";
     public static final String PURPOSE = "purpose";
@@ -1333,8 +1343,10 @@ public class ApiConstants {
     public static final String VNF_CONFIGURE_MANAGEMENT = "vnfconfiguremanagement";
     public static final String VNF_CIDR_LIST = "vnfcidrlist";
 
+    public static final String AUTHORIZE_URL = "authorizeurl";
     public static final String CLIENT_ID = "clientid";
     public static final String REDIRECT_URI = "redirecturi";
+    public static final String TOKEN_URL = "tokenurl";
 
     public static final String IS_TAG_A_RULE = "istagarule";
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java b/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
index 18c96c371591..1ee41ac86c22 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
@@ -21,8 +21,11 @@
 
 import javax.servlet.http.HttpSession;
 
+import org.apache.cloudstack.context.CallContext;
+
 import com.cloud.domain.Domain;
 import com.cloud.exception.CloudAuthenticationException;
+import com.cloud.user.Account;
 import com.cloud.user.UserAccount;
 
 public interface ApiServerService {
@@ -52,4 +55,20 @@ public ResponseObject loginUser(HttpSession session, String username, String pas
     String getDomainId(Map<String, Object[]> params);
 
     boolean isPostRequestsAndTimestampsEnforced();
+
+    AsyncCmdResult processAsyncCmd(BaseAsyncCmd cmdObj, Map<String, String> params, CallContext ctx, Long callerUserId, Account caller) throws Exception;
+
+    class AsyncCmdResult {
+        public final Long objectId;
+        public final String objectUuid;
+        public final BaseAsyncCmd asyncCmd;
+        public final long jobId;
+
+        public AsyncCmdResult(Long objectId, String objectUuid, BaseAsyncCmd asyncCmd, long jobId) {
+            this.objectId = objectId;
+            this.objectUuid = objectUuid;
+            this.asyncCmd = asyncCmd;
+            this.jobId = jobId;
+        }
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java b/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
index 30baa71d6d85..b9b13dcfd884 100644
--- a/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
@@ -20,7 +20,7 @@ public abstract class BaseAsyncCreateCustomIdCmd extends BaseAsyncCreateCmd {
     @Parameter(name = ApiConstants.CUSTOM_ID,
                type = CommandType.STRING,
                description = "An optional field, in case you want to set a custom id to the resource. Allowed to Root Admins only")
-    private String customId;
+    protected String customId;
 
     public String getCustomId() {
         return customId;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java
new file mode 100644
index 000000000000..c98bfb850529
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java
@@ -0,0 +1,100 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.VolumeResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.utils.EnumUtils;
+
+@APICommand(name = "createImageTransfer",
+        description = "Create image transfer for a disk in backup. This API is intended for testing only and is disabled by default.",
+        responseObject = ImageTransferResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class CreateImageTransferCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.BACKUP_ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            description = "ID of the backup")
+    private Long backupId;
+
+    @Parameter(name = ApiConstants.VOLUME_ID,
+            type = CommandType.UUID,
+            entityType = VolumeResponse.class,
+            required = true,
+            description = "ID of the disk/volume")
+    private Long volumeId;
+
+    @Parameter(name = ApiConstants.DIRECTION,
+            type = CommandType.STRING,
+            required = true,
+            description = "Direction of the transfer: upload, download")
+    private String direction;
+
+    @Parameter(name = ApiConstants.FORMAT,
+            type = CommandType.STRING,
+            description = "Format for the image transfer: raw/cow. 'raw' will create an NBD backend. 'cow' will use the File backend." +
+                    "For download, only the 'raw' format is supported. Default: raw")
+    private String format;
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    public Long getVolumeId() {
+        return volumeId;
+    }
+
+    public ImageTransfer.Direction getDirection() {
+        return ImageTransfer.Direction.valueOf(direction);
+    }
+
+    public ImageTransfer.Format getFormat() {
+        return EnumUtils.getEnum(ImageTransfer.Format.class, format);
+    }
+
+   @Override
+    public void execute() {
+        ImageTransferResponse response = kvmBackupExportService.createImageTransfer(this);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java
new file mode 100644
index 000000000000..d0e17e86d427
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java
@@ -0,0 +1,85 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "deleteVirtualMachineCheckpoint",
+        description = "Delete a VM checkpoint. This API is intended for testing only and is disabled by default.",
+        responseObject = SuccessResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class DeleteVmCheckpointCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = "checkpointid",
+            type = CommandType.STRING,
+            required = true,
+            description = "Checkpoint ID")
+    private String checkpointId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public void setVmId(Long vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setCheckpointId(String checkpointId) {
+        this.checkpointId = checkpointId;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = kvmBackupExportService.deleteVmCheckpoint(this);
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        response.setSuccess(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java
new file mode 100644
index 000000000000..45173f8668ee
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java
@@ -0,0 +1,103 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.event.EventTypes;
+
+@APICommand(name = "finalizeBackup",
+        description = "Finalize a VM backup session. This API is intended for testing only and is disabled by default.",
+        responseObject = BackupResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class FinalizeBackupCmd extends BaseAsyncCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    private BackupManager backupManager;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            required = true,
+            description = "ID of the backup")
+    private Long backupId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public void execute() {
+        Backup backup = kvmBackupExportService.finalizeBackup(this);
+
+        if (backup == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create Backup");
+        }
+
+        BackupResponse response = backupManager.createBackupResponse(backup, null);
+
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VM_BACKUP_CREATE;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Finalizing backup " + backupId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java
new file mode 100644
index 000000000000..dfc43e233bf2
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "finalizeImageTransfer",
+        description = "Finalize an image transfer. This API is intended for testing only and is disabled by default.",
+        responseObject = SuccessResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class FinalizeImageTransferCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = ImageTransferResponse.class,
+            required = true,
+            description = "ID of the image transfer")
+    private Long imageTransferId;
+
+    public Long getImageTransferId() {
+        return imageTransferId;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = kvmBackupExportService.finalizeImageTransfer(this);
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        response.setSuccess(result);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java
new file mode 100644
index 000000000000..d810d21ab5f8
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java
@@ -0,0 +1,81 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "listImageTransfers",
+        description = "List image transfers for a backup. This API is intended for testing only and is disabled by default.",
+        responseObject = ImageTransferResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class ListImageTransfersCmd extends BaseListCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = ImageTransferResponse.class,
+            description = "ID of the Image Transfer")
+    private Long id;
+
+    @Parameter(name = ApiConstants.BACKUP_ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            description = "ID of the backup")
+    private Long backupId;
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public void execute() {
+        List<ImageTransferResponse> responses = kvmBackupExportService.listImageTransfers(this);
+        ListResponse<ImageTransferResponse> response = new ListResponse<>();
+        response.setResponses(responses);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java
new file mode 100644
index 000000000000..a61661e982de
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+
+@APICommand(name = "listVirtualMachineCheckpoints",
+        description = "List checkpoints for a VM. This API is intended for testing only and is disabled by default.",
+        responseObject = CheckpointResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class ListVmCheckpointsCmd extends BaseListCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    @Override
+    public void execute() {
+        List<CheckpointResponse> responses = kvmBackupExportService.listVmCheckpoints(this);
+        ListResponse<CheckpointResponse> response = new ListResponse<>();
+        response.setResponses(responses);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return 0;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java
new file mode 100644
index 000000000000..1bf6d45db049
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java
@@ -0,0 +1,120 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCreateCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.event.EventTypes;
+
+@APICommand(name = "startBackup",
+        description = "Start a VM backup session using pull mode backup-begin on the KVM host. This API is intended for testing only and is disabled by default.",
+        responseObject = BackupResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+    public class StartBackupCmd extends BaseAsyncCreateCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    private BackupManager backupManager;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = ApiConstants.NAME,
+            type = CommandType.STRING,
+            description = "the name of the backup")
+    private String name;
+
+    @Parameter(name = ApiConstants.DESCRIPTION,
+            type = CommandType.STRING,
+            description = "the description for the backup")
+    private String description;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    @Override
+    public void execute() {
+        try {
+            Backup backup = kvmBackupExportService.startBackup(this);
+            BackupResponse response = backupManager.createBackupResponse(backup, null);
+
+            response.setResponseName(getCommandName());
+            setResponseObject(response);
+        } catch (Exception e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
+        }
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public void create() {
+        Backup backup = kvmBackupExportService.createBackup(this);
+
+        if (backup != null) {
+            setEntityId(backup.getId());
+            setEntityUuid(backup.getUuid());
+        } else {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create Backup");
+        }
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VM_BACKUP_CREATE;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Starting backup for Instance " + vmId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
index f6f66415f533..055443934609 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
@@ -19,23 +19,23 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.cloudstack.api.ApiErrorCode;
-import org.apache.cloudstack.api.ServerApiException;
-import org.apache.cloudstack.api.response.DomainResponse;
-import org.apache.commons.lang3.StringUtils;
-
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseListCmd;
 import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ImageStoreResponse;
 import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.utils.Pair;
@@ -94,6 +94,13 @@ public class ListCfgsByCmd extends BaseListCmd {
             description = "The ID of the Image Store to update the parameter value for corresponding image store")
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     @Parameter(name = ApiConstants.GROUP, type = CommandType.STRING, description = "Lists configuration by group name (primarily used for UI)", since = "4.18.0")
     private String groupName;
 
@@ -139,6 +146,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     public String getGroupName() {
         return groupName;
     }
@@ -200,6 +211,9 @@ private void setScope(ConfigurationResponse cfgResponse) {
         if (getImageStoreId() != null){
             cfgResponse.setScope("imagestore");
         }
+        if (getManagementServerId() != null){
+            cfgResponse.setScope("managementserver");
+        }
     }
 
     @Override
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
index 2d511cff34db..3c3c36b29d7e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
@@ -23,16 +23,16 @@
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
-import org.apache.cloudstack.api.response.ImageStoreResponse;
-import org.apache.cloudstack.framework.config.ConfigKey;
-
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ImageStoreResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
@@ -84,6 +84,13 @@ public class ResetCfgCmd extends BaseCmd {
             description = "The ID of the Image Store to reset the parameter value for corresponding image store")
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -116,6 +123,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -149,6 +160,9 @@ public void execute() {
             if (getImageStoreId() != null) {
                 response.setScope(ConfigKey.Scope.ImageStore.name());
             }
+            if (getManagementServerId() != null) {
+                response.setScope(ConfigKey.Scope.ManagementServer.name());
+            }
             response.setValue(cfg.second());
             this.setResponseObject(response);
         } else {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
index 97dee8f638af..9db9529dc8d8 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
@@ -16,9 +16,7 @@
 // under the License.
 package org.apache.cloudstack.api.command.admin.config;
 
-import com.cloud.utils.crypt.DBEncryptionUtil;
 import org.apache.cloudstack.acl.RoleService;
-import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiArgValidator;
 import org.apache.cloudstack.api.ApiConstants;
@@ -29,13 +27,17 @@
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ImageStoreResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.user.Account;
+import com.cloud.utils.crypt.DBEncryptionUtil;
 
 @APICommand(name = "updateConfiguration", description = "Updates a configuration.", responseObject = ConfigurationResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
@@ -88,6 +90,13 @@ public class UpdateCfgCmd extends BaseCmd {
             validations = ApiArgValidator.PositiveNumber)
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -112,7 +121,7 @@ public Long getClusterId() {
         return clusterId;
     }
 
-    public Long getStoragepoolId() {
+    public Long getStoragePoolId() {
         return storagePoolId;
     }
 
@@ -128,6 +137,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -182,7 +195,7 @@ public ConfigurationResponse setResponseScopes(ConfigurationResponse response) {
         if (getClusterId() != null) {
             response.setScope("cluster");
         }
-        if (getStoragepoolId() != null) {
+        if (getStoragePoolId() != null) {
             response.setScope("storagepool");
         }
         if (getAccountId() != null) {
@@ -191,6 +204,9 @@ public ConfigurationResponse setResponseScopes(ConfigurationResponse response) {
         if (getDomainId() != null) {
             response.setScope("domain");
         }
+        if (getManagementServerId() != null) {
+            response.setScope(ConfigKey.Scope.ManagementServer.name().toLowerCase());
+        }
         return response;
     }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
index c085abd42c76..69bca7c79e21 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
@@ -49,9 +49,14 @@ public class UpdateHostCmd extends BaseCmd {
     @Parameter(name = ApiConstants.OS_CATEGORY_ID,
                type = CommandType.UUID,
                entityType = GuestOSCategoryResponse.class,
-               description = "The ID of OS category to update the host with")
+               description = "the ID of OS category used to prioritize VMs with matching OS category during the allocation process. " +
+                       "It cannot be used alongside the 'guestosrule' parameter.")
     private Long osCategoryId;
 
+    @Parameter(name = ApiConstants.GUEST_OS_RULE, type = CommandType.STRING, description = "the guest OS rule written in JavaScript to match with the OS of the VM." +
+            "It cannot be used alongside the 'oscategoryid' parameter.")
+    private String guestOsRule;
+
     @Parameter(name = ApiConstants.ALLOCATION_STATE,
                type = CommandType.STRING,
                description = "Change resource state of host, valid values are [Enable, Disable]. Operation may failed if host in states not allowing Enable/Disable")
@@ -96,6 +101,10 @@ public Long getOsCategoryId() {
         return osCategoryId;
     }
 
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
     public String getAllocationState() {
         return allocationState;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/RegisterUserKeysCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/RegisterUserKeysCmd.java
index 11d7c1d2ffab..28c79517f4b9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/RegisterUserKeysCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/RegisterUserKeysCmd.java
@@ -50,7 +50,7 @@ public class RegisterUserKeysCmd extends BaseAsyncCmd {
     @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "API key pair name.")
     private String name;
 
-    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, description = "API key pair description.")
+    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, description = "API key pair description.", length = 1024)
     private String description;
 
     @Parameter(name = ApiConstants.START_DATE, type = CommandType.DATE, description = "Start date of the API key pair. " +
@@ -138,6 +138,9 @@ public List<Map<String, Object>> getRules() {
 
             String description = detail.get(ApiConstants.DESCRIPTION);
             if (StringUtils.isNotEmpty(description)) {
+                if (description.length() > 255) {
+                    throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Rule description cannot be longer than 255 characters.");
+                }
                 ruleDetails.put(ApiConstants.DESCRIPTION, description);
             }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
index e11d20d06466..50ff97ac676f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
@@ -85,6 +85,9 @@ public class AssignVMCmd extends BaseCmd  {
                    "In case no security groups are provided the Instance is part of the default security group.")
     private List<Long> securityGroupIdList;
 
+    // Internal flag to allow assignment without adding a network
+    private boolean  skipNetwork = false;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -113,6 +116,34 @@ public List<Long> getSecurityGroupIdList() {
         return securityGroupIdList;
     }
 
+    public boolean isSkipNetwork() {
+        return skipNetwork;
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////////// Setters /////////////////////////
+    /////////////////////////////////////////////////////
+
+    public void setVirtualMachineId(Long virtualMachineId) {
+        this.virtualMachineId = virtualMachineId;
+    }
+
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    public void setDomainId(Long domainId) {
+        this.domainId = domainId;
+    }
+
+    public void setProjectId(Long projectId) {
+        this.projectId = projectId;
+    }
+
+    public void setSkipNetwork(boolean skipNetwork) {
+        this.skipNetwork = skipNetwork;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
index e64c8b3f46c6..b7c3b2ba41a6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
@@ -41,6 +41,19 @@ public class DeployVMCmdByAdmin extends DeployVMCmd implements AdminCmd {
     @Parameter(name = ApiConstants.CLUSTER_ID, type = CommandType.UUID, entityType = ClusterResponse.class, description = "Destination Cluster ID to deploy the Instance to - parameter available for root admin only", since = "4.13")
     private Long clusterId;
 
+    @Parameter(name = ApiConstants.BLANK_INSTANCE,
+            type = CommandType.BOOLEAN,
+            description = "Whether to create a blank instance without storage and network",
+            since = "4.23.0")
+    private Boolean blankInstance;
+
+    // Internal flag to allow deploying instance with a given type
+    private String instanceType;
+
+    /////////////////////////////////////////////////////
+    ////////////////// Getters //////////////////////////
+    /////////////////////////////////////////////////////
+
     public Long getPodId() {
         return podId;
     }
@@ -48,4 +61,37 @@ public Long getPodId() {
     public Long getClusterId() {
         return clusterId;
     }
+
+    @Override
+    public boolean isBlankInstance() {
+        return Boolean.TRUE.equals(blankInstance);
+    }
+
+    @Override
+    public String getInstanceType() {
+        if (!isBlankInstance()) {
+            return null;
+        }
+        return instanceType;
+    }
+
+    /////////////////////////////////////////////////////
+    ////////////////// Setters //////////////////////////
+    /////////////////////////////////////////////////////
+
+    public void setClusterId(Long clusterId) {
+        this.clusterId = clusterId;
+    }
+
+    public void setBlankInstance(boolean blankInstance) {
+        this.blankInstance = blankInstance;
+    }
+
+    public void setInstanceType(String instanceType) {
+        this.instanceType = instanceType;
+    }
+
+    public void setCustomId(String customId) {
+        this.customId = customId;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
index 93d4b610b900..cbe6494d4004 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
@@ -17,6 +17,8 @@
 package org.apache.cloudstack.api.command.admin.vm;
 
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.api.command.admin.AdminCmd;
 import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
@@ -27,4 +29,20 @@
 @APICommand(name = "destroyVirtualMachine", description = "Destroys  an Instance. Once destroyed, only the administrator can recover it.", responseObject = UserVmResponse.class, responseView = ResponseView.Full, entityType = {VirtualMachine.class},
         requestHasSensitiveInfo = false,
         responseHasSensitiveInfo = true)
-public class DestroyVMCmdByAdmin extends DestroyVMCmd implements AdminCmd {}
+public class DestroyVMCmdByAdmin extends DestroyVMCmd implements AdminCmd {
+
+    @Parameter( name = ApiConstants.FORCED,
+            type = CommandType.BOOLEAN,
+            description = "Force destroy the Instance",
+            since = "4.23.0")
+    Boolean forced;
+
+    @Override
+    public boolean isForced() {
+        return Boolean.TRUE.equals(forced);
+    }
+
+    public void setForced(Boolean forced) {
+        this.forced = forced;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
index 5c5c8776bce3..cd6baaf827bb 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
@@ -193,6 +193,22 @@ public Boolean getGpuEnabled() {
         return gpuEnabled;
     }
 
+    public void setZoneId(Long zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setCpuNumber(Integer cpuNumber) {
+        this.cpuNumber = cpuNumber;
+    }
+
+    public void setMemory(Integer memory) {
+        this.memory = memory;
+    }
+
+    public void setEncryptRoot(Boolean encryptRoot) {
+        this.encryptRoot = encryptRoot;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java
index 6274e7e14963..9d96f104885e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java
@@ -56,6 +56,9 @@ public class AddIpToVmNicCmd extends BaseAsyncCreateCmd {
     @Parameter(name = ApiConstants.IP_ADDRESS, type = CommandType.STRING, required = false, description = "Secondary IP Address")
     private String ipAddr;
 
+    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, required = false, description = "Description of the secondary IP address", length = 2048)
+    private String description;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -160,7 +163,7 @@ public void create() throws ResourceAllocationException {
         }
 
         try {
-            result = _networkService.allocateSecondaryGuestIP(getNicId(), requestedIpPair);
+            result = _networkService.allocateSecondaryGuestIP(getNicId(), requestedIpPair, description);
             if (result != null) {
                 setEntityId(result.getId());
                 setEntityUuid(result.getUuid());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
index 6347c38811e8..f6ef955956f6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
@@ -100,6 +100,26 @@ public String getMacAddress() {
         return NetUtils.standardizeMacAddress(macaddr);
     }
 
+    public void setVmId(Long vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setNetworkId(Long netId) {
+        this.netId = netId;
+    }
+
+    public void setIpaddr(String ipaddr) {
+        this.ipaddr = ipaddr;
+    }
+
+    public void setMacAddress(String macaddr) {
+        this.macaddr = macaddr;
+    }
+
+    public void setDhcpOptions(Map dhcpOptions) {
+        this.dhcpOptions = dhcpOptions;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
index 8c29d7338b85..68b0821ba44d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
@@ -61,10 +61,10 @@
 import com.cloud.network.Network.IpAddresses;
 import com.cloud.offering.DiskOffering;
 import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.utils.net.Dhcp;
 import com.cloud.utils.net.NetUtils;
 import com.cloud.vm.VmDetailConstants;
 import com.cloud.vm.VmDiskInfo;
-import com.cloud.utils.net.Dhcp;
 
 public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd implements SecurityGroupAction, UserCmd {
 
@@ -75,13 +75,13 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     /////////////////////////////////////////////////////
 
     @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class, required = true, description = "availability zone for the virtual machine")
-    private Long zoneId;
+    protected Long zoneId;
 
     @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "host name for the virtual machine", validations = {ApiArgValidator.RFCComplianceDomainName})
-    private String name;
+    protected String name;
 
     @Parameter(name = ApiConstants.DISPLAY_NAME, type = CommandType.STRING, description = "an optional user generated name for the virtual machine")
-    private String displayName;
+    protected String displayName;
 
     @Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, description="The password of the virtual machine. If null, a random password will be generated for the VM.",
             since="4.19.0.0")
@@ -89,21 +89,21 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
 
     //Owner information
     @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, description = "an optional account for the virtual machine. Must be used with domainId.")
-    private String accountName;
+    protected String accountName;
 
     @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "an optional domainId for the virtual machine. If the account parameter is used, domainId must also be used. If account is NOT provided then virtual machine will be assigned to the caller account and domain.")
-    private Long domainId;
+    protected Long domainId;
 
     //Network information
     //@ACL(accessType = AccessType.UseEntry)
     @Parameter(name = ApiConstants.NETWORK_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = NetworkResponse.class, description = "list of network ids used by virtual machine. Can't be specified with ipToNetworkList parameter")
-    private List<Long> networkIds;
+    protected List<Long> networkIds;
 
     @Parameter(name = ApiConstants.BOOT_TYPE, type = CommandType.STRING, required = false, description = "Guest VM Boot option either custom[UEFI] or default boot [BIOS]. Not applicable with VMware if the template is marked as deploy-as-is, as we honour what is defined in the template.", since = "4.14.0.0")
-    private String bootType;
+    protected String bootType;
 
     @Parameter(name = ApiConstants.BOOT_MODE, type = CommandType.STRING, required = false, description = "Boot Mode [Legacy] or [Secure] Applicable when Boot Type Selected is UEFI, otherwise Legacy only for BIOS. Not applicable with VMware if the template is marked as deploy-as-is, as we honour what is defined in the template.", since = "4.14.0.0")
-    private String bootMode;
+    protected String bootMode;
 
     @Parameter(name = ApiConstants.BOOT_INTO_SETUP, type = CommandType.BOOLEAN, required = false, description = "Boot into hardware setup or not (ignored if startVm = false, only valid for vmware)", since = "4.15.0.0")
     private Boolean bootIntoSetup;
@@ -138,7 +138,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
 
     @Parameter(name = ApiConstants.HYPERVISOR, type = CommandType.STRING, description = "the hypervisor on which to deploy the virtual machine. "
             + "The parameter is required and respected only when hypervisor info is not set on the ISO/Template passed to the call")
-    private String hypervisor;
+    protected String hypervisor;
 
     @Parameter(name = ApiConstants.USER_DATA, type = CommandType.STRING,
             description = "an optional binary data that can be sent to the virtual machine upon a successful deployment. " +
@@ -147,10 +147,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
                     "Using HTTP POST (via POST body), you can send up to 1MB of data after base64 encoding. " +
                     "You also need to change vm.userdata.max.length value",
             length = 1048576)
-    private String userData;
+    protected String userData;
 
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.18")
-    private Long userdataId;
+    protected Long userdataId;
 
     @Parameter(name = ApiConstants.USER_DATA_DETAILS, type = CommandType.MAP, description = "used to specify the parameters values for the variables in userdata.", since = "4.18")
     private Map userdataDetails;
@@ -160,7 +160,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private String sshKeyPairName;
 
     @Parameter(name = ApiConstants.SSH_KEYPAIRS, type = CommandType.LIST, collectionType = CommandType.STRING, since="4.17", description = "names of the ssh key pairs used to login to the virtual machine")
-    private List<String> sshKeyPairNames;
+    protected List<String> sshKeyPairNames;
 
     @Parameter(name = ApiConstants.HOST_ID, type = CommandType.UUID, entityType = HostResponse.class, description = "destination Host ID to deploy the VM to - parameter available for root admin only")
     private Long hostId;
@@ -168,7 +168,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     @ACL
     @Parameter(name = ApiConstants.SECURITY_GROUP_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = SecurityGroupResponse.class, description = "comma separated list of security groups id that going to be applied to the virtual machine. "
             + "Should be passed only when vm is created from a zone with Basic Network support." + " Mutually exclusive with securitygroupnames parameter")
-    private List<Long> securityGroupIdList;
+    protected List<Long> securityGroupIdList;
 
     @ACL
     @Parameter(name = ApiConstants.SECURITY_GROUP_NAMES, type = CommandType.LIST, collectionType = CommandType.STRING, entityType = SecurityGroupResponse.class, description = "comma separated list of security groups names that going to be applied to the virtual machine."
@@ -189,10 +189,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private String macAddress;
 
     @Parameter(name = ApiConstants.KEYBOARD, type = CommandType.STRING, description = "an optional keyboard device type for the virtual machine. valid value can be one of de,de-ch,es,es-latam,fi,fr,fr-be,fr-ch,is,it,jp,nl-be,no,pt,uk,us")
-    private String keyboard;
+    protected String keyboard;
 
     @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class, description = "Deploy vm for the project")
-    private Long projectId;
+    protected Long projectId;
 
     @Parameter(name = ApiConstants.START_VM, type = CommandType.BOOLEAN, description = "true if start vm after creating; defaulted to true if not specified")
     private Boolean startVm;
@@ -200,7 +200,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     @ACL
     @Parameter(name = ApiConstants.AFFINITY_GROUP_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = AffinityGroupResponse.class, description = "comma separated list of affinity groups id that are going to be applied to the virtual machine."
             + " Mutually exclusive with affinitygroupnames parameter")
-    private List<Long> affinityGroupIdList;
+    protected List<Long> affinityGroupIdList;
 
     @ACL
     @Parameter(name = ApiConstants.AFFINITY_GROUP_NAMES, type = CommandType.LIST, collectionType = CommandType.STRING, entityType = AffinityGroupResponse.class, description = "comma separated list of affinity groups names that are going to be applied to the virtual machine."
@@ -208,10 +208,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private List<String> affinityGroupNameList;
 
     @Parameter(name = ApiConstants.DISPLAY_VM, type = CommandType.BOOLEAN, since = "4.2", description = "an optional field, whether to the display the vm to the end user or not.", authorized = {RoleType.Admin})
-    private Boolean displayVm;
+    protected Boolean displayVm;
 
     @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, since = "4.3", description = "used to specify the custom parameters. 'extraconfig' is not allowed to be passed in details")
-    private Map details;
+    protected Map details;
 
     @Parameter(name = ApiConstants.DEPLOYMENT_PLANNER, type = CommandType.STRING, description = "Deployment planner to use for vm allocation. Available to ROOT admin only", since = "4.4", authorized = { RoleType.Admin })
     private String deploymentPlanner;
@@ -225,7 +225,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private Map dataDiskTemplateToDiskOfferingList;
 
     @Parameter(name = ApiConstants.EXTRA_CONFIG, type = CommandType.STRING, since = "4.12", description = "an optional URL encoded string that can be passed to the virtual machine upon successful deployment", length = 5120)
-    private String extraConfig;
+    protected String extraConfig;
 
     @Parameter(name = ApiConstants.COPY_IMAGE_TAGS, type = CommandType.BOOLEAN, since = "4.13", description = "if true the image tags (if any) will be copied to the VM, default value is false")
     private Boolean copyImageTags;
@@ -798,6 +798,11 @@ public IoDriverPolicy getIoDriverPolicy() {
         }
         return null;
     }
+
+    public String getInstanceType() {
+        return null;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
index 050592b97a3b..0a943fab118d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
@@ -16,10 +16,11 @@
 // under the License.
 package org.apache.cloudstack.api.command.user.vm;
 
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.stream.Stream;
 
-import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
@@ -40,6 +41,7 @@
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.VirtualMachine;
 
 @APICommand(name = "deployVirtualMachine", description = "Creates and automatically starts an Instance based on a service offering, disk offering, and Template.", responseObject = UserVmResponse.class, responseView = ResponseView.Restricted, entityType = {VirtualMachine.class},
@@ -88,6 +90,111 @@ public boolean isVolumeOrSnapshotProvided() {
         return volumeId != null || snapshotId != null;
     }
 
+    public boolean isBlankInstance() {
+        return false;
+    }
+
+
+
+    /////////////////////////////////////////////////////
+    ////////////////// Setters //////////////////////////
+    /////////////////////////////////////////////////////
+    public void setZoneId(Long zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    public void setDomainId(Long domainId) {
+        this.domainId = domainId;
+    }
+
+    public void setNetworkIds(List<Long> networkIds) {
+        this.networkIds = networkIds;
+    }
+
+    public void setBootType(String bootType) {
+        this.bootType = bootType;
+    }
+
+    public void setBootMode(String bootMode) {
+        this.bootMode = bootMode;
+    }
+
+    public void setHypervisor(String hypervisor) {
+        this.hypervisor = hypervisor;
+    }
+
+    public void setUserData(String userData) {
+        this.userData = userData;
+    }
+
+    public void setKeyboard(String keyboard) {
+        this.keyboard = keyboard;
+    }
+
+    public void setProjectId(Long projectId) {
+        this.projectId = projectId;
+    }
+
+    public void setDisplayVm(Boolean displayVm) {
+        this.displayVm = displayVm;
+    }
+
+    public void setUserDataId(Long userDataId) {
+        this.userdataId = userDataId;
+    }
+
+    public void setAffinityGroupIds(List<Long> ids) {
+        this.affinityGroupIdList = ids;
+    }
+
+    public void setDetails(Map details) {
+        this.details = details;
+    }
+
+    public void setExtraConfig(String extraConfig) {
+        this.extraConfig = extraConfig;
+    }
+
+    public void setDynamicScalingEnabled(Boolean dynamicScalingEnabled) {
+        this.dynamicScalingEnabled = dynamicScalingEnabled;
+    }
+
+    public void setServiceOfferingId(Long serviceOfferingId) {
+        this.serviceOfferingId = serviceOfferingId;
+    }
+
+    public void setTemplateId(Long templateId) {
+        this.templateId = templateId;
+    }
+
+    public void setVolumeId(Long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    public void setSnapshotId(Long snapshotId) {
+        this.snapshotId = snapshotId;
+    }
+
+    public void setSshKeyPairNames(List<String> sshKeyPairNames) {
+        this.sshKeyPairNames = sshKeyPairNames;
+    }
+
+    public void setSecurityGroupList(List<Long> securityGroupIdList) {
+        this.securityGroupIdList = securityGroupIdList;
+    }
+
     @Override
     public void execute() {
         UserVm result;
@@ -132,7 +239,7 @@ public void execute() {
 
     @Override
     public void create() throws ResourceAllocationException {
-        if (Stream.of(templateId, snapshotId, volumeId).filter(Objects::nonNull).count() != 1) {
+        if (!isBlankInstance() && Stream.of(templateId, snapshotId, volumeId).filter(Objects::nonNull).count() != 1) {
             throw new CloudRuntimeException("Please provide only one of the following parameters - template ID, volume ID or snapshot ID");
         }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
index 9e2f2bcb72ce..aec0688f1779 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
@@ -90,6 +90,10 @@ public List<Long> getVolumeIds() {
         return volumeIds;
     }
 
+    public boolean isForced() {
+        return false;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
index e3ad0502f454..a5f06e6ecbb3 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
@@ -288,6 +288,14 @@ public boolean isCleanupExtraConfig() {
         return Boolean.TRUE.equals(cleanupExtraConfig);
     }
 
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public void setSecurityGroupIdList(List<Long> securityGroupIdList) {
+        this.securityGroupIdList = securityGroupIdList;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
index f39853512281..f50abaf73c96 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
@@ -70,6 +70,21 @@ public Long getProjectid() {
         return projectid;
     }
 
+    /////////////////////////////////////////////////////
+    /////////////////// Setter///////////////////////////
+    /////////////////////////////////////////////////////
+    public void setVolumeId(Long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    public void setAccountId(Long accountId) {
+        this.accountId = accountId;
+    }
+
+    public void setProjectId(Long projectid) {
+        this.projectid = projectid;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
index 78de05648486..ec7a626fa156 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
@@ -114,7 +114,8 @@ public class CreateVolumeCmd extends BaseAsyncCreateCustomIdCmd implements UserC
             type = CommandType.UUID,
             entityType = StoragePoolResponse.class,
             description = "Storage pool ID to create the volume in. Cannot be used with the snapshotid parameter.",
-            authorized = {RoleType.Admin})
+            authorized = {RoleType.Admin},
+            since = "4.22.1")
     private Long storageId;
 
     /////////////////////////////////////////////////////
@@ -150,6 +151,10 @@ public Long getMaxIops() {
     }
 
     public Long getSnapshotId() {
+        if (storageId != null && snapshotId != null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Snapshot ID cannot be specified with the Storage ID.");
+        }
         return snapshotId;
     }
 
@@ -163,7 +168,8 @@ private Long getProjectId() {
 
     public Long getStorageId() {
         if (snapshotId != null && storageId != null) {
-            throw new IllegalArgumentException("StorageId parameter cannot be specified with the SnapshotId parameter.");
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Storage ID cannot be specified with the Snapshot ID.");
         }
         return storageId;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
index 66a558abf982..f6e811da6055 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
@@ -77,6 +77,10 @@ public Long getVirtualMachineId() {
         return virtualMachineId;
     }
 
+    public void setId(Long id) {
+        this.id = id;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
index b855bfe40b8d..51fcaa9836e9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
@@ -127,6 +127,18 @@ public class BackupResponse extends BaseResponse {
     @Param(description = "Indicates whether the VM from which the backup was taken is expunged or not", since = "4.22.0")
     private Boolean isVmExpunged;
 
+    @SerializedName(ApiConstants.FROM_CHECKPOINT_ID)
+    @Param(description = "Previous active checkpoint ID for incremental backups", since = "4.23.0")
+    private String fromCheckpointId;
+
+    @SerializedName(ApiConstants.TO_CHECKPOINT_ID)
+    @Param(description = "Next checkpoint ID for incremental backups", since = "4.23.0")
+    private String toCheckpointId;
+
+    @SerializedName(ApiConstants.HOST_ID)
+    @Param(description = "Host ID where the backup is running", since = "4.23.0")
+    private String hostId;
+
     public String getId() {
         return id;
     }
@@ -314,4 +326,28 @@ public void setVmOfferingRemoved(Boolean vmOfferingRemoved) {
     public void setVmExpunged(Boolean isVmExpunged) {
         this.isVmExpunged = isVmExpunged;
     }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    public String getFromCheckpointId() {
+        return this.fromCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    public String getToCheckpointId() {
+        return this.toCheckpointId;
+    }
+
+    public void setHostId(String hostId) {
+        this.hostId = hostId;
+    }
+
+    public String getHostId() {
+        return this.hostId;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java
new file mode 100644
index 000000000000..2bec7711064f
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java
@@ -0,0 +1,53 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+public class CheckpointResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the checkpoint ID")
+    private String id;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the checkpoint creation time")
+    private Date created;
+
+    @SerializedName(ApiConstants.IS_ACTIVE)
+    @Param(description = "whether this is the active checkpoint")
+    private Boolean isActive;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setIsActive(Boolean isActive) {
+        this.isActive = isActive;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
index 5d085d1bee05..f8e1af8d5b76 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
@@ -63,6 +63,10 @@ public class HostResponse extends BaseResponseWithAnnotations {
     @Param(description = "The OS category name of the host")
     private String osCategoryName;
 
+    @SerializedName(ApiConstants.GUEST_OS_RULE)
+    @Param(description = "the guest OS rule")
+    private String guestOsRule;
+
     @SerializedName(ApiConstants.IP_ADDRESS)
     @Param(description = "The IP address of the host")
     private String ipAddress;
@@ -999,4 +1003,12 @@ public void setExtensionName(String extensionName) {
     public String getExtensionName() {
         return extensionName;
     }
+
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
+    public void setGuestOsRule(String guestOsRule) {
+        this.guestOsRule = guestOsRule;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java
new file mode 100644
index 000000000000..15576e8f1012
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java
@@ -0,0 +1,104 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.backup.ImageTransfer;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+@EntityReference(value = ImageTransfer.class)
+public class ImageTransferResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the ID of the image transfer")
+    private String id;
+
+    @SerializedName("backupid")
+    @Param(description = "the backup ID")
+    private String backupId;
+
+    @SerializedName("vmid")
+    @Param(description = "the VM ID")
+    private String vmId;
+
+    @SerializedName(ApiConstants.VOLUME_ID)
+    @Param(description = "the disk/volume ID")
+    private String diskId;
+
+    @SerializedName("devicename")
+    @Param(description = "the device name (vda, vdb, etc)")
+    private String deviceName;
+
+    @SerializedName("transferurl")
+    @Param(description = "the transfer URL")
+    private String transferUrl;
+
+    @SerializedName("phase")
+    @Param(description = "the transfer phase")
+    private String phase;
+
+    @SerializedName("direction")
+    @Param(description = "the image transfer direction: upload / download")
+    private String direction;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the date created")
+    private Date created;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setBackupId(String backupId) {
+        this.backupId = backupId;
+    }
+
+    public void setVmId(String vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setDiskId(String diskId) {
+        this.diskId = diskId;
+    }
+
+    public void setDeviceName(String deviceName) {
+        this.deviceName = deviceName;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public void setDirection(String direction) {
+        this.direction = direction;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/NicSecondaryIpResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/NicSecondaryIpResponse.java
index eba00da25cfe..8734e65dfa58 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/NicSecondaryIpResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/NicSecondaryIpResponse.java
@@ -53,6 +53,10 @@ public class NicSecondaryIpResponse extends BaseResponse {
     @Param(description = "The ID of the Instance")
     private String vmId;
 
+    @SerializedName(ApiConstants.DESCRIPTION)
+    @Param(description = "Description of the secondary IP address")
+    private String description;
+
     @Override
     public String getObjectId() {
         return this.getId();
@@ -98,6 +102,14 @@ public void setId(String id) {
         this.id = id;
     }
 
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
     public List<NicSecondaryIpResponse> getSecondaryIpsList() {
         return secondaryIpsList;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/backup/Backup.java b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
index 951af9180e7f..2d68f18b953f 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/Backup.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
@@ -30,8 +30,16 @@
 
 public interface Backup extends ControlledEntity, InternalIdentity, Identity {
 
+    String getFromCheckpointId();
+
+    String getToCheckpointId();
+
+    Long getCheckpointCreateTime();
+
+    Long getHostId();
+
     enum Status {
-        Allocated, Queued, BackingUp, BackedUp, Error, Failed, Restoring, Removed, Expunged
+        Allocated, Queued, BackingUp, ReadyForImageTransfer, FinalizingImageTransfer, BackedUp, Error, Failed, Restoring, Removed, Expunged
     }
 
     class Metric {
diff --git a/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java b/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java
new file mode 100644
index 000000000000..e1153be3ae02
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import org.apache.cloudstack.acl.ControlledEntity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface ImageTransfer extends ControlledEntity, InternalIdentity {
+    long getDataCenterId();
+
+    public enum Direction {
+        upload, download
+    }
+
+    public enum Format {
+        raw,
+        cow
+    }
+
+    public enum Backend {
+        nbd,
+        file
+    }
+
+    public enum Phase {
+        initializing, transferring, finished, failed
+    }
+
+    String getUuid();
+
+    Long getBackupId();
+
+    long getVolumeId();
+
+    long getHostId();
+
+    String getTransferUrl();
+
+    Phase getPhase();
+
+    Direction getDirection();
+
+    Backend getBackend();
+
+    String getSignedTicketId();
+}
diff --git a/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java b/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java
new file mode 100644
index 000000000000..e1affb311ec6
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java
@@ -0,0 +1,106 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.List;
+
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+
+import com.cloud.utils.component.PluggableService;
+
+/**
+ * Service for Creating Backups and ImageTransfer sessions which will be consumed by an external orchestrator.
+ */
+public interface KVMBackupExportService extends Configurable, PluggableService {
+
+    ConfigKey<Integer> ImageTransferIdleTimeoutSeconds = new ConfigKey<>("Advanced", Integer.class,
+            "image.transfer.idle.timeout.seconds",
+            "600",
+            "Seconds since last completed HTTP request to an image transfer before the image server unregisters it (idle timeout).",
+            true, ConfigKey.Scope.Zone);
+
+    ConfigKey<Boolean> ExposeKVMBackupExportServiceApis = new ConfigKey<>("Advanced", Boolean.class,
+            "expose.kvm.backup.export.service.apis",
+            "false",
+            "Enable to expose APIs for testing the KVM Backup Export Service.",
+            false, ConfigKey.Scope.Global);
+    /**
+     * Creates a backup session for a VM
+     */
+    Backup createBackup(StartBackupCmd cmd);
+
+    /**
+     * Start a backup session for a VM
+     * Creates a new checkpoint and starts NBD server for pull-mode backup
+     */
+    Backup startBackup(StartBackupCmd cmd);
+
+    /**
+     * Finalize a backup session
+     * Stops NBD server, updates checkpoint tracking, deletes old checkpoints
+     */
+    Backup finalizeBackup(FinalizeBackupCmd cmd);
+
+    /**
+     * Create an image transfer object for a disk
+     * Registers NBD endpoint with ImageIO (stubbed for POC)
+     */
+    ImageTransferResponse createImageTransfer(CreateImageTransferCmd cmd);
+
+    ImageTransfer createImageTransfer(long volumeId, Long backupId, ImageTransfer.Direction direction, ImageTransfer.Format format);
+
+    boolean cancelImageTransfer(long imageTransferId);
+
+    /**
+     * Finalize an image transfer
+     * Marks transfer as complete (NBD is closed globally in finalize backup)
+     */
+    boolean finalizeImageTransfer(FinalizeImageTransferCmd cmd);
+
+    boolean finalizeImageTransfer(long imageTransferId);
+
+    /**
+     * List image transfers for a backup
+     */
+    List<ImageTransferResponse> listImageTransfers(ListImageTransfersCmd cmd);
+
+    /**
+     * List checkpoints for a VM
+     */
+    List<CheckpointResponse> listVmCheckpoints(ListVmCheckpointsCmd cmd);
+
+    /**
+     * Delete a VM checkpoint (no-op for normal flow, kept for API parity)
+     */
+    boolean deleteVmCheckpoint(DeleteVmCheckpointCmd cmd);
+
+    /**
+     * List Compatible Data Center Ids for the service
+     */
+    List<Long> listCompatibleDataCenterIds();
+}
diff --git a/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java b/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
index 21184de27a26..3e349cf0bd39 100644
--- a/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
+++ b/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
@@ -23,6 +23,10 @@
 import org.apache.cloudstack.api.command.user.storage.sharedfs.ChangeSharedFSServiceOfferingCmd;
 import org.apache.cloudstack.api.command.user.storage.sharedfs.CreateSharedFSCmd;
 import org.apache.cloudstack.api.command.user.storage.sharedfs.DestroySharedFSCmd;
+import org.apache.cloudstack.api.command.user.storage.sharedfs.ListSharedFSCmd;
+import org.apache.cloudstack.api.command.user.storage.sharedfs.UpdateSharedFSCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.SharedFSResponse;
 
 import com.cloud.exception.InsufficientCapacityException;
 import com.cloud.exception.ManagementServerException;
@@ -31,11 +35,6 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.exception.VirtualMachineMigrationException;
 
-import org.apache.cloudstack.api.command.user.storage.sharedfs.ListSharedFSCmd;
-import org.apache.cloudstack.api.command.user.storage.sharedfs.UpdateSharedFSCmd;
-import org.apache.cloudstack.api.response.SharedFSResponse;
-import org.apache.cloudstack.api.response.ListResponse;
-
 public interface SharedFSService {
 
     List<SharedFSProvider> getSharedFSProviders();
@@ -69,4 +68,10 @@ public interface SharedFSService {
     SharedFS recoverSharedFS(Long sharedFSId);
 
     void deleteSharedFS(Long sharedFSId);
+
+    SharedFS getSharedFSByUuid(String uuid);
+
+    SharedFS getSharedFSForVmId(long vmId);
+
+    SharedFS updateSharedFSPostRestore(long sharedFsId, long volumeId);
 }
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java
new file mode 100644
index 000000000000..27bc4614e1b5
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.admin.vm;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+
+public class AssignVMCmdTest {
+
+    @Test
+    public void test_setSkipNetwork_default() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        Object value = ReflectionTestUtils.getField(assignVMCmd, "skipNetwork");
+        Assert.assertTrue(value instanceof Boolean);
+        Assert.assertFalse((Boolean) value);
+    }
+
+    @Test
+    public void test_setSkipNetwork_set() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        assignVMCmd.setSkipNetwork(true);
+        Object value = ReflectionTestUtils.getField(assignVMCmd, "skipNetwork");
+        Assert.assertTrue(value instanceof Boolean);
+        Assert.assertTrue((Boolean) value);
+    }
+
+    @Test
+    public void test_isSkipNetwork_default() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        Assert.assertFalse(assignVMCmd.isSkipNetwork());
+    }
+
+    @Test
+    public void test_isSkipNetwork_set() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        ReflectionTestUtils.setField(assignVMCmd, "skipNetwork", true);
+        Assert.assertTrue(assignVMCmd.isSkipNetwork());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java
new file mode 100644
index 000000000000..d82dc9f766f9
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.admin.vm;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+@RunWith(MockitoJUnitRunner.class)
+public class DeployVMCmdByAdminTest {
+
+    @InjectMocks
+    private DeployVMCmdByAdmin cmd;
+
+    @Test
+    public void testIsBlankInstance_default() {
+        assertFalse(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testIsBlankInstance_true() {
+        ReflectionTestUtils.setField(cmd, "blankInstance", true);
+        assertTrue(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testIsBlankInstance_false() {
+        ReflectionTestUtils.setField(cmd, "blankInstance", false);
+        assertFalse(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testSetBlankInstance_default() {
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNull(obj);
+    }
+
+    @Test
+    public void testSetBlankInstance_true() {
+        cmd.setBlankInstance(true);
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNotNull(obj);
+        assertTrue((boolean)obj);
+    }
+
+    @Test
+    public void testSetBlankInstance_false() {
+        cmd.setBlankInstance(false);
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNotNull(obj);
+        assertFalse((boolean)obj);
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/test/AddIpToVmNicTest.java b/api/src/test/java/org/apache/cloudstack/api/command/test/AddIpToVmNicTest.java
index 9ea3a6446e8e..71c6d54c7a8c 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/test/AddIpToVmNicTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/test/AddIpToVmNicTest.java
@@ -59,7 +59,7 @@ public void testCreateSuccess() throws ResourceAllocationException, ResourceUnav
         NicSecondaryIp secIp = Mockito.mock(NicSecondaryIp.class);
 
         Mockito.when(
-            networkService.allocateSecondaryGuestIP(ArgumentMatchers.anyLong(), ArgumentMatchers.any()))
+            networkService.allocateSecondaryGuestIP(ArgumentMatchers.anyLong(), ArgumentMatchers.any(), ArgumentMatchers.anyString()))
             .thenReturn(secIp);
 
         ipTonicCmd._networkService = networkService;
@@ -79,7 +79,7 @@ public void testCreateFailure() throws ResourceAllocationException, ResourceUnav
         AddIpToVmNicCmd ipTonicCmd = Mockito.mock(AddIpToVmNicCmd.class);
 
         Mockito.when(
-            networkService.allocateSecondaryGuestIP(ArgumentMatchers.anyLong(), ArgumentMatchers.any()))
+            networkService.allocateSecondaryGuestIP(ArgumentMatchers.anyLong(), ArgumentMatchers.any(), ArgumentMatchers.anyString()))
             .thenReturn(null);
 
         ipTonicCmd._networkService = networkService;
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
index f7e3e38d9c3f..09d396e40237 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.api.command.user.vm;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThrows;
@@ -41,6 +42,7 @@
 import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
 import com.cloud.network.NetworkService;
 import com.cloud.utils.db.EntityManager;
 import com.cloud.vm.VmDetailConstants;
@@ -480,4 +482,146 @@ public void testGetDataDiskTemplateToDiskOfferingMapInvalidTemplateId() {
         });
         assertTrue(thrownException.getMessage().contains("Unable to translate and find entity with datadisktemplateid"));
     }
+
+    @Test
+    public void testSetServiceOfferingId() {
+        cmd.setServiceOfferingId(101L);
+        assertEquals(Long.valueOf(101L), cmd.getServiceOfferingId());
+    }
+
+    @Test
+    public void testSetTemplateId() {
+        cmd.setTemplateId(102L);
+        assertEquals(Long.valueOf(102L), cmd.getTemplateId());
+    }
+
+    @Test
+    public void testSetVolumeId() {
+        cmd.setVolumeId(103L);
+        assertEquals(Long.valueOf(103L), cmd.getVolumeId());
+    }
+
+    @Test
+    public void testSetSnapshotId() {
+        cmd.setSnapshotId(104L);
+        assertEquals(Long.valueOf(104L), cmd.getSnapshotId());
+    }
+
+    @Test
+    public void testSetZoneId() {
+        cmd.setZoneId(105L);
+        assertEquals(Long.valueOf(105L), cmd.getZoneId());
+    }
+
+    @Test
+    public void testSetName() {
+        cmd.setName("vm-name");
+        assertEquals("vm-name", cmd.getName());
+    }
+
+    @Test
+    public void testSetDisplayName() {
+        cmd.setDisplayName("vm-display-name");
+        assertEquals("vm-display-name", cmd.getDisplayName());
+    }
+
+    @Test
+    public void testSetAccountName() {
+        cmd.setAccountName("account-name");
+        assertEquals("account-name", cmd.getAccountName());
+    }
+
+    @Test
+    public void testSetDomainId() {
+        cmd.setDomainId(106L);
+        assertEquals(Long.valueOf(106L), cmd.getDomainId());
+    }
+
+    @Test
+    public void testSetNetworkIds() {
+        List<Long> networkIds = Arrays.asList(11L, 12L);
+        cmd.setNetworkIds(networkIds);
+        assertEquals(networkIds, cmd.getNetworkIds());
+    }
+
+    @Test
+    public void testSetBootType() {
+        cmd.setBootType("UEFI");
+        assertEquals(BootType.UEFI, cmd.getBootType());
+    }
+
+    @Test
+    public void testSetBootMode() {
+        cmd.setBootType("UEFI");
+        cmd.setBootMode("SECURE");
+        assertEquals(BootMode.SECURE, cmd.getBootMode());
+    }
+
+    @Test
+    public void testSetHypervisor() {
+        cmd.setHypervisor("KVM");
+        assertEquals(HypervisorType.KVM, cmd.getHypervisor());
+    }
+
+    @Test
+    public void testSetUserData() {
+        cmd.setUserData("dXNlci1kYXRh");
+        assertEquals("dXNlci1kYXRh", cmd.getUserData());
+    }
+
+    @Test
+    public void testSetKeyboard() {
+        cmd.setKeyboard("us");
+        assertEquals("us", cmd.getKeyboard());
+    }
+
+    @Test
+    public void testSetProjectId() {
+        cmd.setProjectId(107L);
+        assertEquals(Long.valueOf(107L), ReflectionTestUtils.getField(cmd, "projectId"));
+    }
+
+    @Test
+    public void testSetDisplayVm() {
+        cmd.setDisplayVm(Boolean.FALSE);
+        assertEquals(Boolean.FALSE, cmd.isDisplayVm());
+    }
+
+    @Test
+    public void testSetUserDataId() {
+        cmd.setUserDataId(108L);
+        assertEquals(Long.valueOf(108L), cmd.getUserdataId());
+    }
+
+    @Test
+    public void testSetAffinityGroupIds() {
+        List<Long> affinityGroupIds = Arrays.asList(21L, 22L);
+        cmd.setAffinityGroupIds(affinityGroupIds);
+        assertEquals(affinityGroupIds, cmd.getAffinityGroupIdList());
+    }
+
+    @Test
+    public void testSetDetails() {
+        Map<String, String> details = new HashMap<>();
+        details.put("key", "value");
+        cmd.setDetails(details);
+        assertEquals(details, ReflectionTestUtils.getField(cmd, "details"));
+    }
+
+    @Test
+    public void testSetExtraConfig() {
+        cmd.setExtraConfig("cpu-mode=host-passthrough");
+        assertEquals("cpu-mode=host-passthrough", cmd.getExtraConfig());
+    }
+
+    @Test
+    public void testSetDynamicScalingEnabled() {
+        cmd.setDynamicScalingEnabled(Boolean.FALSE);
+        assertFalse(cmd.isDynamicScalingEnabled());
+    }
+
+    @Test
+    public void testIsBlankInstance() {
+        assertFalse(cmd.isBlankInstance());
+    }
 }
diff --git a/client/pom.xml b/client/pom.xml
index ba16cc5d34a2..7d37225dbbb3 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -612,6 +612,11 @@
             <artifactId>cloud-plugin-backup-nas</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-plugin-integrations-veeam-control-service</artifactId>
+            <version>${project.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-plugin-integrations-kubernetes-service</artifactId>
diff --git a/core/src/main/java/com/cloud/agent/api/MigrateCommand.java b/core/src/main/java/com/cloud/agent/api/MigrateCommand.java
index 5ac4e9ae445e..7196247ffc23 100644
--- a/core/src/main/java/com/cloud/agent/api/MigrateCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/MigrateCommand.java
@@ -26,6 +26,7 @@
 
 import com.cloud.agent.api.to.DpdkTO;
 import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.storage.Storage;
 
 public class MigrateCommand extends Command {
     private String vmName;
@@ -42,6 +43,7 @@ public class MigrateCommand extends Command {
     private Map<String, DpdkTO> dpdkInterfaceMapping = new HashMap<>();
 
     private int newVmCpuShares;
+    private boolean clvmCrossPoolMigration;
 
     Map<String, Boolean> vlanToPersistenceMap = new HashMap<>();
 
@@ -149,6 +151,14 @@ public void setNewVmCpuShares(int newVmCpuShares) {
         this.newVmCpuShares = newVmCpuShares;
     }
 
+    public boolean isClvmCrossPoolMigration() {
+        return clvmCrossPoolMigration;
+    }
+
+    public void setClvmCrossPoolMigration(boolean clvmCrossPoolMigration) {
+        this.clvmCrossPoolMigration = clvmCrossPoolMigration;
+    }
+
     public static class MigrateDiskInfo {
         public enum DiskType {
             FILE, BLOCK;
@@ -184,6 +194,8 @@ public String toString() {
         private final String sourceText;
         private final String backingStoreText;
         private boolean isSourceDiskOnStorageFileSystem;
+        private Storage.StoragePoolType sourcePoolType;
+        private Storage.StoragePoolType destPoolType;
 
         public MigrateDiskInfo(final String serialNumber, final DiskType diskType, final DriverType driverType, final Source source, final String sourceText) {
             this.serialNumber = serialNumber;
@@ -232,6 +244,22 @@ public boolean isSourceDiskOnStorageFileSystem() {
         public void setSourceDiskOnStorageFileSystem(boolean isDiskOnFileSystemStorage) {
             this.isSourceDiskOnStorageFileSystem = isDiskOnFileSystemStorage;
         }
+
+        public Storage.StoragePoolType getSourcePoolType() {
+            return sourcePoolType;
+        }
+
+        public void setSourcePoolType(Storage.StoragePoolType sourcePoolType) {
+            this.sourcePoolType = sourcePoolType;
+        }
+
+        public Storage.StoragePoolType getDestPoolType() {
+            return destPoolType;
+        }
+
+        public void setDestPoolType(Storage.StoragePoolType destPoolType) {
+            this.destPoolType = destPoolType;
+        }
     }
 
     @Override
diff --git a/core/src/main/java/com/cloud/agent/api/PostMigrationAnswer.java b/core/src/main/java/com/cloud/agent/api/PostMigrationAnswer.java
new file mode 100644
index 000000000000..24fdf8402029
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/PostMigrationAnswer.java
@@ -0,0 +1,42 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+/**
+ * Answer for PostMigrationCommand.
+ * Indicates success or failure of post-migration operations on the destination host.
+ */
+public class PostMigrationAnswer extends Answer {
+
+    protected PostMigrationAnswer() {
+    }
+
+    public PostMigrationAnswer(PostMigrationCommand cmd, String detail) {
+        super(cmd, false, detail);
+    }
+
+    public PostMigrationAnswer(PostMigrationCommand cmd, Exception ex) {
+        super(cmd, ex);
+    }
+
+    public PostMigrationAnswer(PostMigrationCommand cmd) {
+        super(cmd, true, null);
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/PostMigrationCommand.java b/core/src/main/java/com/cloud/agent/api/PostMigrationCommand.java
new file mode 100644
index 000000000000..938000c3593c
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/PostMigrationCommand.java
@@ -0,0 +1,59 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.VirtualMachineTO;
+
+/**
+ * PostMigrationCommand is sent to the destination host after a successful VM migration.
+ * It performs post-migration tasks such as:
+ * - Claiming exclusive locks on CLVM volumes (converting from shared to exclusive mode)
+ * - Other post-migration cleanup operations
+ */
+public class PostMigrationCommand extends Command {
+    private VirtualMachineTO vm;
+    private String vmName;
+
+    protected PostMigrationCommand() {
+    }
+
+    public PostMigrationCommand(VirtualMachineTO vm, String vmName) {
+        this.vm = vm;
+        this.vmName = vmName;
+    }
+
+    public VirtualMachineTO getVirtualMachine() {
+        return vm;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    @Override
+    public boolean isBypassHostMaintenance() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/PreMigrationCommand.java b/core/src/main/java/com/cloud/agent/api/PreMigrationCommand.java
new file mode 100644
index 000000000000..3ff30391eaef
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/PreMigrationCommand.java
@@ -0,0 +1,61 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.VirtualMachineTO;
+
+/**
+ * PreMigrationCommand is sent to the source host before VM migration starts.
+ * It performs pre-migration tasks such as:
+ * - Converting CLVM volume exclusive locks to shared mode so destination host can access them
+ * - Other pre-migration preparation operations on the source host
+ *
+ * This command runs on the SOURCE host before PrepareForMigrationCommand runs on the DESTINATION host.
+ */
+public class PreMigrationCommand extends Command {
+    private VirtualMachineTO vm;
+    private String vmName;
+
+    protected PreMigrationCommand() {
+    }
+
+    public PreMigrationCommand(VirtualMachineTO vm, String vmName) {
+        this.vm = vm;
+        this.vmName = vmName;
+    }
+
+    public VirtualMachineTO getVirtualMachine() {
+        return vm;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    @Override
+    public boolean isBypassHostMaintenance() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java
new file mode 100644
index 000000000000..34cf6d4ca34c
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java
@@ -0,0 +1,56 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class CreateImageTransferAnswer extends Answer {
+    private String imageTransferId;
+    private String transferUrl;
+
+    public CreateImageTransferAnswer() {
+    }
+
+    public CreateImageTransferAnswer(CreateImageTransferCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public CreateImageTransferAnswer(CreateImageTransferCommand cmd, boolean success, String details,
+                                    String imageTransferId, String transferUrl) {
+        super(cmd, success, details);
+        this.imageTransferId = imageTransferId;
+        this.transferUrl = transferUrl;
+    }
+
+    public String getImageTransferId() {
+        return imageTransferId;
+    }
+
+    public void setImageTransferId(String imageTransferId) {
+        this.imageTransferId = imageTransferId;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java
new file mode 100644
index 000000000000..95b56c9a9c38
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java
@@ -0,0 +1,94 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class CreateImageTransferCommand extends Command {
+    private String transferId;
+    private String exportName;
+    private String socket;
+    private String direction;
+    private String checkpointId;
+    private String file;
+    private ImageTransfer.Backend backend;
+    private int idleTimeoutSeconds;
+
+    public CreateImageTransferCommand() {
+    }
+
+    private CreateImageTransferCommand(String transferId, String direction, String socket, int idleTimeoutSeconds) {
+        this.transferId = transferId;
+        this.direction = direction;
+        this.socket = socket;
+        this.idleTimeoutSeconds = idleTimeoutSeconds;
+    }
+
+    public CreateImageTransferCommand(String transferId, String direction, String exportName, String socket, String checkpointId, int idleTimeoutSeconds) {
+        this(transferId, direction, socket, idleTimeoutSeconds);
+        this.backend = ImageTransfer.Backend.nbd;
+        this.exportName = exportName;
+        this.checkpointId = checkpointId;
+    }
+
+    public CreateImageTransferCommand(String transferId, String direction, String socket, String file, int idleTimeoutSeconds) {
+        this(transferId, direction, socket, idleTimeoutSeconds);
+        if (direction == ImageTransfer.Direction.download.toString()) {
+            throw new IllegalArgumentException("File backend is only supported for upload");
+        }
+        this.backend = ImageTransfer.Backend.file;
+        this.file = file;
+    }
+
+    public String getExportName() {
+        return exportName;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public String getFile() {
+        return file;
+    }
+
+    public ImageTransfer.Backend getBackend() {
+        return backend;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public int getIdleTimeoutSeconds() {
+        return idleTimeoutSeconds;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java b/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java
new file mode 100644
index 000000000000..81cf6c1abfcc
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java
@@ -0,0 +1,60 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Map;
+
+import com.cloud.agent.api.Command;
+
+public class DeleteVmCheckpointCommand extends Command {
+    private String vmName;
+    private String checkpointId;
+    private Map<String, String> diskPathUuidMap;
+    private boolean stoppedVM;
+
+    public DeleteVmCheckpointCommand() {
+    }
+
+    public DeleteVmCheckpointCommand(String vmName, String checkpointId, Map<String, String> diskPathUuidMap, boolean stoppedVM) {
+        this.vmName = vmName;
+        this.checkpointId = checkpointId;
+        this.diskPathUuidMap = diskPathUuidMap;
+        this.stoppedVM = stoppedVM;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public Map<String, String> getDiskPathUuidMap() {
+        return diskPathUuidMap;
+    }
+
+    public boolean isStoppedVM() {
+        return stoppedVM;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java b/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java
new file mode 100644
index 000000000000..84d9b1ff8186
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java
@@ -0,0 +1,40 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class FinalizeImageTransferCommand extends Command {
+    private String transferId;
+
+    public FinalizeImageTransferCommand() {
+    }
+
+    public FinalizeImageTransferCommand(String transferId) {
+        this.transferId = transferId;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java
new file mode 100644
index 000000000000..d7cbf097df90
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java
@@ -0,0 +1,44 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StartBackupAnswer extends Answer {
+    private Long checkpointCreateTime;
+
+    public StartBackupAnswer() {
+    }
+
+    public StartBackupAnswer(StartBackupCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public StartBackupAnswer(StartBackupCommand cmd, boolean success, String details, Long checkpointCreateTime) {
+        super(cmd, success, details);
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+
+    public Long getCheckpointCreateTime() {
+        return checkpointCreateTime;
+    }
+
+    public void setCheckpointCreateTime(Long checkpointCreateTime) {
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java
new file mode 100644
index 000000000000..6f1ed6834500
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java
@@ -0,0 +1,91 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Map;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.LogLevel;
+
+public class StartBackupCommand extends Command {
+    private String vmName;
+    private String toCheckpointId;
+    private String fromCheckpointId;
+    private Long fromCheckpointCreateTime;
+    private String socket;
+    private Map<String, String> diskPathUuidMap;
+    private boolean stoppedVM;
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private Map<String, byte[]> diskPathPassphraseMap;
+
+    public StartBackupCommand() {
+    }
+
+    public StartBackupCommand(String vmName, String toCheckpointId, String fromCheckpointId, Long fromCheckpointCreateTime,
+                              String socket, Map<String, String> diskPathUuidMap, Map<String, byte[]> passphrases, boolean stoppedVM) {
+        this.vmName = vmName;
+        this.toCheckpointId = toCheckpointId;
+        this.fromCheckpointId = fromCheckpointId;
+        this.fromCheckpointCreateTime = fromCheckpointCreateTime;
+        this.socket = socket;
+        this.diskPathUuidMap = diskPathUuidMap;
+        this.diskPathPassphraseMap = passphrases;
+        this.stoppedVM = stoppedVM;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public Long getFromCheckpointCreateTime() {
+        return fromCheckpointCreateTime;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public Map<String, String> getDiskPathUuidMap() {
+        return diskPathUuidMap;
+    }
+
+    public boolean isIncremental() {
+        return fromCheckpointId != null && !fromCheckpointId.isEmpty();
+    }
+
+    public boolean isStoppedVM() {
+        return stoppedVM;
+    }
+
+    public Map<String, byte[]> getDiskPathPassphraseMap() {
+        return diskPathPassphraseMap;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java
new file mode 100644
index 000000000000..d8c78d3c8807
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java
@@ -0,0 +1,56 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StartNBDServerAnswer extends Answer {
+    private String imageTransferId;
+    private String transferUrl;
+
+    public StartNBDServerAnswer() {
+    }
+
+    public StartNBDServerAnswer(StartNBDServerCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public StartNBDServerAnswer(StartNBDServerCommand cmd, boolean success, String details,
+                                String imageTransferId, String transferUrl) {
+        super(cmd, success, details);
+        this.imageTransferId = imageTransferId;
+        this.transferUrl = transferUrl;
+    }
+
+    public String getImageTransferId() {
+        return imageTransferId;
+    }
+
+    public void setImageTransferId(String imageTransferId) {
+        this.imageTransferId = imageTransferId;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java
new file mode 100644
index 000000000000..07e50f11fd37
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java
@@ -0,0 +1,78 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.LogLevel;
+
+public class StartNBDServerCommand extends Command {
+    private String transferId;
+    private String exportName;
+    private String volumePath;
+    private String socket;
+    private String direction;
+    private String fromCheckpointId;
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private byte[] passphrase;
+
+    public StartNBDServerCommand() {
+    }
+
+    protected StartNBDServerCommand(String transferId, String exportName, String volumePath, String socket, String direction, String fromCheckpointId, byte[] passphrase) {
+        this.transferId = transferId;
+        this.socket = socket;
+        this.exportName = exportName;
+        this.volumePath = volumePath;
+        this.direction = direction;
+        this.fromCheckpointId = fromCheckpointId;
+        this.passphrase = passphrase;
+    }
+
+    public String getExportName() {
+        return exportName;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    public String getVolumePath() {
+        return volumePath;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public byte[] getPassphrase() {
+        return passphrase;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java
new file mode 100644
index 000000000000..ce977f31e005
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java
@@ -0,0 +1,30 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StopBackupAnswer extends Answer {
+
+    public StopBackupAnswer() {
+    }
+
+    public StopBackupAnswer(StopBackupCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java
new file mode 100644
index 000000000000..d3055021e9de
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java
@@ -0,0 +1,52 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class StopBackupCommand extends Command {
+    private String vmName;
+    private Long vmId;
+    private Long backupId;
+
+    public StopBackupCommand() {
+    }
+
+    public StopBackupCommand(String vmName, Long vmId, Long backupId) {
+        this.vmName = vmName;
+        this.vmId = vmId;
+        this.backupId = backupId;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java
new file mode 100644
index 000000000000..d75168a22eb2
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java
@@ -0,0 +1,46 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class StopNBDServerCommand extends Command {
+    private String transferId;
+    private String direction;
+
+    public StopNBDServerCommand() {
+    }
+
+    public StopNBDServerCommand(String transferId, String direction) {
+        this.transferId = transferId;
+        this.direction = direction;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferAnswer.java b/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferAnswer.java
new file mode 100644
index 000000000000..f3c43c400b2b
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferAnswer.java
@@ -0,0 +1,90 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.storage.clvm.command;
+
+import com.cloud.agent.api.Answer;
+
+/**
+ * Answer for ClvmLockTransferCommand, containing lock state information.
+ * This answer includes the current lock holder information when querying lock state.
+ */
+public class ClvmLockTransferAnswer extends Answer {
+
+    private String currentLockHostname;
+    private boolean isActive;
+    private boolean isOpen;
+    private String lvAttributes;
+
+    public ClvmLockTransferAnswer(ClvmLockTransferCommand cmd, boolean result, String details) {
+        super(cmd, result, details);
+    }
+
+    public ClvmLockTransferAnswer(ClvmLockTransferCommand cmd, boolean result, String details,
+                                  String currentLockHostname, boolean isActive, boolean isOpen,
+                                  String lvAttributes) {
+        super(cmd, result, details);
+        this.currentLockHostname = currentLockHostname;
+        this.isActive = isActive;
+        this.isOpen = isOpen;
+        this.lvAttributes = lvAttributes;
+    }
+
+    /**
+     * Get the hostname from lv_host. Retained for diagnostics only —
+     * do NOT use this to determine lock holder identity.
+     */
+    public String getCurrentLockHostname() {
+        return currentLockHostname;
+    }
+
+    public void setCurrentLockHostname(String currentLockHostname) {
+        this.currentLockHostname = currentLockHostname;
+    }
+
+    /**
+     * Whether the LV is locally active on the queried host (lv_attr[4]=='a').
+     * This is the authoritative signal for lock holder discovery via fan-out.
+     */
+    public boolean isActive() {
+        return isActive;
+    }
+
+    public void setActive(boolean active) {
+        isActive = active;
+    }
+
+    /**
+     * Whether a process has the device file open on the queried host (lv_attr[5]=='o').
+     * true means a VM is actively doing I/O on this host right now — do NOT deactivate.
+     */
+    public boolean isOpen() {
+        return isOpen;
+    }
+
+    public void setOpen(boolean open) {
+        isOpen = open;
+    }
+
+    public String getLvAttributes() {
+        return lvAttributes;
+    }
+
+    public void setLvAttributes(String lvAttributes) {
+        this.lvAttributes = lvAttributes;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferCommand.java b/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferCommand.java
new file mode 100644
index 000000000000..218fb798869d
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/storage/clvm/command/ClvmLockTransferCommand.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.storage.clvm.command;
+
+import com.cloud.agent.api.Command;
+
+/**
+ * Command to transfer CLVM (Clustered LVM) exclusive lock between hosts.
+ * This enables lightweight volume migration for CLVM storage pools where volumes
+ * reside in the same Volume Group (VG) but need to be accessed from different hosts.
+ *
+ * <p>Instead of copying volume data (traditional migration), this command simply
+ * deactivates the LV on the source host and activates it exclusively on the destination host.
+ *
+ * <p>This is significantly faster (10-100x) than traditional migration and uses no network bandwidth.
+ */
+public class ClvmLockTransferCommand extends Command {
+
+    /**
+     * Operation to perform on the CLVM volume.
+     * Maps to lvchange flags for LVM operations.
+     */
+    public enum Operation {
+        /** Deactivate the volume on this host (-an) */
+        DEACTIVATE("-an", "deactivate"),
+
+        /** Activate the volume exclusively on this host (-aey) */
+        ACTIVATE_EXCLUSIVE("-aey", "activate exclusively"),
+
+        /** Activate the volume in shared mode on this host (-asy) */
+        ACTIVATE_SHARED("-asy", "activate in shared mode"),
+
+        /** Query the current lock state (lvs -o lv_attr,lv_host) */
+        QUERY_LOCK_STATE("query", "query lock state");
+
+        private final String lvchangeFlag;
+        private final String description;
+
+        Operation(String lvchangeFlag, String description) {
+            this.lvchangeFlag = lvchangeFlag;
+            this.description = description;
+        }
+
+        public String getLvchangeFlag() {
+            return lvchangeFlag;
+        }
+
+        public String getDescription() {
+            return description;
+        }
+    }
+
+    private String lvPath;
+    private Operation operation;
+    private String volumeUuid;
+
+    public ClvmLockTransferCommand() {
+        // For serialization
+    }
+
+    public ClvmLockTransferCommand(Operation operation, String lvPath, String volumeUuid) {
+        this.operation = operation;
+        this.lvPath = lvPath;
+        this.volumeUuid = volumeUuid;
+        setWait(65);
+    }
+
+    public String getLvPath() {
+        return lvPath;
+    }
+
+    public Operation getOperation() {
+        return operation;
+    }
+
+    public String getVolumeUuid() {
+        return volumeUuid;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/debian/control b/debian/control
index 2b8ce929c639..cdf663ef8906 100644
--- a/debian/control
+++ b/debian/control
@@ -24,7 +24,7 @@ Description: CloudStack server library
 
 Package: cloudstack-agent
 Architecture: all
-Depends: ${python:Depends}, ${python3:Depends}, openjdk-17-jre-headless | java17-runtime-headless | java17-runtime | zulu-17, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5) | qemu-system-x86 (>= 5.2), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), iproute2, ebtables, vlan, ipset, python3-libvirt, ethtool, iptables, cryptsetup, rng-tools, rsync, ovmf, swtpm, lsb-release, ufw, apparmor, cpu-checker, libvirt-daemon-driver-storage-rbd, sysstat
+Depends: ${python:Depends}, ${python3:Depends}, openjdk-17-jre-headless | java17-runtime-headless | java17-runtime | zulu-17, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5) | qemu-system-x86 (>= 5.2), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), iproute2, ebtables, vlan, ipset, python3-libvirt, ethtool, iptables, cryptsetup, rng-tools, rsync, ovmf, swtpm, lsb-release, ufw, apparmor, cpu-checker, libvirt-daemon-driver-storage-rbd, sysstat, python3-libnbd, socat
 Recommends: init-system-helpers
 Conflicts: cloud-agent, cloud-agent-libs, cloud-agent-deps, cloud-agent-scripts
 Description: CloudStack agent
diff --git a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
index e871bd8672ff..5eca02f33d51 100644
--- a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
+++ b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
@@ -59,6 +59,8 @@
  */
 public interface VirtualMachineManager extends Manager {
 
+    String KVM_BLANK_VM_TEMPLATE_NAME = "kvm-blank-vm-template";
+
     ConfigKey<Boolean> ExecuteInSequence = new ConfigKey<>("Advanced", Boolean.class, "execute.in.sequence.hypervisor.commands", "false",
             "If set to true, start, stop, reboot, copy and migrate commands will be serialized on the agent side. If set to false the commands are executed in parallel. Default value is false.", false);
 
@@ -312,4 +314,8 @@ void checkDeploymentPlan(VirtualMachine virtualMachine, VirtualMachineTemplate t
                 ServiceOffering serviceOffering, Account systemAccount, DeploymentPlan plan)
             throws InsufficientServerCapacityException;
 
+    boolean isBlankInstanceDefaultTemplate(VirtualMachineTemplate template);
+
+    boolean isBlankInstance(VirtualMachineTemplate template);
+
 }
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeInfo.java b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeInfo.java
index 8b0171870765..4937edd33d1f 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeInfo.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeInfo.java
@@ -103,4 +103,21 @@ public interface VolumeInfo extends DownloadableDataInfo, Volume {
     List<String> getCheckpointPaths();
 
     Set<String> getCheckpointImageStoreUrls();
+
+    /**
+     * Gets the destination host ID hint for CLVM volume creation.
+     * This is used to route volume creation commands to the specific host where the VM will be deployed.
+     * Only applicable for CLVM storage pools to avoid shared mode activation.
+     *
+     * @return The host ID where the volume should be created, or null if not set
+     */
+    Long getDestinationHostId();
+
+    /**
+     * Sets the destination host ID hint for CLVM volume creation.
+     * This should be set before volume creation when the destination host is known.
+     *
+     * @param hostId The host ID where the volume should be created
+     */
+    void setDestinationHostId(Long hostId);
 }
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeService.java
index 682473ec94fc..a7d82d0b9628 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/VolumeService.java
@@ -30,6 +30,7 @@
 import com.cloud.host.Host;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
 import com.cloud.offering.DiskOffering;
+import com.cloud.storage.Storage.StoragePoolType;
 import com.cloud.storage.Volume;
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
@@ -123,4 +124,71 @@ boolean copyPoliciesBetweenVolumesAndDestroySourceVolumeAfterMigration(ObjectInD
     void checkAndRepairVolumeBasedOnConfig(DataObject dataObject, Host host);
 
     void validateChangeDiskOfferingEncryptionType(long existingDiskOfferingId, long newDiskOfferingId);
+
+    /**
+     * Transfers exclusive lock for a volume on cluster-based storage (e.g., CLVM/CLVM_NG) from one host to another.
+     * This is used for storage that requires host-level lock management for volumes on shared storage pools.
+     * For non-CLVM pool types, this method returns false without taking action.
+     *
+     * @param volume The volume to transfer lock for
+     * @param sourceHostId Host currently holding the exclusive lock
+     * @param destHostId Host to receive the exclusive lock
+     * @return true if lock transfer succeeded or was not needed, false if it failed
+     */
+    boolean transferVolumeLock(VolumeInfo volume, Long sourceHostId, Long destHostId);
+
+    /**
+     * Finds which host currently has the exclusive lock on a CLVM volume.
+     * Checks in order: explicit lock tracking, attached VM's host, or first available cluster host.
+     *
+     * @param volume The CLVM volume
+     * @return Host ID that has the exclusive lock, or null if cannot be determined
+     */
+    Long findVolumeLockHost(VolumeInfo volume);
+
+    /**
+     * Performs lightweight CLVM lock migration for a volume to a target host.
+     * This transfers the LVM exclusive lock without copying data (CLVM volumes are on shared cluster storage).
+     * If the volume already has the lock on the destination host, no action is taken.
+     *
+     * @param volume The volume to migrate lock for
+     * @param destHostId Destination host ID
+     * @return Updated VolumeInfo after lock migration
+     */
+    VolumeInfo performLockMigration(VolumeInfo volume, Long destHostId);
+
+    /**
+     * Checks if both storage pools are CLVM type (CLVM or CLVM_NG).
+     *
+     * @param volumePoolType Storage pool type for the volume
+     * @param vmPoolType Storage pool type for the VM
+     * @return true if both pools are CLVM type (CLVM or CLVM_NG)
+     */
+    boolean areBothPoolsClvmType(StoragePoolType volumePoolType, StoragePoolType vmPoolType);
+
+    /**
+     * Determines if CLVM lock transfer is required when a volume is already on the correct storage pool.
+     *
+     * @param volumeToAttach The volume being attached
+     * @param volumePoolType Storage pool type for the volume
+     * @param vmPoolType Storage pool type for the VM's existing volume
+     * @param volumePoolId Storage pool ID for the volume
+     * @param vmPoolId Storage pool ID for the VM's existing volume
+     * @param vmHostId VM's current host ID (or last host ID if stopped)
+     * @return true if CLVM lock transfer is needed
+     */
+    boolean isLockTransferRequired(VolumeInfo volumeToAttach, StoragePoolType volumePoolType, StoragePoolType vmPoolType,
+                                   Long volumePoolId, Long vmPoolId, Long vmHostId);
+
+    /**
+     * Determines if lightweight CLVM migration is needed instead of full data copy.
+     *
+     * @param volumePoolType Storage pool type for the volume
+     * @param vmPoolType Storage pool type for the VM
+     * @param volumePoolPath Storage pool path for the volume
+     * @param vmPoolPath Storage pool path for the VM
+     * @return true if lightweight migration should be used
+     */
+    boolean isLightweightMigrationNeeded(StoragePoolType volumePoolType, StoragePoolType vmPoolType,
+                                         String volumePoolPath, String vmPoolPath);
 }
diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index ead990b42b86..c27240823b16 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -50,6 +50,8 @@
 import javax.naming.ConfigurationException;
 import javax.persistence.EntityExistsException;
 
+import com.cloud.agent.api.PostMigrationCommand;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.hypervisor.KVMGuru;
 import org.apache.cloudstack.affinity.dao.AffinityGroupVMMapDao;
 import org.apache.cloudstack.annotation.AnnotationService;
@@ -136,6 +138,7 @@
 import com.cloud.agent.api.PrepareExternalProvisioningCommand;
 import com.cloud.agent.api.PrepareForMigrationAnswer;
 import com.cloud.agent.api.PrepareForMigrationCommand;
+import com.cloud.agent.api.PreMigrationCommand;
 import com.cloud.agent.api.RebootAnswer;
 import com.cloud.agent.api.RebootCommand;
 import com.cloud.agent.api.RecreateCheckpointsCommand;
@@ -267,6 +270,7 @@
 import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.dao.VMTemplateZoneDao;
 import com.cloud.storage.dao.VolumeDao;
+import com.cloud.storage.dao.VolumeDetailsDao;
 import com.cloud.storage.snapshot.SnapshotManager;
 import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.user.Account;
@@ -303,8 +307,8 @@
 import com.cloud.vm.VirtualMachine.State;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
-import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.snapshot.VMSnapshotManager;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
@@ -361,6 +365,8 @@ public class VirtualMachineManagerImpl extends ManagerBase implements VirtualMac
     @Inject
     private VolumeDao _volsDao;
     @Inject
+    private VolumeDetailsDao _volsDetailsDao;
+    @Inject
     private HighAvailabilityManager _haMgr;
     @Inject
     private HostPodDao _podDao;
@@ -463,6 +469,8 @@ public class VirtualMachineManagerImpl extends ManagerBase implements VirtualMac
     ExtensionsManager extensionsManager;
     @Inject
     ExtensionDetailsDao extensionDetailsDao;
+    @Inject
+    ClvmPoolManager clvmPoolManager;
 
 
     VmWorkJobHandlerProxy _jobHandlerProxy = new VmWorkJobHandlerProxy(this);
@@ -576,7 +584,13 @@ public void allocate(final String vmInstanceName, final VirtualMachineTemplate t
 
             logger.debug("Allocating disks for {}",  persistedVm);
 
-            allocateRootVolume(persistedVm, template, rootDiskOfferingInfo, owner, rootDiskSizeFinal, volume, snapshot);
+            if (isBlankInstance(template)) {
+                logger.debug("Template is a dummy template for hypervisor {}, skipping volume allocation", hyperType);
+                return;
+            } else {
+                allocateRootVolume(persistedVm, template, rootDiskOfferingInfo, owner, rootDiskSizeFinal, volume, snapshot);
+            }
+
 
             // Create new Volume context and inject event resource type, id and details to generate VOLUME.CREATE event for the ROOT disk.
             CallContext volumeContext = CallContext.register(CallContext.current(), ApiCommandResourceType.Volume);
@@ -3144,6 +3158,9 @@ protected void migrate(final VMInstanceVO vm, final long srcHostId, final Deploy
         updateOverCommitRatioForVmProfile(profile, dest.getHost().getClusterId());
 
         final VirtualMachineTO to = toVmTO(profile);
+
+        executePreMigrationCommand(vm, to, srcHostId);
+
         final PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(to);
         setVmNetworkDetails(vm, to);
 
@@ -3275,6 +3292,7 @@ protected void migrate(final VMInstanceVO vm, final long srcHostId, final Deploy
                 logger.warn("Error while checking the vm {} on host {}", vm, dest.getHost(), e);
             }
             migrated = true;
+            executePostMigrationCommand(vm, to, dstHostId);
         } finally {
             if (!migrated) {
                 logger.info("Migration was unsuccessful. Cleaning up: {}", vm);
@@ -3314,6 +3332,30 @@ protected void migrate(final VMInstanceVO vm, final long srcHostId, final Deploy
         }
     }
 
+    private void executePostMigrationCommand(VMInstanceVO vm, VirtualMachineTO to, long dstHostId) {
+        if (!(vm.getHypervisorType() == HypervisorType.KVM && hasClvmVolumes(vm.getId()))) {
+            return;
+        }
+        final String dstHostUuid = _hostDao.findById(dstHostId).getUuid();
+        try {
+            logger.info("Executing post-migration tasks for VM {} with CLVM volumes on destination host {}", vm.getInstanceName(), dstHostUuid);
+            final PostMigrationCommand postMigrationCommand = new PostMigrationCommand(to, vm.getInstanceName());
+            final Answer postMigrationAnswer = _agentMgr.send(dstHostId, postMigrationCommand);
+
+            if (postMigrationAnswer == null || !postMigrationAnswer.getResult()) {
+                final String details = postMigrationAnswer != null ? postMigrationAnswer.getDetails() : "null answer returned";
+                logger.warn("Post-migration tasks failed for VM {} on destination host {}: {}. Migration completed but some cleanup may be needed.",
+                        vm.getInstanceName(), dstHostUuid, details);
+            } else {
+                logger.info("Successfully completed post-migration tasks for VM {} on destination host {}", vm.getInstanceName(), dstHostUuid);
+            }
+        } catch (Exception e) {
+            logger.warn("Exception during post-migration tasks for VM {} on destination host {}: {}. Migration completed but some cleanup may be needed.",
+                    vm.getInstanceName(), dstHostUuid, e.getMessage(), e);
+        }
+        updateClvmLockHostForVmVolumes(vm.getId(), dstHostId);
+    }
+
     /**
      * Create and set parameters for the {@link MigrateCommand} used in the migration and scaling of VMs.
      */
@@ -3360,6 +3402,27 @@ private void updateVmPod(VMInstanceVO vm, long dstHostId) {
         _vmDao.persist(newVm);
     }
 
+    /**
+     * Updates CLVM_LOCK_HOST_ID for all CLVM volumes attached to a VM after VM migration.
+     * This ensures that subsequent operations on CLVM volumes are routed to the correct host.
+     *
+     * @param vmId The ID of the VM that was migrated
+     * @param destHostId The destination host ID where the VM now resides
+     */
+    private void updateClvmLockHostForVmVolumes(long vmId, long destHostId) {
+        List<VolumeVO> volumes = _volsDao.findByInstance(vmId);
+        if (CollectionUtils.isEmpty(volumes)) {
+            return;
+        }
+
+        for (VolumeVO volume : volumes) {
+            StoragePoolVO pool = _storagePoolDao.findById(volume.getPoolId());
+            if (pool != null && ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+                clvmPoolManager.setClvmLockHostId(volume.getId(), destHostId);
+            }
+        }
+    }
+
     /**
      * We create the mapping of volumes and storage pool to migrate the VMs according to the information sent by the user.
      * If the user did not enter a complete mapping, the volumes that were left behind will be auto mapped using {@link #createStoragePoolMappingsForVolumes(VirtualMachineProfile, DataCenterDeployment, Map, List)}
@@ -4916,6 +4979,12 @@ private void orchestrateMigrateForScale(final String vmUuid, final long srcHostI
         volumeMgr.prepareForMigration(profile, dest);
 
         final VirtualMachineTO to = toVmTO(profile);
+
+        // Step 1: Send PreMigrationCommand to source host to convert CLVM volumes to shared mode
+        // This must happen BEFORE PrepareForMigrationCommand on destination to avoid lock conflicts
+        executePreMigrationCommand(vm, to, srcHostId);
+
+        // Step 2: Send PrepareForMigrationCommand to destination host
         final PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(to);
 
         ItWorkVO work = new ItWorkVO(UUID.randomUUID().toString(), _nodeId, State.Migrating, vm.getType(), vm.getId());
@@ -5000,6 +5069,7 @@ private void orchestrateMigrateForScale(final String vmUuid, final long srcHostI
             }
 
             migrated = true;
+            executePostMigrationCommand(vm, to, dstHostId);
         } finally {
             if (!migrated) {
                 logger.info("Migration was unsuccessful.  Cleaning up: {}", vm);
@@ -6435,6 +6505,37 @@ private Pair<Long, Long> findClusterAndHostIdForVm(VirtualMachine vm) {
         return findClusterAndHostIdForVm(vm, false);
     }
 
+    private boolean hasClvmVolumes(long vmId) {
+        List<VolumeVO> volumes = _volsDao.findByInstance(vmId);
+        return volumes.stream()
+            .map(v -> _storagePoolDao.findById(v.getPoolId()))
+            .anyMatch(pool -> pool != null && ClvmPoolManager.isClvmPoolType(pool.getPoolType()));
+    }
+
+    private void executePreMigrationCommand(VMInstanceVO vm, VirtualMachineTO to, long srcHostId) {
+        if (!(vm.getHypervisorType() == HypervisorType.KVM && hasClvmVolumes(vm.getId()))) {
+            return;
+        }
+        final String vmInstanceName = vm.getInstanceName();
+        final String srcHostUuid = _hostDao.findById(srcHostId).getUuid();
+        logger.info("Sending PreMigrationCommand to source host {} for VM {} with CLVM volumes", srcHostUuid, vmInstanceName);
+        final PreMigrationCommand preMigCmd = new PreMigrationCommand(to, vmInstanceName);
+        Answer preMigAnswer = null;
+        try {
+            preMigAnswer = _agentMgr.send(srcHostId, preMigCmd);
+            if (preMigAnswer == null || !preMigAnswer.getResult()) {
+                final String details = preMigAnswer != null ? preMigAnswer.getDetails() : "null answer returned";
+                final String msg = "Failed to prepare source host for migration: " + details;
+                logger.error("Failed to prepare source host {} for migration of VM {}: {}", srcHostUuid, vmInstanceName, details);
+                throw new CloudRuntimeException(msg);
+            }
+            logger.info("Successfully prepared source host {} for migration of VM {}", srcHostUuid, vmInstanceName);
+        } catch (final AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Failed to send PreMigrationCommand to source host {}: {}", srcHostUuid, e.getMessage(), e);
+            throw new CloudRuntimeException("Failed to prepare source host for migration: " + e.getMessage(), e);
+        }
+    }
+
     @Override
     public Pair<Long, Long> findClusterAndHostIdForVm(long vmId) {
         VMInstanceVO vm = _vmDao.findById(vmId);
@@ -6708,4 +6809,18 @@ public void checkDeploymentPlan(VirtualMachine virtualMachine, VirtualMachineTem
                     vmProfile), DataCenter.class, plan.getDataCenterId(), areAffinityGroupsAssociated(vmProfile));
         }
     }
+
+    @Override
+    public boolean isBlankInstanceDefaultTemplate(VirtualMachineTemplate template) {
+        return KVM_BLANK_VM_TEMPLATE_NAME.equals(template.getUniqueName());
+    }
+
+    @Override
+    public boolean isBlankInstance(VirtualMachineTemplate template) {
+        if (isBlankInstanceDefaultTemplate(template)) {
+            return true;
+        }
+        return Boolean.TRUE.equals(
+                MapUtils.getBoolean(CallContext.current().getContextParameters(), ApiConstants.BLANK_INSTANCE));
+    }
 }
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
index 8639f006383f..964265cb873e 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
@@ -19,6 +19,7 @@
 package org.apache.cloudstack.engine.orchestration;
 
 import com.cloud.storage.Snapshot;
+import com.cloud.storage.VMTemplateVO;
 import com.cloud.storage.Volume;
 import com.cloud.template.VirtualMachineTemplate;
 import java.net.URL;
@@ -292,9 +293,11 @@ public VirtualMachineEntity createVirtualMachineFromScratch(String id, String ow
 
         ServiceOfferingVO computeOffering = _serviceOfferingDao.findById(vm.getId(), vm.getServiceOfferingId());
 
+        VMTemplateVO iso = _templateDao.findByIdIncludingRemoved(Long.valueOf(isoId));
+
         DiskOfferingInfo rootDiskOfferingInfo = new DiskOfferingInfo();
 
-        if (diskOfferingId == null) {
+        if (diskOfferingId == null && !_itMgr.isBlankInstance(iso)) {
             throw new InvalidParameterValueException("Installing from ISO requires a disk offering to be specified for the root disk.");
         }
         DiskOfferingVO diskOffering = _diskOfferingDao.findById(diskOfferingId);
@@ -345,7 +348,7 @@ public VirtualMachineEntity createVirtualMachineFromScratch(String id, String ow
 
         HypervisorType hypervisorType = HypervisorType.valueOf(hypervisor);
 
-        _itMgr.allocate(vm.getInstanceName(), _templateDao.findByIdIncludingRemoved(new Long(isoId)), computeOffering, rootDiskOfferingInfo, dataDiskOfferings, dataDiskDeviceIds,
+        _itMgr.allocate(vm.getInstanceName(), iso, computeOffering, rootDiskOfferingInfo, dataDiskOfferings, dataDiskDeviceIds,
                 networkIpMap, plan, hypervisorType, extraDhcpOptionMap, null, volume, snapshot);
 
         return vmEntity;
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
index bf3985d3ce77..c4a6a9dd6843 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
@@ -38,8 +38,10 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.agent.AgentManager;
 import com.cloud.deploy.DeploymentClusterPlanner;
 import com.cloud.exception.ResourceAllocationException;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.resourcelimit.ReservationHelper;
 import com.cloud.storage.DiskOfferingVO;
 import com.cloud.storage.VMTemplateVO;
@@ -275,6 +277,10 @@ public enum UserVmCloneType {
     ConfigurationDao configurationDao;
     @Inject
     VMInstanceDao vmInstanceDao;
+    @Inject
+    ClvmPoolManager clvmPoolManager;
+    @Inject
+    AgentManager _agentMgr;
 
     @Inject
     protected SnapshotHelper snapshotHelper;
@@ -747,6 +753,17 @@ public VolumeInfo createVolume(VolumeInfo volumeInfo, VirtualMachine vm, Virtual
         logger.debug("Trying to create volume [{}] on storage pool [{}].",
                 volumeToString, poolToString);
         DataStore store = dataStoreMgr.getDataStore(pool.getId(), DataStoreRole.Primary);
+
+        // For CLVM pools, set the lock host hint so volume is created on the correct host
+        // This avoids the need for shared mode activation and improves performance
+        if (ClvmPoolManager.isClvmPoolType(pool.getPoolType()) && hostId != null) {
+            logger.info("CLVM pool detected. Setting lock host {} for volume {} to route creation to correct host",
+                    hostId, volumeInfo.getUuid());
+            volumeInfo.setDestinationHostId(hostId);
+
+            clvmPoolManager.setClvmLockHostId(volumeInfo.getId(), hostId);
+        }
+
         for (int i = 0; i < 2; i++) {
             // retry one more time in case of template reload is required for Vmware case
             AsyncCallFuture<VolumeApiResult> future = null;
@@ -788,6 +805,122 @@ private String getVolumeIdentificationInfos(Volume volume) {
         return String.format("uuid: %s, name: %s", volume.getUuid(), volume.getName());
     }
 
+    /**
+     * Updates the CLVM_LOCK_HOST_ID for a migrated volume if applicable.
+     * For CLVM volumes that are attached to a VM, this updates the lock host tracking
+     * to point to the VM's current host after volume migration.
+     *
+     * @param migratedVolume The volume that was migrated
+     * @param destPool The destination storage pool
+     * @param operationType Description of the operation (e.g., "migrated", "live-migrated") for logging
+     */
+    private void updateClvmLockHostAfterMigration(Volume migratedVolume, StoragePool destPool, String operationType) {
+        if (migratedVolume == null || destPool == null) {
+            return;
+        }
+
+        StoragePoolVO pool = _storagePoolDao.findById(destPool.getId());
+        if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            return;
+        }
+
+        if (migratedVolume.getInstanceId() == null) {
+            return;
+        }
+
+        VMInstanceVO vm = vmInstanceDao.findById(migratedVolume.getInstanceId());
+        if (vm == null || vm.getHostId() == null) {
+            return;
+        }
+
+        clvmPoolManager.setClvmLockHostId(migratedVolume.getId(), vm.getHostId());
+        logger.debug("Updated CLVM_LOCK_HOST_ID for {} volume {} to host {} where VM {} is running",
+                operationType, migratedVolume.getUuid(), vm.getHostId(), vm.getInstanceName());
+    }
+
+    /**
+     * Retrieves the CLVM lock host ID from any existing volume of the specified VM.
+     * This is useful when attaching a new volume to a stopped VM - we want to maintain
+     * consistency by using the same host that manages the VM's other CLVM volumes.
+     *
+     * @param vmId The ID of the VM
+     * @return The host ID if found, null otherwise
+     */
+    private Long getClvmLockHostFromVmVolumes(Long vmId) {
+        if (vmId == null) {
+            return null;
+        }
+
+        List<VolumeVO> vmVolumes = _volsDao.findByInstance(vmId);
+        if (vmVolumes == null || vmVolumes.isEmpty()) {
+            return null;
+        }
+
+        for (VolumeVO volume : vmVolumes) {
+            if (volume.getPoolId() == null) {
+                continue;
+            }
+
+            StoragePoolVO pool = _storagePoolDao.findById(volume.getPoolId());
+            if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+                continue;
+            }
+            Long lockHostId = clvmPoolManager.getClvmLockHostId(
+                    volume.getId(),
+                    volume.getUuid(),
+                    volume.getPath(),
+                    pool,
+                    true
+            );
+            if (lockHostId != null) {
+                logger.debug("Found actual CLVM lock host {} from volume {} of VM {} via LVM query",
+                        lockHostId, volume.getUuid(), vmId);
+                return lockHostId;
+            }
+        }
+
+        return null;
+    }
+
+    private void transferClvmLocksForVmStart(List<VolumeVO> volumes, Long destHostId, VMInstanceVO vm) {
+        if (volumes == null || volumes.isEmpty() || destHostId == null) {
+            return;
+        }
+
+        for (VolumeVO volume : volumes) {
+            if (volume.getPoolId() == null) {
+                continue;
+            }
+
+            StoragePoolVO pool = _storagePoolDao.findById(volume.getPoolId());
+            if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+                continue;
+            }
+
+            Long currentLockHost = clvmPoolManager.getClvmLockHostId(
+                    volume.getId(),
+                    volume.getUuid(),
+                    volume.getPath(),
+                    pool,
+                    true
+            );
+
+            if (currentLockHost == null) {
+                clvmPoolManager.setClvmLockHostId(volume.getId(), destHostId);
+            } else if (!currentLockHost.equals(destHostId)) {
+                logger.info("CLVM volume {} is locked on host {} but VM {} starting on host {}. Transferring lock.",
+                        volume.getUuid(), currentLockHost, vm.getInstanceName(), destHostId);
+
+                if (!clvmPoolManager.transferClvmVolumeLock(volume.getUuid(), volume.getId(),
+                        volume.getPath(), pool, currentLockHost, destHostId)) {
+                    throw new CloudRuntimeException(
+                            String.format("Failed to transfer CLVM lock for volume %s from host %s to host %s",
+                                    volume.getUuid(), currentLockHost, destHostId));
+                }
+            }
+        }
+    }
+
     public String getRandomVolumeName() {
         return UUID.randomUUID().toString();
     }
@@ -1206,10 +1339,22 @@ public VolumeInfo createVolumeOnPrimaryStorage(VirtualMachine vm, VolumeInfo vol
         Long clusterId = storagePool.getClusterId();
         logger.trace("storage-pool {}/{} is associated with cluster {}",storagePool.getName(), storagePool.getUuid(), clusterId);
         Long hostId = vm.getHostId();
-        if (hostId == null && storagePool.isLocal()) {
-            List<StoragePoolHostVO> poolHosts = storagePoolHostDao.listByPoolId(storagePool.getId());
-            if (poolHosts.size() > 0) {
-                hostId = poolHosts.get(0).getHostId();
+        if (hostId == null && (storagePool.isLocal() || ClvmPoolManager.isClvmPoolType(storagePool.getPoolType()))) {
+            if (ClvmPoolManager.isClvmPoolType(storagePool.getPoolType())) {
+                hostId = getClvmLockHostFromVmVolumes(vm.getId());
+                if (hostId != null) {
+                    logger.debug("Using CLVM lock host {} from VM {}'s existing volumes for new volume creation",
+                            hostId, vm.getUuid());
+                }
+            }
+
+            if (hostId == null) {
+                List<StoragePoolHostVO> poolHosts = storagePoolHostDao.listByPoolId(storagePool.getId());
+                if (!poolHosts.isEmpty()) {
+                    hostId = poolHosts.get(0).getHostId();
+                    logger.debug("Selected host {} from storage pool {} for stopped VM {} volume creation",
+                            hostId, storagePool.getUuid(), vm.getUuid());
+                }
             }
         }
 
@@ -1454,6 +1599,9 @@ public Volume migrateVolume(Volume volume, StoragePool destPool) throws StorageU
                     _snapshotDao.updateVolumeIds(vol.getId(), result.getVolume().getId());
                     _snapshotDataStoreDao.updateVolumeIds(vol.getId(), result.getVolume().getId());
                 }
+
+                // For CLVM volumes attached to a VM, update the CLVM_LOCK_HOST_ID after migration
+                updateClvmLockHostAfterMigration(result.getVolume(), destPool, "migrated");
             }
             return result.getVolume();
         } catch (InterruptedException | ExecutionException e) {
@@ -1479,6 +1627,10 @@ public Volume liveMigrateVolume(Volume volume, StoragePool destPool) {
                 logger.error("Volume [{}] migration failed due to [{}].", volToString, result.getResult());
                 return null;
             }
+
+            // For CLVM volumes attached to a VM, update the CLVM_LOCK_HOST_ID after live migration
+            updateClvmLockHostAfterMigration(result.getVolume(), destPool, "live-migrated");
+
             return result.getVolume();
         } catch (InterruptedException | ExecutionException e) {
             logger.error("Volume [{}] migration failed due to [{}].", volToString, e.getMessage());
@@ -1521,6 +1673,22 @@ public void migrateVolumes(VirtualMachine vm, VirtualMachineTO vmTo, Host srcHos
                 logger.error(msg);
                 throw new CloudRuntimeException(msg);
             }
+            for (Map.Entry<Volume, StoragePool> entry : volumeToPool.entrySet()) {
+                Volume volume = entry.getKey();
+                StoragePool destPool = entry.getValue();
+                StoragePoolVO srcPool = _storagePoolDao.findById(volume.getPoolId());
+                if (srcPool != null && srcPool.getId() == destPool.getId() &&
+                        ClvmPoolManager.isClvmPoolType(srcPool.getPoolType())) {
+                    if (!clvmPoolManager.transferClvmVolumeLock(volume.getUuid(), volume.getId(),
+                            volume.getPath(), srcPool, srcHost.getId(), destHost.getId())) {
+                        throw new CloudRuntimeException(String.format(
+                                "Failed to transfer CLVM lock for volume [%s] to destination host [%s].",
+                                volume.getUuid(), destHost.getId()));
+                    }
+                } else {
+                    updateClvmLockHostAfterMigration(volume, destPool, "vm-migrated");
+                }
+            }
         } catch (InterruptedException |  ExecutionException e) {
             logger.error("Failed to migrate VM [{}] along with its volumes due to [{}].", vm, e.getMessage());
             logger.debug("Exception: ", e);
@@ -1853,6 +2021,19 @@ private Pair<VolumeVO, DataStore> recreateVolume(VolumeVO vol, VirtualMachinePro
 
                     future = volService.createManagedStorageVolumeFromTemplateAsync(volume, destPool.getId(), templ, hostId);
                 } else {
+                    // For CLVM pools, set the destination host hint so volume is created on the correct host
+                    // This avoids the need for shared mode activation and improves performance
+                    StoragePoolVO poolVO = _storagePoolDao.findById(destPool.getId());
+                    if (poolVO != null && ClvmPoolManager.isClvmPoolType(poolVO.getPoolType())) {
+                        Long hostId = vm.getVirtualMachine().getHostId();
+                        if (hostId != null) {
+                            volume.setDestinationHostId(hostId);
+                            clvmPoolManager.setClvmLockHostId(volume.getId(), hostId);
+                            logger.info("CLVM pool detected during volume creation from template. Setting lock host {} for volume {} (persisted to DB) to route creation to correct host",
+                                    hostId, volume.getUuid());
+                        }
+                    }
+
                     future = volService.createVolumeFromTemplateAsync(volume, destPool.getId(), templ);
                 }
             }
@@ -1976,13 +2157,18 @@ public void prepare(VirtualMachineProfile vm, DeployDestination dest) throws Sto
             throw new CloudRuntimeException(msg);
         }
 
-        // don't allow to start vm that doesn't have a root volume
         if (_volsDao.findByInstanceAndType(vm.getId(), Volume.Type.ROOT).isEmpty()) {
             throw new CloudRuntimeException(String.format("ROOT volume is missing, unable to prepare volumes for the VM [%s].", vm.getVirtualMachine()));
         }
 
         List<VolumeVO> vols = _volsDao.findUsableVolumesForInstance(vm.getId());
 
+        VirtualMachine vmInstance = vm.getVirtualMachine();
+        VMInstanceVO vmInstanceVO = vmInstanceDao.findById(vmInstance.getId());
+        if (vmInstance.getState() == State.Starting && dest.getHost() != null) {
+            transferClvmLocksForVmStart(vols, dest.getHost().getId(), vmInstanceVO);
+        }
+
         List<VolumeTask> tasks = getTasks(vols, dest.getStorageForDisks(), vm);
         Volume vol = null;
         PrimaryDataStore store;
diff --git a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
index 17c5002c718b..8f93ae5b35a3 100644
--- a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
+++ b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
@@ -44,6 +44,8 @@
             value="#{storagePoolAllocatorsRegistry.registered}" />
     </bean>
 
+    <bean id="clvmPoolManager" class="com.cloud.storage.clvm.ClvmPoolManager" />
+
     <bean id="storageOrchestrator"
           class="org.apache.cloudstack.engine.orchestration.StorageOrchestrator"/>
     <bean id="dataMigrationHelper"
@@ -88,6 +90,7 @@
                 <entry key="VirtualMachineManagerImpl" value-ref="clusteredVirtualMachineManagerImpl" />
                 <entry key="VolumeApiServiceImpl" value-ref="volumeApiServiceImpl" />
                 <entry key="VMSnapshotManagerImpl" value-ref="vMSnapshotManagerImpl" />
+                <entry key="KVMBackupExportServiceImpl" value-ref="kvmBackupExportService" />
             </map>
         </property>
     </bean>
diff --git a/engine/orchestration/src/test/java/com/cloud/vm/VirtualMachineManagerImplTest.java b/engine/orchestration/src/test/java/com/cloud/vm/VirtualMachineManagerImplTest.java
index a07870d09af2..c656e1a282af 100644
--- a/engine/orchestration/src/test/java/com/cloud/vm/VirtualMachineManagerImplTest.java
+++ b/engine/orchestration/src/test/java/com/cloud/vm/VirtualMachineManagerImplTest.java
@@ -38,6 +38,7 @@
 import static org.mockito.Mockito.when;
 
 import java.lang.reflect.Field;
+import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -60,6 +61,7 @@
 import com.cloud.network.Network;
 import com.cloud.network.NetworkModel;
 import com.cloud.resource.ResourceManager;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.subsystem.api.storage.StoragePoolAllocator;
@@ -336,6 +338,19 @@ public void cleanup() {
         }
     }
 
+    private ClvmPoolManager injectMockedClvmPoolManager() {
+        ClvmPoolManager clvmPoolManagerMock = mock(ClvmPoolManager.class);
+        ReflectionTestUtils.setField(virtualMachineManagerImpl, "clvmPoolManager", clvmPoolManagerMock);
+        return clvmPoolManagerMock;
+    }
+
+    private Method getUpdateClvmLockHostForVmVolumesMethod() throws NoSuchMethodException {
+        Method method = VirtualMachineManagerImpl.class.getDeclaredMethod(
+            "updateClvmLockHostForVmVolumes", long.class, long.class);
+        method.setAccessible(true);
+        return method;
+    }
+
     @Test
     public void testaddHostIpToCertDetailsIfConfigAllows() {
         Host vmHost = mock(Host.class);
@@ -1954,4 +1969,181 @@ public void testUnmanageSuccessKvm() throws Exception {
         }
     }
 
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithClvmVolumes() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+        long poolId = 10L;
+
+        VolumeVO clvmVolume1 = mock(VolumeVO.class);
+        VolumeVO clvmVolume2 = mock(VolumeVO.class);
+
+        when(clvmVolume1.getId()).thenReturn(1L);
+        when(clvmVolume1.getPoolId()).thenReturn(poolId);
+        when(clvmVolume2.getId()).thenReturn(2L);
+        when(clvmVolume2.getPoolId()).thenReturn(poolId);
+
+        StoragePoolVO clvmPool = mock(StoragePoolVO.class);
+        when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(clvmVolume1, clvmVolume2));
+        when(storagePoolDaoMock.findById(poolId)).thenReturn(clvmPool);
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(1L, destHostId);
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(2L, destHostId);
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithNonClvmVolumes() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+        long poolId = 10L;
+
+        VolumeVO nfsVolume = mock(VolumeVO.class);
+        when(nfsVolume.getPoolId()).thenReturn(poolId);
+
+        StoragePoolVO nfsPool = mock(StoragePoolVO.class);
+        when(nfsPool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(nfsVolume));
+        when(storagePoolDaoMock.findById(poolId)).thenReturn(nfsPool);
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, never()).setClvmLockHostId(anyLong(), anyLong());
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithMixedVolumes() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+        long clvmPoolId = 10L;
+        long nfsPoolId = 20L;
+
+        VolumeVO clvmVolume = mock(VolumeVO.class);
+        VolumeVO nfsVolume = mock(VolumeVO.class);
+
+        when(clvmVolume.getId()).thenReturn(1L);
+        when(clvmVolume.getPoolId()).thenReturn(clvmPoolId);
+        when(nfsVolume.getPoolId()).thenReturn(nfsPoolId);
+
+        StoragePoolVO clvmPool = mock(StoragePoolVO.class);
+        when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        StoragePoolVO nfsPool = mock(StoragePoolVO.class);
+        when(nfsPool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(clvmVolume, nfsVolume));
+        when(storagePoolDaoMock.findById(clvmPoolId)).thenReturn(clvmPool);
+        when(storagePoolDaoMock.findById(nfsPoolId)).thenReturn(nfsPool);
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(1L, destHostId);
+        verify(clvmPoolManagerMock, never()).setClvmLockHostId(2L, destHostId);
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithNoVolumes() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Collections.emptyList());
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, never()).setClvmLockHostId(anyLong(), anyLong());
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithNullPoolId() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+
+        VolumeVO volumeWithoutPool = mock(VolumeVO.class);
+        when(volumeWithoutPool.getPoolId()).thenReturn(null);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(volumeWithoutPool));
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(storagePoolDaoMock, never()).findById(anyLong());
+        verify(clvmPoolManagerMock, never()).setClvmLockHostId(anyLong(), anyLong());
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_WithNullPool() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+        long poolId = 10L;
+
+        VolumeVO volume = mock(VolumeVO.class);
+        when(volume.getPoolId()).thenReturn(poolId);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(volume));
+        when(storagePoolDaoMock.findById(poolId)).thenReturn(null);
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, never()).setClvmLockHostId(anyLong(), anyLong());
+    }
+
+    @Test
+    public void testUpdateClvmLockHostForVmVolumes_MultipleClvmPools() throws Exception {
+        long vmId = 100L;
+        long destHostId = 2L;
+        long pool1Id = 10L;
+        long pool2Id = 20L;
+
+        VolumeVO volume1 = mock(VolumeVO.class);
+        VolumeVO volume2 = mock(VolumeVO.class);
+        VolumeVO volume3 = mock(VolumeVO.class);
+
+        when(volume1.getId()).thenReturn(1L);
+        when(volume1.getPoolId()).thenReturn(pool1Id);
+        when(volume2.getId()).thenReturn(2L);
+        when(volume2.getPoolId()).thenReturn(pool2Id);
+        when(volume3.getId()).thenReturn(3L);
+        when(volume3.getPoolId()).thenReturn(pool1Id);
+
+        StoragePoolVO clvmPool1 = mock(StoragePoolVO.class);
+        when(clvmPool1.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        StoragePoolVO clvmPool2 = mock(StoragePoolVO.class);
+        when(clvmPool2.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        when(volumeDaoMock.findByInstance(vmId)).thenReturn(Arrays.asList(volume1, volume2, volume3));
+        when(storagePoolDaoMock.findById(pool1Id)).thenReturn(clvmPool1);
+        when(storagePoolDaoMock.findById(pool2Id)).thenReturn(clvmPool2);
+
+        ClvmPoolManager clvmPoolManagerMock = injectMockedClvmPoolManager();
+
+        Method method = getUpdateClvmLockHostForVmVolumesMethod();
+        method.invoke(virtualMachineManagerImpl, vmId, destHostId);
+
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(1L, destHostId);
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(2L, destHostId);
+        verify(clvmPoolManagerMock, times(1)).setClvmLockHostId(3L, destHostId);
+    }
+
 }
diff --git a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
index b4a26c17e2e5..a184b4540a96 100644
--- a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
+++ b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
@@ -16,6 +16,8 @@
 // under the License.
 package org.apache.cloudstack.engine.orchestration;
 
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -30,6 +32,7 @@
 import com.cloud.host.HostVO;
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.offering.DiskOffering;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.Storage;
@@ -42,6 +45,7 @@
 import com.cloud.uservm.UserVm;
 import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.utils.Pair;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
@@ -67,6 +71,7 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentMatchers;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockedConstruction;
@@ -640,4 +645,305 @@ public void getVolumeCheckpointPathsAndImageStoreUrlsTestReturnCheckpointIfKVMAn
         Assert.assertEquals(1, result.second().size());
     }
 
+    @Test
+    public void testTransferClvmLocksForVmStart_WithClvmVolumes() throws Exception {
+        Long destHostId = 2L;
+        Long currentHostId = 1L;
+        Long poolId = 10L;
+
+        VolumeVO clvmVolume1 = Mockito.mock(VolumeVO.class);
+        VolumeVO clvmVolume2 = Mockito.mock(VolumeVO.class);
+
+        Mockito.when(clvmVolume1.getId()).thenReturn(101L);
+        Mockito.when(clvmVolume1.getPoolId()).thenReturn(poolId);
+        Mockito.when(clvmVolume1.getUuid()).thenReturn("vol-uuid-1");
+        Mockito.when(clvmVolume1.getPath()).thenReturn("vol-path-1");
+
+        Mockito.when(clvmVolume2.getId()).thenReturn(102L);
+        Mockito.when(clvmVolume2.getPoolId()).thenReturn(poolId);
+        Mockito.when(clvmVolume2.getUuid()).thenReturn("vol-uuid-2");
+        Mockito.when(clvmVolume2.getPath()).thenReturn("vol-path-2");
+
+        StoragePoolVO clvmPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+        Mockito.when(vmInstance.getInstanceName()).thenReturn(MOCK_VM_NAME);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(101L), Mockito.anyString(),
+                Mockito.anyString(), Mockito.any(), Mockito.eq(true))).thenReturn(currentHostId);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(102L), Mockito.anyString(),
+                Mockito.anyString(), Mockito.any(), Mockito.eq(true))).thenReturn(currentHostId);
+        Mockito.when(clvmPoolManager.transferClvmVolumeLock(Mockito.anyString(), Mockito.anyLong(),
+            Mockito.anyString(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong())).thenReturn(true);
+
+        Mockito.when(storagePoolDao.findById(poolId)).thenReturn(clvmPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(clvmVolume1, clvmVolume2), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.times(1)).transferClvmVolumeLock(
+            Mockito.eq("vol-uuid-1"), Mockito.eq(101L), Mockito.eq("vol-path-1"),
+            Mockito.eq(clvmPool), Mockito.eq(currentHostId), Mockito.eq(destHostId));
+        Mockito.verify(clvmPoolManager, Mockito.times(1)).transferClvmVolumeLock(
+            Mockito.eq("vol-uuid-2"), Mockito.eq(102L), Mockito.eq("vol-path-2"),
+            Mockito.eq(clvmPool), Mockito.eq(currentHostId), Mockito.eq(destHostId));
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_WithNonClvmVolumes() throws Exception {
+        Long destHostId = 2L;
+        Long poolId = 10L;
+
+        VolumeVO nfsVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(nfsVolume.getPoolId()).thenReturn(poolId);
+
+        StoragePoolVO nfsPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(nfsPool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+
+        Mockito.when(storagePoolDao.findById(poolId)).thenReturn(nfsPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(nfsVolume), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.never()).transferClvmVolumeLock(
+            Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+            Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_NoLockTransferNeeded() throws Exception {
+        Long destHostId = 2L;
+        Long poolId = 10L;
+
+        VolumeVO clvmVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(clvmVolume.getId()).thenReturn(101L);
+        Mockito.when(clvmVolume.getPoolId()).thenReturn(poolId);
+
+        StoragePoolVO clvmPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(101L), ArgumentMatchers.nullable(String.class),
+                ArgumentMatchers.nullable(String.class), Mockito.any(), Mockito.eq(true))).thenReturn(destHostId);
+
+        Mockito.when(storagePoolDao.findById(poolId)).thenReturn(clvmPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        java.lang.reflect.Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(clvmVolume), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.never()).transferClvmVolumeLock(
+            Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+            Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_EmptyVolumeList() throws Exception {
+        Long destHostId = 2L;
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, new ArrayList<VolumeVO>(), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.never()).getClvmLockHostId(Mockito.anyLong(), Mockito.anyString(),
+                Mockito.anyString(), Mockito.any(), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_NullPoolId() throws Exception {
+        Long destHostId = 2L;
+
+        VolumeVO volumeWithoutPool = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeWithoutPool.getPoolId()).thenReturn(null);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(volumeWithoutPool), destHostId, vmInstance);
+
+        Mockito.verify(storagePoolDao, Mockito.never()).findById(Mockito.anyLong());
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_SetInitialLockHost() throws Exception {
+        Long destHostId = 2L;
+        Long poolId = 10L;
+
+        VolumeVO clvmVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(clvmVolume.getId()).thenReturn(101L);
+        Mockito.when(clvmVolume.getPoolId()).thenReturn(poolId);
+
+        StoragePoolVO clvmPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(101L), ArgumentMatchers.nullable(String.class),
+                ArgumentMatchers.nullable(String.class), Mockito.any(), Mockito.eq(true))).thenReturn(null);
+
+        Mockito.when(storagePoolDao.findById(poolId)).thenReturn(clvmPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(clvmVolume), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.times(1)).setClvmLockHostId(101L, destHostId);
+        Mockito.verify(clvmPoolManager, Mockito.never()).transferClvmVolumeLock(
+            Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+            Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
+    }
+
+    @Test
+    public void testTransferClvmLocksForVmStart_MixedVolumes() throws Exception {
+        Long destHostId = 2L;
+        Long currentHostId = 1L;
+        Long clvmPoolId = 10L;
+        Long nfsPoolId = 20L;
+
+        VolumeVO clvmVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(clvmVolume.getId()).thenReturn(101L);
+        Mockito.when(clvmVolume.getPoolId()).thenReturn(clvmPoolId);
+        Mockito.when(clvmVolume.getUuid()).thenReturn("clvm-vol-uuid");
+        Mockito.when(clvmVolume.getPath()).thenReturn("clvm-vol-path");
+
+        VolumeVO nfsVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(nfsVolume.getPoolId()).thenReturn(nfsPoolId);
+
+        StoragePoolVO clvmPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        StoragePoolVO nfsPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(nfsPool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+        Mockito.when(vmInstance.getInstanceName()).thenReturn(MOCK_VM_NAME);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(101L), Mockito.anyString(),
+                Mockito.anyString(), Mockito.any(), Mockito.eq(true))).thenReturn(currentHostId);
+        Mockito.when(clvmPoolManager.transferClvmVolumeLock(Mockito.anyString(), Mockito.anyLong(),
+            Mockito.anyString(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong())).thenReturn(true);
+
+        Mockito.when(storagePoolDao.findById(clvmPoolId)).thenReturn(clvmPool);
+        Mockito.when(storagePoolDao.findById(nfsPoolId)).thenReturn(nfsPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        method.invoke(volumeOrchestrator, List.of(clvmVolume, nfsVolume), destHostId, vmInstance);
+
+        Mockito.verify(clvmPoolManager, Mockito.times(1)).transferClvmVolumeLock(
+            Mockito.eq("clvm-vol-uuid"), Mockito.eq(101L), Mockito.eq("clvm-vol-path"),
+            Mockito.eq(clvmPool), Mockito.eq(currentHostId), Mockito.eq(destHostId));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testTransferClvmLocksForVmStart_TransferFails() throws Throwable {
+        Long destHostId = 2L;
+        Long currentHostId = 1L;
+        Long poolId = 10L;
+
+        VolumeVO clvmVolume = Mockito.mock(VolumeVO.class);
+        Mockito.when(clvmVolume.getId()).thenReturn(101L);
+        Mockito.when(clvmVolume.getPoolId()).thenReturn(poolId);
+        Mockito.when(clvmVolume.getUuid()).thenReturn("vol-uuid");
+        Mockito.when(clvmVolume.getPath()).thenReturn("vol-path");
+
+        StoragePoolVO clvmPool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(clvmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        VMInstanceVO vmInstance = Mockito.mock(VMInstanceVO.class);
+        Mockito.when(vmInstance.getInstanceName()).thenReturn(MOCK_VM_NAME);
+
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(101L), Mockito.anyString(),
+                Mockito.anyString(), Mockito.any(), Mockito.eq(true))).thenReturn(currentHostId);
+        Mockito.when(clvmPoolManager.transferClvmVolumeLock(Mockito.anyString(), Mockito.anyLong(),
+            Mockito.anyString(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong())).thenReturn(false);
+
+        Mockito.when(storagePoolDao.findById(poolId)).thenReturn(clvmPool);
+
+        setField(volumeOrchestrator, "clvmPoolManager", clvmPoolManager);
+        setField(volumeOrchestrator, "_storagePoolDao", storagePoolDao);
+
+        Method method = VolumeOrchestrator.class.getDeclaredMethod(
+            "transferClvmLocksForVmStart", List.class, Long.class, VMInstanceVO.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(volumeOrchestrator, List.of(clvmVolume), destHostId, vmInstance);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    private void setField(Object target, String fieldName, Object value) throws Exception {
+        Field field = findField(target.getClass(), fieldName);
+        if (field == null) {
+            throw new NoSuchFieldException("Field " + fieldName + " not found in " + target.getClass());
+        }
+        field.setAccessible(true);
+        field.set(target, value);
+    }
+
+    private Field findField(Class<?> clazz, String fieldName) {
+        Class<?> current = clazz;
+        while (current != null && current != Object.class) {
+            try {
+                return current.getDeclaredField(fieldName);
+            } catch (NoSuchFieldException e) {
+                current = current.getSuperclass();
+            }
+        }
+        return null;
+    }
+
 }
diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
index 6cfd2608f5de..3d04f6679def 100644
--- a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
+++ b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
@@ -23,6 +23,7 @@
 import com.cloud.dc.ClusterVO;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface ClusterDao extends GenericDao<ClusterVO, Long> {
@@ -61,4 +62,6 @@ public interface ClusterDao extends GenericDao<ClusterVO, Long> {
     List<String> listDistinctStorageAccessGroups(String name, String keyword);
 
     List<Long> listEnabledClusterIdsByZoneHypervisorArch(Long zoneId, HypervisorType hypervisorType, CPU.CPUArch arch);
+
+    List<ClusterVO> listByZonesAndHypervisorType(List<Long> zoneIds, HypervisorType hypervisorType, Filter filter);
 }
diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
index c63af0a237ba..9b6f0f7ac3a6 100644
--- a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
@@ -20,6 +20,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -27,6 +28,7 @@
 
 import javax.inject.Inject;
 
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.cpu.CPU;
@@ -38,6 +40,7 @@
 import com.cloud.org.Grouping;
 import com.cloud.org.Managed;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.GenericSearchBuilder;
 import com.cloud.utils.db.JoinBuilder;
@@ -413,4 +416,19 @@ public List<Long> listEnabledClusterIdsByZoneHypervisorArch(Long zoneId, Hypervi
         }
         return customSearch(sc, null);
     }
+
+    @Override
+    public List<ClusterVO> listByZonesAndHypervisorType(List<Long> zoneIds, HypervisorType hypervisorType, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<ClusterVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        sb.done();
+        SearchCriteria<ClusterVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("hypervisorType", hypervisorType.toString());
+        return listBy(sc, filter);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/host/HostVO.java b/engine/schema/src/main/java/com/cloud/host/HostVO.java
index d51b4eca0577..468caf1e2271 100644
--- a/engine/schema/src/main/java/com/cloud/host/HostVO.java
+++ b/engine/schema/src/main/java/com/cloud/host/HostVO.java
@@ -45,7 +45,7 @@
 import com.cloud.cpu.CPU;
 import org.apache.cloudstack.util.CPUArchConverter;
 import org.apache.cloudstack.util.HypervisorTypeConverter;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang.BooleanUtils;
@@ -856,7 +856,8 @@ public boolean checkHostServiceOfferingTags(ServiceOffering serviceOffering) {
         }
 
         if (BooleanUtils.isTrue(this.getIsTagARule())) {
-            return TagAsRuleHelper.interpretTagAsRule(this.getHostTags().get(0), serviceOffering.getHostTag(), HostTagsDao.hostTagRuleExecutionTimeout.value());
+            return GenericRuleHelper.interpretTagAsRule(this.getHostTags().get(0), serviceOffering.getHostTag(), HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                    HostTagsDao.hostTagRuleExecutionTimeout.key());
         }
 
         if (StringUtils.isEmpty(serviceOffering.getHostTag())) {
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
index 5f5b2affee08..5c0d04fb2be8 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
@@ -32,12 +32,17 @@
 import com.cloud.utils.db.GenericDao;
 import com.cloud.utils.fsm.StateDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
 /**
  * Data Access Object for server
  *
  */
 public interface HostDao extends GenericDao<HostVO, Long>, StateDao<Status, Status.Event, Host> {
+
+    ConfigKey<Long> guestOsRuleExecutionTimeout = new ConfigKey<>("Advanced", Long.class, "guest.os.rule.execution.timeout", "3000", "The maximum runtime, in milliseconds, " +
+            "to execute a guest OS rule; if it is reached, a timeout will happen.", true);
+
     long countBy(long clusterId, ResourceState... states);
 
     Integer countAllByType(final Host.Type type);
@@ -220,6 +225,8 @@ int countHostsByMsResourceStateTypeAndHypervisorType(long msId, List<ResourceSta
 
     List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags);
 
+    List<HostVO> findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(String templateGuestOSName);
+
     List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags);
 
     List<Long> listSsvmHostsWithPendingMigrateJobsOrderedByJobCount();
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
index 99c9a979c3bf..cd4423dfa269 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
@@ -37,7 +37,9 @@
 
 import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.commons.collections.CollectionUtils;
 
 import com.cloud.agent.api.VgpuTypesInfo;
@@ -84,7 +86,7 @@
 
 @DB
 @TableGenerator(name = "host_req_sq", table = "op_host", pkColumnName = "id", valueColumnName = "sequence", allocationSize = 1)
-public class HostDaoImpl extends GenericDaoBase<HostVO, Long> implements HostDao { //FIXME: , ExternalIdDao {
+public class HostDaoImpl extends GenericDaoBase<HostVO, Long> implements HostDao, Configurable {
 
     private static final String LIST_HOST_IDS_BY_HOST_TAGS = "SELECT filtered.host_id, COUNT(filtered.tag) AS tag_count "
                                                              + "FROM (SELECT host_id, tag, is_tag_a_rule FROM host_tags GROUP BY host_id,tag,is_tag_a_rule) AS filtered "
@@ -1520,11 +1522,13 @@ private List<Long> findHostIdsByHostTags(String hostTags){
         }
     }
 
+    @Override
     public List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags) {
         List<HostTagVO> hostTagVOList = _hostTagsDao.findHostRuleTags();
         List<HostVO> result = new ArrayList<>();
         for (HostTagVO rule: hostTagVOList) {
-            if (TagAsRuleHelper.interpretTagAsRule(rule.getTag(), computeOfferingTags, HostTagsDao.hostTagRuleExecutionTimeout.value())) {
+            if (GenericRuleHelper.interpretTagAsRule(rule.getTag(), computeOfferingTags, HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                    HostTagsDao.hostTagRuleExecutionTimeout.key())) {
                 result.add(findById(rule.getHostId()));
             }
         }
@@ -1532,6 +1536,23 @@ public List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String comp
         return result;
     }
 
+    @Override
+    public List<HostVO> findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(String templateGuestOSName) {
+        List<DetailVO> hostIdsWithGuestOsRule = _detailsDao.findByName(Host.GUEST_OS_RULE);
+        List<HostVO> hostsWithIncompatibleRules = new ArrayList<>();
+        for (DetailVO guestOsRule : hostIdsWithGuestOsRule) {
+            if (!GenericRuleHelper.interpretGuestOsRule(guestOsRule.getValue(), templateGuestOSName, HostDao.guestOsRuleExecutionTimeout.value(),
+                    HostDao.guestOsRuleExecutionTimeout.key())) {
+                logger.trace("The guest OS rule [{}] of the host with ID [{}] is incompatible with the OS of the VM.",
+                        guestOsRule.getHostId(), guestOsRule.getValue());
+                hostsWithIncompatibleRules.add(findById(guestOsRule.getHostId()));
+            }
+        }
+        logger.trace("The hosts with the following IDs [{}] are incompatible with the VM considering their guest OS rule.",
+                hostsWithIncompatibleRules);
+        return hostsWithIncompatibleRules;
+    }
+
     public List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags) {
         Set<Long> result = new HashSet<>();
         List<HostVO> hosts = findHostsWithTagRuleThatMatchComputeOfferingTags(computeOfferingTags);
@@ -1984,4 +2005,14 @@ public List<String> listDistinctStorageAccessGroups(String name, String keyword)
 
         return customSearch(sc, null);
     }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey<?>[] {guestOsRuleExecutionTimeout};
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return HostDaoImpl.class.getSimpleName();
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
index fdca6e43f00f..8406f80ed09d 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
@@ -24,6 +24,7 @@
 import com.cloud.network.Network.GuestType;
 import com.cloud.network.Network.State;
 import com.cloud.network.Networks.TrafficType;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.fsm.StateDao;
@@ -96,8 +97,13 @@ public interface NetworkDao extends GenericDao<NetworkVO, Long>, StateDao<State,
 
     boolean update(Long networkId, NetworkVO network, Map<String, String> serviceProviderMap);
 
+    List<NetworkVO> listByZoneAndTrafficType(long zoneId, TrafficType trafficType, Filter filter);
+
     List<NetworkVO> listByZoneAndTrafficType(long zoneId, TrafficType trafficType);
 
+    List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType,
+                                                    List<Long> accountIds, List<Long> domainIds, Filter filter);
+
     void setCheckForGc(long networkId);
 
     int getNetworkCountByNetworkOffId(long networkOfferingId);
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
index 9f7ffabac930..f3ece4879040 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
@@ -19,6 +19,7 @@
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -29,9 +30,9 @@
 import javax.inject.Inject;
 import javax.persistence.TableGenerator;
 
-import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.acl.ControlledEntity.ACLType;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.network.Network;
@@ -63,6 +64,7 @@
 import com.cloud.utils.db.SearchCriteria.Op;
 import com.cloud.utils.db.SequenceFetcher;
 import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.net.NetUtils;
 
 @Component
@@ -632,12 +634,46 @@ public List<NetworkVO> listBy(final long accountId, final long dataCenterId, fin
     }
 
     @Override
-    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType, Filter filter) {
         final SearchCriteria<NetworkVO> sc = AllFieldsSearch.create();
         sc.setParameters("datacenter", zoneId);
         sc.setParameters("trafficType", trafficType);
 
-        return listBy(sc, null);
+        return listBy(sc, filter);
+    }
+
+    @Override
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
+        return listByZoneAndTrafficType(zoneId, trafficType, null);
+    }
+
+    @Override
+    public List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType,
+                                                           List<Long> accountIds, List<Long> domainIds, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<NetworkVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("trafficType", sb.entity().getTrafficType(), Op.EQ);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<NetworkVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("trafficType", trafficType);
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+        return listBy(sc, filter);
     }
 
     @Override
diff --git a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
index 793334731095..2b18bcbd87bd 100644
--- a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
@@ -31,4 +31,6 @@ public interface SecurityGroupDao extends GenericDao<SecurityGroupVO, Long> {
     List<SecurityGroupVO> findByAccountAndNames(Long accountId, String... names);
 
     int removeByAccountId(long accountId);
+
+    List<SecurityGroupVO> listByIds(List<Long> ids);
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
index 019cf5fec462..ffb45629b625 100644
--- a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
@@ -129,4 +129,14 @@ public boolean expunge(Long id) {
         txn.commit();
         return result;
     }
+
+    @Override
+    public List<SecurityGroupVO> listByIds(List<Long> ids) {
+        SearchBuilder<SecurityGroupVO> idsSearch = createSearchBuilder();
+        idsSearch.and("ids", idsSearch.entity().getId(), SearchCriteria.Op.IN);
+        idsSearch.done();
+        SearchCriteria<SecurityGroupVO> sc = idsSearch.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
index 9beea0037444..ea97f663768f 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
@@ -30,7 +30,7 @@ public interface DiskOfferingDao extends GenericDao<DiskOfferingVO, Long> {
 
     List<DiskOfferingVO> listAllBySizeAndProvisioningType(long size, Storage.ProvisioningType provisioningType);
 
-    List<DiskOfferingVO> findCustomDiskOfferings();
+    List<DiskOfferingVO> listCustomDiskOfferings();
 
     List<DiskOfferingVO> listByStorageTag(String tag);
 
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
index 4ca3fe9f12ac..44e6551da17d 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
@@ -16,6 +16,8 @@
 // under the License.
 package com.cloud.storage.dao;
 
+import static org.apache.cloudstack.query.QueryService.SortKeyAscending;
+
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -33,6 +35,7 @@
 import com.cloud.storage.DiskOfferingVO;
 import com.cloud.storage.Storage;
 import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -138,13 +141,14 @@ public List<DiskOfferingVO> listAllBySizeAndProvisioningType(long size, Storage.
     }
 
     @Override
-    public List<DiskOfferingVO> findCustomDiskOfferings() {
+    public List<DiskOfferingVO> listCustomDiskOfferings() {
         SearchBuilder<DiskOfferingVO> sb = createSearchBuilder();
         sb.and("customized", sb.entity().isCustomized(), SearchCriteria.Op.EQ);
         sb.done();
         SearchCriteria<DiskOfferingVO> sc = sb.create();
         sc.setParameters("customized", true);
-        return listBy(sc);
+        Filter searchFilter = new Filter(DiskOfferingVO.class, "sortKey", SortKeyAscending.value());
+        return listBy(sc, searchFilter);
     }
 
     @Override
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
index 4c9f906b68a9..aec06d6d0003 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
@@ -106,4 +106,6 @@ public interface VMTemplateDao extends GenericDao<VMTemplateVO, Long>, StateDao<
 
     VMTemplateVO findActiveSystemTemplateByHypervisorArchAndUrlPath(HypervisorType hypervisorType,
                 CPU.CPUArch arch, String urlPathSuffix);
+
+    VMTemplateVO findByAccountAndName(Long accountId, String templateName);
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
index 9b5d0edc599d..8c6e3fe0983f 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
@@ -945,4 +945,12 @@ public boolean updateState(
         }
         return rows > 0;
     }
+
+    @Override
+    public VMTemplateVO findByAccountAndName(Long accountId, String templateName) {
+        SearchCriteria<VMTemplateVO> sc = NameAccountIdSearch.create();
+        sc.setParameters("name", templateName);
+        sc.setParameters("accountId", accountId);
+        return findOneBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
index 717e3e782f2f..7d566a1ea01e 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
@@ -46,6 +46,8 @@ public interface VolumeDao extends GenericDao<VolumeVO, Long>, StateDao<Volume.S
 
     List<VolumeVO> findByInstanceAndType(long id, Volume.Type vType);
 
+    List<VolumeVO> findByInstanceAndNotStates(long id, Volume.State...states);
+
     List<VolumeVO> findIncludingRemovedByInstanceAndType(long id, Volume.Type vType);
 
     List<VolumeVO> findNonDestroyedVolumesByInstanceIdAndPoolId(long instanceId, long poolId);
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
index fce4d1f7233d..91f1c7f5eb69 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
@@ -208,6 +208,17 @@ public List<VolumeVO> findByInstanceAndType(long id, Type vType) {
         return listBy(sc);
     }
 
+    @Override
+    public List<VolumeVO> findByInstanceAndNotStates(long id, Volume.State...states) {
+        SearchBuilder<VolumeVO> sb = createSearchBuilder();
+        sb.and("instanceId", sb.entity().getInstanceId(), Op.EQ);
+        sb.and("state", sb.entity().getState(), Op.NIN);
+        SearchCriteria<VolumeVO> sc = sb.create();
+        sc.setParameters("instanceId", id);
+        sc.setParameters("state", (Object[]) states);
+        return listBy(sc);
+    }
+
     @Override
     public List<VolumeVO> findIncludingRemovedByInstanceAndType(long id, Type vType) {
         SearchCriteria<VolumeVO> sc = AllFieldsSearch.create();
diff --git a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
index bacb09b98793..5efaea40a943 100644
--- a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
+++ b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
@@ -20,11 +20,13 @@
 import java.util.Map;
 import java.util.Set;
 
+import org.apache.cloudstack.api.response.ResourceTagResponse;
+
 import com.cloud.server.ResourceTag;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.tags.ResourceTagVO;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
-import org.apache.cloudstack.api.response.ResourceTagResponse;
 
 public interface ResourceTagDao extends GenericDao<ResourceTagVO, Long> {
 
@@ -60,4 +62,13 @@ public interface ResourceTagDao extends GenericDao<ResourceTagVO, Long> {
     void removeByResourceIdAndKey(long resourceId, ResourceObjectType resourceType, String key);
 
     List<? extends ResourceTag> listByResourceUuid(String resourceUuid);
+
+    List<String> listByResourceTypeKeyPrefixAndOwners(ResourceObjectType resourceType, String key,
+                                                      List<Long> accountIds, List<Long> domainIds,
+                                                      Filter filter);
+
+    ResourceTagVO findByResourceTypeKeyPrefixAndValue(ResourceObjectType resourceType, String key, String value);
+
+    List<ResourceTagVO> listByResourceTypeIdAndKeyPrefix(ResourceObjectType resourceType, long resourceId, String key);
+
 }
diff --git a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
index cc9d99e6ab16..22c7b7b2ee5b 100644
--- a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
@@ -16,19 +16,22 @@
 // under the License.
 package com.cloud.tags.dao;
 
-import java.util.List;
-import java.util.Set;
-import java.util.Map;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 import org.apache.cloudstack.api.response.ResourceTagResponse;
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.server.ResourceTag;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.tags.ResourceTagVO;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.GenericSearchBuilder;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.SearchCriteria.Op;
@@ -120,4 +123,62 @@ public List<? extends ResourceTag> listByResourceUuid(String resourceUuid) {
         sc.setParameters("resourceUuid", resourceUuid);
         return listBy(sc);
     }
+
+    @Override
+    public List<String> listByResourceTypeKeyPrefixAndOwners(ResourceObjectType resourceType, String key,
+                                                             List<Long> accountIds, List<Long> domainIds,
+                                                             Filter filter) {
+        GenericSearchBuilder<ResourceTagVO, String> sb = createSearchBuilder(String.class);
+        sb.select(null, SearchCriteria.Func.DISTINCT, sb.entity().getValue());
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<String> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("key", key + "%");
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+        return customSearch(sc, filter);
+    }
+
+    @Override
+    public ResourceTagVO findByResourceTypeKeyPrefixAndValue(ResourceObjectType resourceType, String key,
+                                                             String value) {
+        SearchBuilder<ResourceTagVO> sb = createSearchBuilder();
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        sb.and("value", sb.entity().getValue(), Op.EQ);
+        sb.done();
+        final SearchCriteria<ResourceTagVO> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("key", key + "%");
+        sc.setParameters("value", value);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public List<ResourceTagVO> listByResourceTypeIdAndKeyPrefix(ResourceObjectType resourceType, long resourceId,
+                                                                String key) {
+        SearchBuilder<ResourceTagVO> sb = createSearchBuilder();
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("resourceId", sb.entity().getResourceId(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        sb.done();
+        final SearchCriteria<ResourceTagVO> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("resourceId", resourceId);
+        sc.setParameters("key", key + "%");
+        return listBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
index 96a1b6e3bd16..7767b7512b91 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
@@ -26,6 +26,8 @@
 public interface NicDao extends GenericDao<NicVO, Long> {
     List<NicVO> listByVmId(long instanceId);
 
+    int countByVmId(long instanceId);
+
     List<NicVO> listByVmIdOrderByDeviceId(long instanceId);
 
     List<String> listIpAddressInNetwork(long networkConfigId);
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
index 78966a09e97c..6202dabf730e 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
@@ -126,6 +126,13 @@ public List<NicVO> listByVmId(long instanceId) {
         return listBy(sc);
     }
 
+    @Override
+    public int countByVmId(long instanceId) {
+        SearchCriteria<NicVO> sc = AllFieldsSearch.create();
+        sc.setParameters("instance", instanceId);
+        return getCount(sc);
+    }
+
     @Override
     public List<NicVO> listByVmIdOrderByDeviceId(long instanceId) {
         SearchCriteria<NicVO> sc = AllFieldsSearch.create();
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicSecondaryIpVO.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicSecondaryIpVO.java
index 4c8208b4be84..baa331d81f67 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicSecondaryIpVO.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicSecondaryIpVO.java
@@ -43,7 +43,7 @@ public NicSecondaryIpVO(long nicId, String ipaddr, long vmId, long accountId, lo
         this.networkId = networkId;
     }
 
-    public NicSecondaryIpVO(long nicId, String ip4Address, String ip6Address, long vmId, long accountId, long domainId, long networkId) {
+    public NicSecondaryIpVO(long nicId, String ip4Address, String ip6Address, long vmId, long accountId, long domainId, long networkId, String description) {
         this.nicId = nicId;
         this.vmId = vmId;
         this.ip4Address = ip4Address;
@@ -51,6 +51,7 @@ public NicSecondaryIpVO(long nicId, String ip4Address, String ip6Address, long v
         this.accountId = accountId;
         this.domainId = domainId;
         this.networkId = networkId;
+        this.description = description;
     }
 
     protected NicSecondaryIpVO() {
@@ -88,6 +89,18 @@ protected NicSecondaryIpVO() {
     @Column(name = "vmId")
     long vmId;
 
+    @Column(name = "description")
+    String description;
+
+    @Override
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
     @Override
     public String toString() {
         return String.format("NicSecondaryIp %s",
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
index 4fd3e729e0d2..1a5b8cedd9ea 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
@@ -197,4 +197,6 @@ List<VMInstanceVO> searchRemovedByRemoveDate(final Date startDate, final Date en
     List<VMInstanceVO> listDeleteProtectedVmsByAccountId(long accountId);
 
     List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds);
+
+    List<Long> listIdsByHostIdForVolumeStats(long hostIds);
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
index 019d152ce5c3..ae1e838649ba 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
@@ -1336,4 +1336,20 @@ public List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds)
         Filter filter = new Filter(VMInstanceVO.class, null, false, 0L, 10L);
         return listBy(sc, filter);
     }
+
+    @Override
+    public List<Long> listIdsByHostIdForVolumeStats(long hostId) {
+        GenericSearchBuilder<VMInstanceVO, Long> sb = createSearchBuilder(Long.class);
+        sb.selectFields(sb.entity().getId());
+        sb.and().op("host", sb.entity().getHostId(), SearchCriteria.Op.EQ);
+        sb.or().op("hostNull", sb.entity().getHostId(), Op.NULL);
+        sb.and("lastHost", sb.entity().getLastHostId(), SearchCriteria.Op.EQ);
+        sb.cp();
+        sb.cp();
+        sb.done();
+        SearchCriteria<Long> sc = sb.create();
+        sc.setParameters("host", hostId);
+        sc.setParameters("lastHost", hostId);
+        return customSearch(sc, null);
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/acl/ApiKeyPairVO.java b/engine/schema/src/main/java/org/apache/cloudstack/acl/ApiKeyPairVO.java
index eb38b08f6151..7a6bd7a3b140 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/acl/ApiKeyPairVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/acl/ApiKeyPairVO.java
@@ -70,7 +70,7 @@ public class ApiKeyPairVO implements ApiKeyPair {
     @Temporal(value = TemporalType.TIMESTAMP)
     private Date created = Date.from(Instant.now());
 
-    @Column(name = "description")
+    @Column(name = "description", length = 1024)
     private String description = "";
 
     @Column(name = "api_key", nullable = false)
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
index 0f8a10fb7be6..d589f9e6bef8 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
@@ -103,6 +103,18 @@ public class BackupVO implements Backup {
     @Column(name = "backup_schedule_id")
     private Long backupScheduleId;
 
+    @Column(name = "from_checkpoint_id")
+    private String fromCheckpointId;
+
+    @Column(name = "to_checkpoint_id")
+    private String toCheckpointId;
+
+    @Column(name = "checkpoint_create_time")
+    private Long checkpointCreateTime;
+
+    @Column(name = "host_id")
+    private Long hostId;
+
     @Transient
     Map<String, String> details;
 
@@ -288,4 +300,40 @@ public Long getBackupScheduleId() {
     public void setBackupScheduleId(Long backupScheduleId) {
         this.backupScheduleId = backupScheduleId;
     }
+
+    @Override
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    @Override
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    @Override
+    public Long getCheckpointCreateTime() {
+        return checkpointCreateTime;
+    }
+
+    public void setCheckpointCreateTime(Long checkpointCreateTime) {
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+
+    @Override
+    public Long getHostId() {
+        return hostId;
+    }
+
+    public void setHostId(Long hostId) {
+        this.hostId = hostId;
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java
new file mode 100644
index 000000000000..ec9b927b63e4
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java
@@ -0,0 +1,242 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+
+@Entity
+@Table(name = "image_transfer")
+public class ImageTransferVO implements ImageTransfer {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "backup_id")
+    private Long backupId;
+
+    @Column(name = "volume_id")
+    private long volumeId;
+
+    @Column(name = "host_id")
+    private long hostId;
+
+    @Column(name = "socket")
+    private String socket;
+
+    @Column(name = "file")
+    private String file;
+
+    @Column(name = "transfer_url")
+    private String transferUrl;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "phase")
+    private Phase phase;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "direction")
+    private Direction direction;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "backend")
+    private Backend backend;
+
+    @Column(name = "signed_ticket_id")
+    private String signedTicketId;
+
+    @Column(name = "account_id")
+    Long accountId;
+
+    @Column(name = "domain_id")
+    Long domainId;
+
+    @Column(name = "data_center_id")
+    Long dataCenterId;
+
+    @Column(name = "created")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date created;
+
+    @Column(name = "updated")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date updated;
+
+    @Column(name = "removed")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    public ImageTransferVO() {
+    }
+
+    private ImageTransferVO(String uuid, long volumeId, long hostId, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this.uuid = uuid;
+        this.volumeId = volumeId;
+        this.hostId = hostId;
+        this.phase = phase;
+        this.direction = direction;
+        this.accountId = accountId;
+        this.domainId = domainId;
+        this.dataCenterId = dataCenterId;
+        this.created = new Date();
+    }
+
+    public ImageTransferVO(String uuid, Long backupId, long volumeId, long hostId, String socket, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this(uuid, volumeId, hostId, phase, direction, accountId, domainId, dataCenterId);
+        this.backupId = backupId;
+        this.socket = socket;
+        this.backend = Backend.nbd;
+    }
+
+    public ImageTransferVO(String uuid, long volumeId, long hostId, String file, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this(uuid, volumeId, hostId, phase, direction, accountId, domainId, dataCenterId);
+        this.file = file;
+        this.backend = Backend.file;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    public void setBackupId(long backupId) {
+        this.backupId = backupId;
+    }
+
+    @Override
+    public long getVolumeId() {
+        return volumeId;
+    }
+
+    public void setVolumeId(long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    @Override
+    public long getHostId() {
+        return hostId;
+    }
+
+    public void setHostId(long hostId) {
+        this.hostId = hostId;
+    }
+
+    public void setSocket(String socket) {
+        this.socket = socket;
+    }
+
+    @Override
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    @Override
+    public Phase getPhase() {
+        return phase;
+    }
+
+    public void setPhase(Phase phase) {
+        this.phase = phase;
+        this.updated = new Date();
+    }
+
+    @Override
+    public Direction getDirection() {
+        return direction;
+    }
+
+    public void setDirection(Direction direction) {
+        this.direction = direction;
+    }
+
+    @Override
+    public Backend getBackend() {
+        return backend;
+    }
+
+    @Override
+    public String getSignedTicketId() {
+        return signedTicketId;
+    }
+
+    public void setSignedTicketId(String signedTicketId) {
+        this.signedTicketId = signedTicketId;
+    }
+
+    @Override
+    public Class<?> getEntityType() {
+        return ImageTransfer.class;
+    }
+
+    @Override
+    public String getName() {
+        return null;
+    }
+
+    @Override
+    public long getDomainId() {
+        return domainId;
+    }
+
+    @Override
+    public long getAccountId() {
+        return accountId;
+    }
+
+    @Override
+    public long getDataCenterId() {
+        return dataCenterId;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getUpdated() {
+        return updated;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java
new file mode 100644
index 000000000000..9a9fbeb8814e
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java
@@ -0,0 +1,36 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup.dao;
+
+import java.util.List;
+
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.ImageTransferVO;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDao;
+
+public interface ImageTransferDao extends GenericDao<ImageTransferVO, Long> {
+    List<ImageTransferVO> listByBackupId(Long backupId);
+    ImageTransferVO findByUuid(String uuid);
+    ImageTransferVO findByVolume(Long volumeId);
+    ImageTransferVO findUnfinishedByVolume(Long volumeId);
+    List<ImageTransferVO> listByPhaseAndDirection(ImageTransfer.Phase phase, ImageTransfer.Direction direction);
+    List<ImageTransferVO> listByZonesAndOwners(List<Long> zoneIds, List<Long> accountIds, List<Long> domainIds,
+                                               Filter filter);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java
new file mode 100644
index 000000000000..2e36f924e4ef
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java
@@ -0,0 +1,136 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup.dao;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.PostConstruct;
+
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class ImageTransferDaoImpl extends GenericDaoBase<ImageTransferVO, Long> implements ImageTransferDao {
+
+    private SearchBuilder<ImageTransferVO> backupIdSearch;
+    private SearchBuilder<ImageTransferVO> uuidSearch;
+    private SearchBuilder<ImageTransferVO> volumeSearch;
+    private SearchBuilder<ImageTransferVO> volumeUnfinishedSearch;
+    private SearchBuilder<ImageTransferVO> phaseDirectionSearch;
+
+    public ImageTransferDaoImpl() {
+    }
+
+    @PostConstruct
+    protected void init() {
+        backupIdSearch = createSearchBuilder();
+        backupIdSearch.and("backupId", backupIdSearch.entity().getBackupId(), SearchCriteria.Op.EQ);
+        backupIdSearch.done();
+
+        uuidSearch = createSearchBuilder();
+        uuidSearch.and("uuid", uuidSearch.entity().getUuid(), SearchCriteria.Op.EQ);
+        uuidSearch.done();
+
+        volumeSearch = createSearchBuilder();
+        volumeSearch.and("volumeId", volumeSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        volumeSearch.done();
+
+        volumeUnfinishedSearch = createSearchBuilder();
+        volumeUnfinishedSearch.and("volumeId", volumeUnfinishedSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        volumeUnfinishedSearch.and("phase", volumeUnfinishedSearch.entity().getPhase(), SearchCriteria.Op.NEQ);
+        volumeUnfinishedSearch.done();
+
+        phaseDirectionSearch = createSearchBuilder();
+        phaseDirectionSearch.and("phase", phaseDirectionSearch.entity().getPhase(), SearchCriteria.Op.EQ);
+        phaseDirectionSearch.and("direction", phaseDirectionSearch.entity().getDirection(), SearchCriteria.Op.EQ);
+        phaseDirectionSearch.done();
+    }
+
+    @Override
+    public List<ImageTransferVO> listByBackupId(Long backupId) {
+        SearchCriteria<ImageTransferVO> sc = backupIdSearch.create();
+        sc.setParameters("backupId", backupId);
+        return listBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findByUuid(String uuid) {
+        SearchCriteria<ImageTransferVO> sc = uuidSearch.create();
+        sc.setParameters("uuid", uuid);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findByVolume(Long volumeId) {
+        SearchCriteria<ImageTransferVO> sc = volumeSearch.create();
+        sc.setParameters("volumeId", volumeId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findUnfinishedByVolume(Long volumeId) {
+        SearchCriteria<ImageTransferVO> sc = volumeUnfinishedSearch.create();
+        sc.setParameters("volumeId", volumeId);
+        sc.setParameters("phase", ImageTransferVO.Phase.finished.toString());
+        return findOneBy(sc);
+    }
+
+    @Override
+    public List<ImageTransferVO> listByPhaseAndDirection(ImageTransfer.Phase phase, ImageTransfer.Direction direction) {
+        SearchCriteria<ImageTransferVO> sc = phaseDirectionSearch.create();
+        sc.setParameters("phase", phase);
+        sc.setParameters("direction", direction);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<ImageTransferVO> listByZonesAndOwners(List<Long> zoneIds, List<Long> accountIds, List<Long> domainIds,
+                                                      Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<ImageTransferVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<ImageTransferVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+
+        return listBy(sc, filter);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
index 4735202a7623..82ba9445b25c 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
@@ -29,4 +29,6 @@ public interface SharedFSDao extends GenericDao<SharedFSVO, Long>, StateDao<Shar
     List<SharedFSVO> listSharedFSToBeDestroyed(Date date);
 
     SharedFSVO findSharedFSByNameAccountDomain(String name, Long accountId, Long domainId);
+
+    SharedFSVO findByVm(long vmId);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
index da6220716715..dd23787f982f 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
@@ -114,4 +114,14 @@ public SharedFSVO findSharedFSByNameAccountDomain(String name, Long accountId, L
         sc.setParameters("domainId", domainId);
         return findOneBy(sc);
     }
+
+    @Override
+    public SharedFSVO findByVm(long vmId) {
+        SearchBuilder<SharedFSVO> sb = createSearchBuilder();
+        sb.and("vmId", sb.entity().getVmId(), SearchCriteria.Op.EQ);
+        sb.done();
+        SearchCriteria<SharedFSVO> sc = sb.create();
+        sc.setParameters("vmId", vmId);
+        return findOneBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
index ad3722577c27..26181d3fce0d 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
@@ -116,6 +116,7 @@
   <bean id="loadBalancerVMMapDaoImpl" class="com.cloud.network.dao.LoadBalancerVMMapDaoImpl" />
   <bean id="loadBalancerCertMapDaoImpl" class="com.cloud.network.dao.LoadBalancerCertMapDaoImpl" />
   <bean id="managementServerHostDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostDaoImpl" />
+  <bean id="managementServerHostDetailsDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostDetailsDaoImpl" />
   <bean id="managementServerHostPeerDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostPeerDaoImpl" />
   <bean id="managementServerHostPeerJoinDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostPeerJoinDaoImpl" />
   <bean id="managementServerStatusDaoImpl" class="com.cloud.cluster.dao.ManagementServerStatusDaoImpl" />
@@ -271,6 +272,7 @@
   <bean id="backupDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDaoImpl" />
   <bean id="backupDetailsDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDetailsDaoImpl" />
   <bean id="backupRepositoryDaoImpl" class="org.apache.cloudstack.backup.dao.BackupRepositoryDaoImpl" />
+  <bean id="imageTransferDaoImpl" class="org.apache.cloudstack.backup.dao.ImageTransferDaoImpl" />
   <bean id="directDownloadCertificateDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateDaoImpl" />
   <bean id="directDownloadCertificateHostMapDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateHostMapDaoImpl" />
   <bean id="routerHealthCheckResultsDaoImpl" class="com.cloud.network.dao.RouterHealthCheckResultDaoImpl" />
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
index 858c46a7c1ee..fbb2fd079f9c 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
@@ -19,7 +19,6 @@
 -- Schema upgrade from 4.21.0.0 to 4.22.0.0
 --;
 
-
 -- health check status as enum
 CALL `cloud`.`IDEMPOTENT_CHANGE_COLUMN`('router_health_check', 'check_result', 'check_result', 'varchar(16) NOT NULL COMMENT "check executions result: SUCCESS, FAILURE, WARNING, UNKNOWN"');
 
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index dfa5fa8f3a14..bd5ecbab21ca 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -73,7 +73,7 @@ CREATE TABLE IF NOT EXISTS `cloud`.`api_keypair` (
     `user_id` bigint(20) unsigned NOT NULL,
     `start_date` datetime,
     `end_date` datetime,
-    `description` varchar(100),
+    `description` varchar(1024),
     `api_key` varchar(255) NOT NULL,
     `secret_key` varchar(255) NOT NULL,
     `created` datetime NOT NULL,
@@ -107,17 +107,25 @@ WHERE user.api_key IS NOT NULL AND user.secret_key IS NOT NULL;
 -- Drop API keys from user table
 ALTER TABLE `cloud`.`user` DROP COLUMN api_key, DROP COLUMN secret_key;
 
--- Grant access to the "deleteUserKeys" API to the "User", "Domain Admin" and "Resource Admin" roles, similarly to the "registerUserKeys" API
+-- Grant access to the "deleteUserKeys" and "listUserKeyRules" APIs to the "User", "Domain Admin" and "Resource Admin" roles, similarly to the "registerUserKeys" API
 CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('User', 'deleteUserKeys', 'ALLOW');
 CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Domain Admin', 'deleteUserKeys', 'ALLOW');
 CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Resource Admin', 'deleteUserKeys', 'ALLOW');
 
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('User', 'listUserKeyRules', 'ALLOW');
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Domain Admin', 'listUserKeyRules', 'ALLOW');
+CALL `cloud`.`IDEMPOTENT_UPDATE_API_PERMISSION`('Resource Admin', 'listUserKeyRules', 'ALLOW');
+
 -- Add conserve mode for VPC offerings
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vpc_offerings','conserve_mode', 'tinyint(1) unsigned NULL DEFAULT 0 COMMENT ''True if the VPC offering is IP conserve mode enabled, allowing public IP services to be used across multiple VPC tiers'' ');
 
 --- Disable/enable NICs
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.nics','enabled', 'TINYINT(1) NOT NULL DEFAULT 1 COMMENT ''Indicates whether the NIC is enabled or not'' ');
 
+--- Add URLs for OAuth provider
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.oauth_provider','authorize_url', 'VARCHAR(255) DEFAULT NULL COMMENT ''Authorize URL for OAuth initialization'' ');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.oauth_provider','token_url', 'VARCHAR(255) DEFAULT NULL COMMENT ''Token URL for OAuth finalization'' ');
+
 --- Quota tariff/usage mapping
 CREATE TABLE IF NOT EXISTS `cloud_usage`.`quota_tariff_usage` (
     `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
@@ -149,3 +157,65 @@ SELECT 'Advanced', 'DEFAULT', 'CapacityManager', 'kvm.cpu.dynamic.scaling.capaci
 FROM `cloud`.`configuration` `cfg`
 WHERE NOT EXISTS (SELECT 1 FROM `cloud`.`configuration` WHERE `name` = 'kvm.cpu.dynamic.scaling.capacity')
   AND `cfg`.`name` = 'vm.serviceoffering.cpu.cores.max';
+
+-- Remove stale realhostip.com default values; domain has been dead since ~2015.
+UPDATE `cloud`.`configuration`
+    SET value = NULL
+    WHERE name IN ('consoleproxy.url.domain', 'secstorage.ssl.cert.domain')
+      AND value IN ('realhostip.com', '*.realhostip.com');
+
+-- Add management_server_details table to allow ManagementServer scope configs
+CREATE TABLE IF NOT EXISTS `management_server_details` (
+                                                           `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
+                                                           `management_server_id` bigint unsigned NOT NULL COMMENT 'management server the detail is related to',
+                                                           `name` varchar(255) NOT NULL COMMENT 'name of the detail',
+    `value` varchar(255) NOT NULL,
+    `display` tinyint(1) NOT NULL DEFAULT '1' COMMENT 'True if the detail can be displayed to the end user',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_management_server_details__management_server_id` FOREIGN KEY `fk_management_server_details__management_server_id`(`management_server_id`) REFERENCES `mshost`(`id`) ON DELETE CASCADE,
+    KEY `i_management_server_details__name__value` (`name`(128),`value`(128))
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- Add checkpoint tracking fields to backups table for incremental backup support
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'from_checkpoint_id', 'VARCHAR(255) DEFAULT NULL COMMENT "Previous active checkpoint id for incremental backups"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'to_checkpoint_id', 'VARCHAR(255) DEFAULT NULL COMMENT "New checkpoint id created for the next incremental backup"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'checkpoint_create_time', 'BIGINT DEFAULT NULL COMMENT "Checkpoint creation timestamp from libvirt"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'host_id', 'BIGINT UNSIGNED DEFAULT NULL COMMENT "Host where backup is running"');
+
+-- Create image_transfer table for per-disk image transfers
+CREATE TABLE IF NOT EXISTS `cloud`.`image_transfer`(
+    `id` bigint unsigned NOT NULL auto_increment COMMENT 'id',
+    `uuid` varchar(40) NOT NULL COMMENT 'uuid',
+    `account_id` bigint unsigned NOT NULL COMMENT 'Account ID',
+    `domain_id` bigint unsigned NOT NULL COMMENT 'Domain ID',
+    `data_center_id` bigint unsigned NOT NULL COMMENT 'Data Center ID',
+    `backup_id` bigint unsigned COMMENT 'Backup ID',
+    `volume_id` bigint unsigned NOT NULL COMMENT 'Volume ID',
+    `host_id` bigint unsigned NOT NULL COMMENT 'Host ID',
+    `transfer_url` varchar(255) COMMENT 'ImageIO transfer URL',
+    `file` varchar(255) COMMENT 'File for the file backend',
+    `phase` varchar(20) NOT NULL COMMENT 'Transfer phase: initializing, transferring, finished, failed',
+    `socket` varchar(255) COMMENT 'Unix socket for nbd backend',
+    `direction` varchar(20) NOT NULL COMMENT 'Direction: upload, download',
+    `backend` varchar(20) NOT NULL COMMENT 'Backend: nbd, file',
+    `progress` int COMMENT 'Transfer progress percentage (0-100)',
+    `signed_ticket_id` varchar(255) COMMENT 'Signed ticket ID from ImageIO',
+    `created` datetime NOT NULL COMMENT 'date created',
+    `updated` datetime COMMENT 'date updated if not null',
+    `removed` datetime COMMENT 'date removed if not null',
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uuid` (`uuid`),
+    CONSTRAINT `fk_image_transfer__backup_id` FOREIGN KEY (`backup_id`) REFERENCES `backups`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_image_transfer__volume_id` FOREIGN KEY (`volume_id`) REFERENCES `volumes`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_image_transfer__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
+    INDEX `i_image_transfer__backup_id`(`backup_id`)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--- Quota resource statement
+INSERT INTO cloud.role_permissions (uuid, role_id, rule, permission, sort_order)
+SELECT uuid(), role_id, 'quotaResourceStatement', permission, sort_order
+FROM cloud.role_permissions rp
+WHERE rule = 'quotaStatement' AND NOT EXISTS(SELECT 1 FROM cloud.role_permissions rp_ WHERE rp.role_id = rp_.role_id AND rp_.rule = 'quotaResourceStatement');
+
+-- Add description for secondary IP addresses
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.nic_secondary_ips', 'description', 'VARCHAR(2048) DEFAULT NULL');
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
index d9f4e2671595..255ce866c427 100644
--- a/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
@@ -64,6 +64,7 @@ SELECT
     guest_os_category.id guest_os_category_id,
     guest_os_category.uuid guest_os_category_uuid,
     guest_os_category.name guest_os_category_name,
+    (SELECT `value` FROM `cloud`.`host_details` `hd` WHERE `hd`.`host_id` = `cloud`.`host`.`id` AND `hd`.`name` = 'guest.os.rule') AS `guest_os_rule`,
     mem_caps.used_capacity memory_used_capacity,
     mem_caps.reserved_capacity memory_reserved_capacity,
     cpu_caps.used_capacity cpu_used_capacity,
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
index c169cbce2170..d77ba27689be 100644
--- a/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
@@ -56,6 +56,7 @@ SELECT
     `vm_instance`.`display_vm` AS `display_vm`,
     `vm_instance`.`delete_protection` AS `delete_protection`,
     `guest_os`.`uuid` AS `guest_os_uuid`,
+    `guest_os`.`display_name` AS `guest_os_display_name`,
     `vm_instance`.`pod_id` AS `pod_id`,
     `host_pod_ref`.`uuid` AS `pod_uuid`,
     `vm_instance`.`private_ip_address` AS `private_ip_address`,
diff --git a/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java b/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
index 9445efeb089c..6f153727ab76 100644
--- a/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
+++ b/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
@@ -41,6 +41,7 @@
 import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeVO;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
@@ -113,6 +114,69 @@ public void testListPoolIdsByVolumeCount_without_cluster_details() throws SQLExc
         verify(preparedStatementMock, times(1)).executeQuery();
     }
 
+    @Test
+    public void findByInstanceAndNotState_queriesWithInstanceIdAndExcludedStates() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        VolumeVO mockedVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(sb.entity()).thenReturn(mockedVO);
+
+        volumeDao.findByInstanceAndNotStates(42L, Volume.State.Ready);
+
+        Mockito.verify(sc).setParameters("instanceId", 42L);
+        Mockito.verify(sc).setParameters("state", (Object[]) new Volume.State[]{Volume.State.Ready});
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_withMultipleExcludedStates_passesAllStatesToCriteria() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        VolumeVO mockedVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(sb.entity()).thenReturn(mockedVO);
+
+        volumeDao.findByInstanceAndNotStates(7L, Volume.State.Destroy, Volume.State.Expunged);
+
+        Mockito.verify(sc).setParameters("instanceId", 7L);
+        Mockito.verify(sc).setParameters("state",
+                (Object[]) new Volume.State[]{Volume.State.Destroy, Volume.State.Expunged});
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_returnsResultFromDao() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        VolumeVO vol = Mockito.mock(VolumeVO.class);
+        Mockito.doReturn(List.of(vol)).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        Mockito.when(sb.entity()).thenReturn(Mockito.mock(VolumeVO.class));
+
+        List<VolumeVO> result = volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready);
+
+        Assert.assertEquals(1, result.size());
+        Assert.assertSame(vol, result.get(0));
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_noMatchingVolumes_returnsEmptyList() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        Mockito.when(sb.entity()).thenReturn(Mockito.mock(VolumeVO.class));
+
+        List<VolumeVO> result = volumeDao.findByInstanceAndNotStates(99L, Volume.State.Ready);
+
+        Assert.assertTrue(result.isEmpty());
+    }
+
     @Test
     public void testSearchRemovedByVmsNoVms() {
         Assert.assertTrue(CollectionUtils.isEmpty(volumeDao.searchRemovedByVms(
@@ -141,5 +205,4 @@ public void testSearchRemovedByVms() {
                 Mockito.any(SearchCriteria.class), Mockito.any(Filter.class), Mockito.eq(null),
                 Mockito.eq(false));
     }
-
 }
diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
index 8145158dfa40..95362f44b138 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
@@ -27,6 +27,7 @@
 import javax.inject.Inject;
 
 import com.cloud.agent.api.to.DiskTO;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.Storage;
 import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope;
 import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
@@ -75,6 +76,7 @@
 import com.cloud.storage.Snapshot.Type;
 import com.cloud.storage.SnapshotVO;
 import com.cloud.storage.StorageManager;
+import com.cloud.storage.Storage.ImageFormat;
 import com.cloud.storage.Storage.StoragePoolType;
 import com.cloud.storage.StoragePool;
 import com.cloud.storage.VolumeVO;
@@ -108,6 +110,8 @@ public class AncientDataMotionStrategy implements DataMotionStrategy {
     StorageCacheManager cacheMgr;
     @Inject
     VolumeDataStoreDao volumeDataStoreDao;
+    @Inject
+    ClvmPoolManager clvmPoolManager;
 
     @Inject
     StorageManager storageManager;
@@ -309,6 +313,8 @@ protected Answer copyVolumeFromSnapshot(DataObject snapObj, DataObject volObj) {
                 ep = selector.select(srcData, volObj);
             }
 
+            updateLockHostForVolume(ep, volObj);
+
             CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(volObj.getTO()), _createVolumeFromSnapshotWait, VirtualMachineManager.ExecuteInSequence.value());
 
             Answer answer = null;
@@ -331,6 +337,29 @@ protected Answer copyVolumeFromSnapshot(DataObject snapObj, DataObject volObj) {
         }
     }
 
+    private void updateLockHostForVolume(EndPoint ep, DataObject volObj) {
+        if (ep == null || !(volObj instanceof VolumeInfo)) {
+            return;
+        }
+        VolumeInfo volumeInfo = (VolumeInfo) volObj;
+        StoragePool destPool = (StoragePool) volObj.getDataStore();
+        if (destPool == null || !ClvmPoolManager.isClvmPoolType(destPool.getPoolType())) {
+            return;
+        }
+        Long hostId = ep.getId();
+        Long existingHostId = clvmPoolManager.getClvmLockHostId(
+                volumeInfo.getId(),
+                volumeInfo.getUuid(),
+                volumeInfo.getPath(),
+                destPool,
+                true
+        );
+        if (existingHostId == null) {
+            clvmPoolManager.setClvmLockHostId(volumeInfo.getId(), hostId);
+            logger.debug("Set lock host ID {} for CLVM volume {} being created from snapshot", hostId, volumeInfo.getId());
+        }
+    }
+
     protected Answer cloneVolume(DataObject template, DataObject volume) {
         CopyCommand cmd = new CopyCommand(template.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(volume.getTO()), 0, VirtualMachineManager.ExecuteInSequence.value());
         try {
@@ -581,6 +610,9 @@ protected Answer migrateVolumeToPool(DataObject srcData, DataObject destData) {
             volumeVo.setPoolId(destPool.getId());
             volumeVo.setPoolType(destPool.getPoolType());
             volumeVo.setLastPoolId(oldPoolId);
+            if (destPool.getPoolType() == StoragePoolType.CLVM) {
+                volumeVo.setFormat(ImageFormat.RAW);
+            }
             // For SMB, pool credentials are also stored in the uri query string.  We trim the query string
             // part  here to make sure the credentials do not get stored in the db unencrypted.
             String folder = destPool.getPath();
diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageDataMotionStrategy.java
index 947b4af8f690..867470dac040 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageDataMotionStrategy.java
@@ -144,12 +144,16 @@ protected boolean isDestinationNfsPrimaryStorageClusterWide(Map<VolumeInfo, Data
     }
 
     /**
-     * Configures a {@link MigrateDiskInfo} object configured for migrating a File System volume and calls rootImageProvisioning.
+     * Configures a {@link MigrateDiskInfo} object configured for migrating a File System volume.
      */
     @Override
     protected MigrateCommand.MigrateDiskInfo configureMigrateDiskInfo(VolumeInfo srcVolumeInfo, String destPath, String backingPath) {
-            return new MigrateCommand.MigrateDiskInfo(srcVolumeInfo.getPath(), MigrateCommand.MigrateDiskInfo.DiskType.FILE, MigrateCommand.MigrateDiskInfo.DriverType.QCOW2,
-                    MigrateCommand.MigrateDiskInfo.Source.FILE, destPath, backingPath);
+            return new MigrateCommand.MigrateDiskInfo(srcVolumeInfo.getPath(),
+                    MigrateCommand.MigrateDiskInfo.DiskType.FILE,
+                    MigrateCommand.MigrateDiskInfo.DriverType.QCOW2,
+                    MigrateCommand.MigrateDiskInfo.Source.FILE,
+                    destPath,
+                    backingPath);
     }
 
     /**
@@ -158,6 +162,17 @@ protected MigrateCommand.MigrateDiskInfo configureMigrateDiskInfo(VolumeInfo src
      */
     @Override
     protected String generateDestPath(Host destHost, StoragePoolVO destStoragePool, VolumeInfo destVolumeInfo) {
+        if (destStoragePool.getPoolType() == StoragePoolType.CLVM || destStoragePool.getPoolType() == StoragePoolType.CLVM_NG) {
+            String vgName = destStoragePool.getPath();
+            if (StringUtils.isBlank(vgName)) {
+                throw new CloudRuntimeException(String.format("CLVM/CLVM_NG destination pool [%s] has empty VG path", destStoragePool.getUuid()));
+            }
+            if (vgName.startsWith("/")) {
+                vgName = vgName.substring(1);
+            }
+            return String.format("/dev/%s/%s", vgName, destVolumeInfo.getUuid());
+        }
+
         return new File(destStoragePool.getPath(), destVolumeInfo.getUuid()).getAbsolutePath();
     }
 
@@ -285,6 +300,7 @@ protected void logInCaseOfTemplateCopyFailure(Answer copyCommandAnswer, Template
     }
 
     protected Boolean supportStoragePoolType(StoragePoolType storagePoolType) {
-        return super.supportStoragePoolType(storagePoolType, StoragePoolType.Filesystem);
+        return super.supportStoragePoolType(storagePoolType, StoragePoolType.Filesystem,
+                StoragePoolType.CLVM, StoragePoolType.CLVM_NG);
     }
 }
diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
index bcade3a371c4..2c791d059806 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
@@ -36,6 +36,8 @@
 import com.cloud.agent.api.CheckVirtualMachineCommand;
 import com.cloud.agent.api.PrepareForMigrationAnswer;
 import com.cloud.resource.ResourceManager;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
 import org.apache.cloudstack.engine.subsystem.api.storage.ChapInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope;
 import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
@@ -87,6 +89,7 @@
 import com.cloud.agent.api.MigrateCommand.MigrateDiskInfo;
 import com.cloud.agent.api.ModifyTargetsAnswer;
 import com.cloud.agent.api.ModifyTargetsCommand;
+import com.cloud.agent.api.PreMigrationCommand;
 import com.cloud.agent.api.PrepareForMigrationCommand;
 import com.cloud.agent.api.storage.CopyVolumeAnswer;
 import com.cloud.agent.api.storage.CopyVolumeCommand;
@@ -206,6 +209,8 @@ public class StorageSystemDataMotionStrategy implements DataMotionStrategy {
     private VolumeDataFactory _volFactory;
     @Inject
     ResourceManager resourceManager;
+    @Inject
+    private ClvmPoolManager clvmPoolManager;
 
     @Override
     public StrategyPriority canHandle(DataObject srcData, DataObject destData) {
@@ -2023,6 +2028,7 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
         String errMsg = null;
         boolean success = false;
         Map<VolumeInfo, VolumeInfo> srcVolumeInfoToDestVolumeInfo = new HashMap<>();
+        List<VolumeInfo> samePoolClvmVolumes = new ArrayList<>();
 
         try {
             if (srcHost.getHypervisorType() != HypervisorType.KVM) {
@@ -2052,6 +2058,13 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                     continue;
                 }
 
+                if (sourceStoragePool.getId() == destStoragePool.getId() &&
+                        ClvmPoolManager.isClvmPoolType(destStoragePool.getPoolType())) {
+                    logger.info("Same-pool CLVM migration for volume [{}]: skipping data copy.", srcVolumeInfo.getUuid());
+                    samePoolClvmVolumes.add(srcVolumeInfo);
+                    continue;
+                }
+
                 if (!shouldMigrateVolume(sourceStoragePool, destHost, destStoragePool)) {
                     continue;
                 }
@@ -2071,6 +2084,13 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
 
                 setVolumeMigrationOptions(srcVolumeInfo, destVolumeInfo, vmTO, srcHost, destStoragePool, migrationType);
 
+                if (ClvmPoolManager.isClvmPoolType(destStoragePool.getPoolType())) {
+                    destVolumeInfo.setDestinationHostId(destHost.getId());
+                    clvmPoolManager.setClvmLockHostId(destVolume.getId(), destHost.getId());
+                    logger.info("Set CLVM lock host {} for volume {} during migration to ensure creation on destination host",
+                            destHost.getId(), destVolumeInfo.getUuid());
+                }
+
                 // create a volume on the destination storage
                 destDataStore.getDriver().createAsync(destDataStore, destVolumeInfo, null);
 
@@ -2096,7 +2116,7 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
 
                 MigrateCommand.MigrateDiskInfo migrateDiskInfo;
 
-                boolean isNonManagedToNfs = supportStoragePoolType(sourceStoragePool.getPoolType(), StoragePoolType.Filesystem) && destStoragePool.getPoolType() == StoragePoolType.NetworkFilesystem && !managedStorageDestination;
+                boolean isNonManagedToNfs = supportStoragePoolType(sourceStoragePool.getPoolType(), StoragePoolType.Filesystem, StoragePoolType.CLVM, StoragePoolType.CLVM_NG) && destStoragePool.getPoolType() == StoragePoolType.NetworkFilesystem && !managedStorageDestination;
                 if (isNonManagedToNfs) {
                     migrateDiskInfo = new MigrateCommand.MigrateDiskInfo(srcVolumeInfo.getPath(),
                             MigrateCommand.MigrateDiskInfo.DiskType.FILE,
@@ -2106,9 +2126,12 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                 } else {
                     String backingPath = generateBackingPath(destStoragePool, destVolumeInfo);
                     migrateDiskInfo = configureMigrateDiskInfo(srcVolumeInfo, destPath, backingPath);
+                    migrateDiskInfo = updateMigrateDiskInfoForBlockDevice(migrateDiskInfo, destStoragePool);
                     migrateDiskInfo.setSourceDiskOnStorageFileSystem(isStoragePoolTypeOfFile(sourceStoragePool));
                     migrateDiskInfoList.add(migrateDiskInfo);
                 }
+                migrateDiskInfo.setSourcePoolType(sourceStoragePool.getPoolType());
+                migrateDiskInfo.setDestPoolType(destVolumeInfo.getStoragePoolType());
                 prepareDiskWithSecretConsumerDetail(vmTO, srcVolumeInfo, destVolumeInfo.getPath());
 
                 migrateStorage.put(srcVolumeInfo.getPath(), migrateDiskInfo);
@@ -2116,6 +2139,8 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                 srcVolumeInfoToDestVolumeInfo.put(srcVolumeInfo, destVolumeInfo);
             }
 
+            prepareDisksForMigrationForClvm(vmTO, volumeDataStoreMap, srcHost);
+
             PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(vmTO);
             Answer pfma;
 
@@ -2132,6 +2157,25 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                 throw new AgentUnavailableException("Operation timed out", destHost.getId());
             }
 
+            for (VolumeInfo vol : samePoolClvmVolumes) {
+                StoragePoolVO samePoolClvmPool = _storagePoolDao.findById(vol.getPoolId());
+                String vgName = samePoolClvmPool.getPath();
+                if (vgName.startsWith("/")) {
+                    vgName = vgName.substring(1);
+                }
+                String lvPath = String.format("/dev/%s/%s", vgName, vol.getPath());
+                logger.info("Activating CLVM volume [{}] in shared mode on dest host [{}] for same-pool migration.",
+                        vol.getUuid(), destHost.getId());
+                Answer activateAnswer = agentManager.send(destHost.getId(),
+                        new ClvmLockTransferCommand(ClvmLockTransferCommand.Operation.ACTIVATE_SHARED, lvPath, vol.getUuid()));
+                if (activateAnswer == null || !activateAnswer.getResult()) {
+                    throw new CloudRuntimeException(String.format(
+                            "Failed to activate CLVM volume [%s] in shared mode on dest host [%s]: %s",
+                            vol.getUuid(), destHost.getId(),
+                            activateAnswer != null ? activateAnswer.getDetails() : "null answer"));
+                }
+            }
+
             VMInstanceVO vm = _vmDao.findById(vmTO.getId());
             boolean isWindows = _guestOsCategoryDao.findById(_guestOsDao.findById(vm.getGuestOSId()).getCategoryId()).getName().equalsIgnoreCase("Windows");
 
@@ -2141,6 +2185,9 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
             migrateCommand.setMigrateDiskInfoList(migrateDiskInfoList);
             migrateCommand.setMigrateStorageManaged(managedStorageDestination);
             migrateCommand.setMigrateNonSharedInc(migrateNonSharedInc);
+            boolean hasClvmCrossPoolVolume = migrateStorage.values().stream()
+                    .anyMatch(info -> ClvmPoolManager.isClvmPoolType(info.getSourcePoolType()));
+            migrateCommand.setClvmCrossPoolMigration(hasClvmCrossPoolVolume);
 
             Integer newVmCpuShares = ((PrepareForMigrationAnswer) pfma).getNewVmCpuShares();
             if (newVmCpuShares != null) {
@@ -2171,7 +2218,7 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                 }
             }
 
-            handlePostMigration(success, srcVolumeInfoToDestVolumeInfo, vmTO, destHost);
+            handlePostMigration(success, srcVolumeInfoToDestVolumeInfo, vmTO, srcHost, destHost);
 
             if (!success) {
                 if (migrateAnswer == null) {
@@ -2211,10 +2258,43 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
         }
     }
 
+    private void prepareDisksForMigrationForClvm(VirtualMachineTO vmTO, Map<VolumeInfo, DataStore> volumeDataStoreMap, Host srcHost) {
+        // For CLVM/CLVM_NG source pools, convert volumes from exclusive to shared mode
+        // on the source host BEFORE PrepareForMigrationCommand on the destination.
+        boolean hasClvmSource = volumeDataStoreMap.keySet().stream()
+                .map(v -> _storagePoolDao.findById(v.getPoolId()))
+                .anyMatch(p -> p != null && (p.getPoolType() == StoragePoolType.CLVM || p.getPoolType() == StoragePoolType.CLVM_NG));
+        if (hasClvmSource && srcHost.getHypervisorType() == HypervisorType.KVM) {
+            logger.info("CLVM/CLVM_NG source pool detected for VM [{}], sending PreMigrationCommand to source host [{}] to convert volumes to shared mode.", vmTO.getName(), srcHost.getId());
+            PreMigrationCommand preMigCmd = new PreMigrationCommand(vmTO, vmTO.getName());
+            try {
+                Answer preMigAnswer = agentManager.send(srcHost.getId(), preMigCmd);
+                if (preMigAnswer == null || !preMigAnswer.getResult()) {
+                    String details = preMigAnswer != null ? preMigAnswer.getDetails() : "null answer returned";
+                    logger.warn("PreMigrationCommand failed for CLVM/CLVM_NG VM [{}] on source host [{}]: {}. Migration will continue but may fail if volumes are exclusively locked.", vmTO.getName(), srcHost.getId(), details);
+                } else {
+                    logger.info("Successfully converted CLVM/CLVM_NG volumes to shared mode on source host [{}] for VM [{}].", srcHost.getId(), vmTO.getName());
+                }
+            } catch (Exception e) {
+                logger.warn("Failed to send PreMigrationCommand to source host [{}] for VM [{}]: {}. Migration will continue but may fail if volumes are exclusively locked.", srcHost.getId(), vmTO.getName(), e.getMessage());
+            }
+        } else if (hasClvmSource) {
+            logger.debug("Skipping PreMigrationCommand for non-KVM hypervisor type: {} on host [{}]", srcHost.getHypervisorType(), srcHost.getId());
+        }
+    }
+
     private MigrationOptions.Type decideMigrationTypeAndCopyTemplateIfNeeded(Host destHost, VMInstanceVO vmInstance, VolumeInfo srcVolumeInfo, StoragePoolVO sourceStoragePool, StoragePoolVO destStoragePool, DataStore destDataStore) {
         VMTemplateVO vmTemplate = _vmTemplateDao.findById(vmInstance.getTemplateId());
         String srcVolumeBackingFile = getVolumeBackingFile(srcVolumeInfo);
+
+        // Check if source is CLVM/CLVM_NG (block device storage)
+        // LinkedClone (VIR_MIGRATE_NON_SHARED_INC) only works for file → file migrations
+        // For block device sources, use FullClone (VIR_MIGRATE_NON_SHARED_DISK)
+        boolean sourceIsBlockDevice = sourceStoragePool.getPoolType() == StoragePoolType.CLVM ||
+                                       sourceStoragePool.getPoolType() == StoragePoolType.CLVM_NG;
+
         if (StringUtils.isNotBlank(srcVolumeBackingFile) && supportStoragePoolType(destStoragePool.getPoolType(), StoragePoolType.Filesystem) &&
+                !sourceIsBlockDevice &&
                 srcVolumeInfo.getTemplateId() != null &&
                 Objects.nonNull(vmTemplate) &&
                 !Arrays.asList(KVM_VM_IMPORT_DEFAULT_TEMPLATE_NAME, VM_IMPORT_DEFAULT_TEMPLATE_NAME).contains(vmTemplate.getName())) {
@@ -2222,8 +2302,12 @@ private MigrationOptions.Type decideMigrationTypeAndCopyTemplateIfNeeded(Host de
             copyTemplateToTargetFilesystemStorageIfNeeded(srcVolumeInfo, sourceStoragePool, destDataStore, destStoragePool, destHost);
             return MigrationOptions.Type.LinkedClone;
         }
-        logger.debug(String.format("Skipping copy template from source storage pool [%s] to target storage pool [%s] before migration due to volume [%s] does not have a " +
-                "template or we are doing full clone migration.", sourceStoragePool.getId(), destStoragePool.getId(), srcVolumeInfo.getId()));
+
+        if (sourceIsBlockDevice) {
+            logger.debug(String.format("Source storage pool [%s] is block device (CLVM/CLVM_NG). Using FullClone migration for volume [%s] to target storage pool [%s]. Template copy skipped as entire volume will be copied.", sourceStoragePool.getId(), srcVolumeInfo.getId(), destStoragePool.getId()));
+        } else {
+            logger.debug(String.format("Skipping copy template from source storage pool [%s] to target storage pool [%s] before migration due to volume [%s] does not have a template or we are doing full clone migration.", sourceStoragePool.getId(), destStoragePool.getId(), srcVolumeInfo.getId()));
+        }
         return MigrationOptions.Type.FullClone;
     }
 
@@ -2289,6 +2373,39 @@ protected MigrateCommand.MigrateDiskInfo configureMigrateDiskInfo(VolumeInfo src
                 MigrateCommand.MigrateDiskInfo.Source.DEV, destPath, backingPath);
     }
 
+    /**
+     * UpdatesMigrateDiskInfo for CLVM/CLVM_NG block devices by returning a new instance with corrected disk type, driver type, and source.
+     * For CLVM/CLVM_NG destinations, returns a new MigrateDiskInfo with BLOCK disk type, DEV source, and appropriate driver type (QCOW2 for CLVM_NG, RAW for CLVM).
+     * For other storage types, returns the original MigrateDiskInfo unchanged.
+     *
+     * @param migrateDiskInfo The original MigrateDiskInfo object
+     * @param destStoragePool The destination storage pool
+     * @return A new MigrateDiskInfo with updated values for CLVM/CLVM_NG, or the original for other storage types
+     */
+    protected MigrateCommand.MigrateDiskInfo updateMigrateDiskInfoForBlockDevice(MigrateCommand.MigrateDiskInfo migrateDiskInfo,
+                                                                                   StoragePoolVO destStoragePool) {
+        if (ClvmPoolManager.isClvmPoolType(destStoragePool.getPoolType())) {
+
+            MigrateCommand.MigrateDiskInfo.DriverType driverType =
+                (destStoragePool.getPoolType() == StoragePoolType.CLVM_NG) ?
+                MigrateCommand.MigrateDiskInfo.DriverType.QCOW2 :
+                MigrateCommand.MigrateDiskInfo.DriverType.RAW;
+
+            logger.debug("Updating MigrateDiskInfo for {} destination: setting BLOCK disk type, DEV source, and {} driver type",
+                destStoragePool.getPoolType(), driverType);
+
+            return new MigrateCommand.MigrateDiskInfo(
+                migrateDiskInfo.getSerialNumber(),
+                MigrateCommand.MigrateDiskInfo.DiskType.BLOCK,
+                driverType,
+                MigrateCommand.MigrateDiskInfo.Source.DEV,
+                migrateDiskInfo.getSourceText(),
+                migrateDiskInfo.getBackingStoreText());
+        }
+
+        return migrateDiskInfo;
+    }
+
     /**
      * Sets the volume path as the iScsi name in case of a configured iScsi.
      */
@@ -2320,7 +2437,26 @@ String getVolumeBackingFile(VolumeInfo srcVolumeInfo) {
         return null;
     }
 
-    private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> srcVolumeInfoToDestVolumeInfo, VirtualMachineTO vmTO, Host destHost) {
+    private void sendClvmLockCommand(long hostId, StoragePoolVO pool, VolumeInfo volumeInfo,
+            ClvmLockTransferCommand.Operation operation) {
+        String vgName = pool.getPath();
+        if (vgName.startsWith("/")) {
+            vgName = vgName.substring(1);
+        }
+        String lvPath = String.format("/dev/%s/%s", vgName, volumeInfo.getPath());
+        try {
+            Answer answer = agentManager.send(hostId,
+                    new ClvmLockTransferCommand(operation, lvPath, volumeInfo.getUuid()));
+            if (answer == null || !answer.getResult()) {
+                String details = answer != null ? answer.getDetails() : "null answer";
+                logger.warn("CLVM lock command [{}] failed for LV [{}] on host [{}]: {}", operation, lvPath, hostId, details);
+            }
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.warn("Exception sending CLVM lock command [{}] for LV [{}] on host [{}]: {}", operation, lvPath, hostId, e.getMessage());
+        }
+    }
+
+    private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> srcVolumeInfoToDestVolumeInfo, VirtualMachineTO vmTO, Host srcHost, Host destHost) {
         if (!success) {
             try {
                 PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(vmTO);
@@ -2339,6 +2475,17 @@ private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> sr
             catch (Exception e) {
                 logger.debug("Failed to disconnect one or more (original) dest volumes", e);
             }
+
+            if (srcHost != null && srcHost.getHypervisorType() == HypervisorType.KVM) {
+                for (VolumeInfo srcVolumeInfo : srcVolumeInfoToDestVolumeInfo.keySet()) {
+                    StoragePoolVO srcPool = _storagePoolDao.findById(srcVolumeInfo.getPoolId());
+                    if (srcPool == null || !ClvmPoolManager.isClvmPoolType(srcPool.getPoolType())) {
+                        continue;
+                    }
+                    sendClvmLockCommand(srcHost.getId(), srcPool, srcVolumeInfo,
+                            ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE);
+                }
+            }
         }
 
         for (Map.Entry<VolumeInfo, VolumeInfo> entry : srcVolumeInfoToDestVolumeInfo.entrySet()) {
@@ -2349,12 +2496,13 @@ private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> sr
 
             if (success) {
                 VolumeVO volumeVO = _volumeDao.findById(destVolumeInfo.getId());
-                volumeVO.setFormat(ImageFormat.QCOW2);
+                StoragePoolVO srcPoolVO = _storagePoolDao.findById(srcVolumeInfo.getPoolId());
+                StoragePoolVO destPoolVO = _storagePoolDao.findById(destVolumeInfo.getPoolId());
+                volumeVO.setFormat(destPoolVO != null && destPoolVO.getPoolType() == StoragePoolType.CLVM
+                        ? ImageFormat.RAW : ImageFormat.QCOW2);
                 volumeVO.setLastId(srcVolumeInfo.getId());
 
                 if (Objects.equals(srcVolumeInfo.getDiskOfferingId(), destVolumeInfo.getDiskOfferingId())) {
-                    StoragePoolVO srcPoolVO = _storagePoolDao.findById(srcVolumeInfo.getPoolId());
-                    StoragePoolVO destPoolVO = _storagePoolDao.findById(destVolumeInfo.getPoolId());
                     if (srcPoolVO != null && destPoolVO != null &&
                             ((srcPoolVO.isShared() && destPoolVO.isLocal()) || (srcPoolVO.isLocal() && destPoolVO.isShared()))) {
                         Long offeringId = getSuitableDiskOfferingForVolumeOnPool(volumeVO, destPoolVO);
@@ -2365,6 +2513,12 @@ private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> sr
                 }
 
                 _volumeDao.update(volumeVO.getId(), volumeVO);
+                if (destPoolVO != null && ClvmPoolManager.isClvmPoolType(destPoolVO.getPoolType())
+                        && (srcPoolVO == null || srcPoolVO.getId() != destPoolVO.getId())) {
+                    sendClvmLockCommand(destHost.getId(), destPoolVO, destVolumeInfo,
+                            ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE);
+                    clvmPoolManager.setClvmLockHostId(destVolumeInfo.getId(), destHost.getId());
+                }
 
                 _volumeService.copyPoliciesBetweenVolumesAndDestroySourceVolumeAfterMigration(Event.OperationSucceeded, null, srcVolumeInfo, destVolumeInfo, false);
 
diff --git a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
index e167cc0a9653..e84163656b10 100755
--- a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
+++ b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
@@ -28,14 +28,18 @@
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.any;
 
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.Storage;
 import com.cloud.storage.StorageManager;
 import com.cloud.storage.StoragePool;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
 import org.apache.cloudstack.engine.subsystem.api.storage.HostScope;
+import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.StorageCacheManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.ZoneScope;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
@@ -95,6 +99,14 @@ private void overrideDefaultConfigValue(final ConfigKey configKey, final String
         f.set(configKey, value);
     }
 
+    private ClvmPoolManager injectMockedClvmPoolManager() throws Exception {
+        ClvmPoolManager clvmPoolManager = Mockito.mock(ClvmPoolManager.class);
+        Field clvmPoolManagerField = AncientDataMotionStrategy.class.getDeclaredField("clvmPoolManager");
+        clvmPoolManagerField.setAccessible(true);
+        clvmPoolManagerField.set(strategy, clvmPoolManager);
+        return clvmPoolManager;
+    }
+
     @Test
     public void testAddFullCloneFlagOnVMwareDest(){
         strategy.addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(dataTO);
@@ -288,4 +300,185 @@ public void testCanBypassSecondaryStorageWithClusterWideNFSAndZoneWideNFSPoolsIn
         canBypassSecondaryStorage = (boolean) method.invoke(strategy, destVolumeInfo, srcVolumeInfo);
         Assert.assertTrue(canBypassSecondaryStorage);
     }
+
+    @Test
+    public void testUpdateLockHostForVolume_CLVMPool_SetsLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class, Mockito.withSettings().extraInterfaces(StoragePool.class));
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        Long hostId = 123L;
+        Long volumeId = 456L;
+        String volumeUuid = "test-volume-uuid";
+
+        Mockito.when(endPoint.getId()).thenReturn(hostId);
+        Mockito.when(volumeInfo.getDataStore()).thenReturn(dataStore);
+        Mockito.when(volumeInfo.getId()).thenReturn(volumeId);
+        Mockito.when(volumeInfo.getUuid()).thenReturn(volumeUuid);
+        Mockito.when(volumeInfo.getPath()).thenReturn("test-volume-path");
+        Mockito.when(((StoragePool) dataStore).getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(volumeId), Mockito.eq(volumeUuid),
+                Mockito.anyString(), Mockito.any(StoragePool.class), Mockito.eq(true))).thenReturn(null);
+
+        method.invoke(strategy, endPoint, volumeInfo);
+
+        Mockito.verify(clvmPoolManager).setClvmLockHostId(volumeId, hostId);
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_CLVM_NG_Pool_SetsLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class, Mockito.withSettings().extraInterfaces(StoragePool.class));
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        Long hostId = 789L;
+        Long volumeId = 101L;
+        String volumeUuid = "test-clvm-ng-volume-uuid";
+
+        Mockito.when(endPoint.getId()).thenReturn(hostId);
+        Mockito.when(volumeInfo.getDataStore()).thenReturn(dataStore);
+        Mockito.when(volumeInfo.getId()).thenReturn(volumeId);
+        Mockito.when(volumeInfo.getUuid()).thenReturn(volumeUuid);
+        Mockito.when(volumeInfo.getPath()).thenReturn("test-clvm-ng-volume-path");
+        Mockito.when(((StoragePool) dataStore).getPoolType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(volumeId), Mockito.eq(volumeUuid),
+                Mockito.anyString(), Mockito.any(StoragePool.class), Mockito.eq(true))).thenReturn(null);
+
+        try {
+            method.invoke(strategy, endPoint, volumeInfo);
+        } catch (InvocationTargetException e) {
+            e.getCause().printStackTrace();
+            throw e;
+        }
+
+        Mockito.verify(clvmPoolManager).setClvmLockHostId(volumeId, hostId);
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_NonCLVMPool_DoesNotSetLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        // Create mock that implements both DataStore and StoragePool interfaces
+        DataStore dataStore = Mockito.mock(DataStore.class, Mockito.withSettings().extraInterfaces(StoragePool.class));
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        Mockito.when(volumeInfo.getDataStore()).thenReturn(dataStore);
+        Mockito.when(((StoragePool) dataStore).getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+
+        method.invoke(strategy, endPoint, volumeInfo);
+
+        Mockito.verify(clvmPoolManager, never()).setClvmLockHostId(any(Long.class), any(Long.class));
+        Mockito.verify(clvmPoolManager, never()).getClvmLockHostId(any(Long.class), any(String.class),
+                any(String.class), any(StoragePool.class), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_ExistingLockHost_DoesNotOverwrite() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class, Mockito.withSettings().extraInterfaces(StoragePool.class));
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        Long hostId = 555L;
+        Long existingHostId = 666L;
+        Long volumeId = 777L;
+        String volumeUuid = "existing-lock-volume-uuid";
+
+        Mockito.when(endPoint.getId()).thenReturn(hostId);
+        Mockito.when(volumeInfo.getDataStore()).thenReturn(dataStore);
+        Mockito.when(volumeInfo.getId()).thenReturn(volumeId);
+        Mockito.when(volumeInfo.getUuid()).thenReturn(volumeUuid);
+        Mockito.when(volumeInfo.getPath()).thenReturn("existing-lock-volume-path");
+        Mockito.when(((StoragePool) dataStore).getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(clvmPoolManager.getClvmLockHostId(Mockito.eq(volumeId), Mockito.eq(volumeUuid),
+                Mockito.anyString(), Mockito.any(StoragePool.class), Mockito.eq(true))).thenReturn(existingHostId);
+
+        method.invoke(strategy, endPoint, volumeInfo);
+
+        Mockito.verify(clvmPoolManager, never()).setClvmLockHostId(any(Long.class), any(Long.class));
+        Mockito.verify(clvmPoolManager).getClvmLockHostId(Mockito.eq(volumeId), Mockito.eq(volumeUuid),
+                Mockito.anyString(), Mockito.any(StoragePool.class), Mockito.eq(true));
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_NullEndPoint_DoesNotSetLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        method.invoke(strategy, null, volumeInfo);
+
+        Mockito.verify(clvmPoolManager, never()).setClvmLockHostId(any(Long.class), any(Long.class));
+        Mockito.verify(clvmPoolManager, never()).getClvmLockHostId(any(Long.class), any(String.class),
+                any(String.class), any(StoragePool.class), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_NonVolumeDataObject_DoesNotSetLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        SnapshotInfo snapshotInfo = Mockito.mock(SnapshotInfo.class);
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        method.invoke(strategy, endPoint, snapshotInfo);
+
+        Mockito.verify(clvmPoolManager, never()).setClvmLockHostId(any(Long.class), any(Long.class));
+        Mockito.verify(clvmPoolManager, never()).getClvmLockHostId(any(Long.class), any(String.class),
+                any(String.class), any(StoragePool.class), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void testUpdateLockHostForVolume_NullPool_DoesNotSetLockHost() throws Exception {
+        Method method = AncientDataMotionStrategy.class.getDeclaredMethod(
+                "updateLockHostForVolume",
+                EndPoint.class,
+                DataObject.class);
+        method.setAccessible(true);
+
+        EndPoint endPoint = Mockito.mock(EndPoint.class);
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        ClvmPoolManager clvmPoolManager = injectMockedClvmPoolManager();
+
+        method.invoke(strategy, endPoint, volumeInfo);
+
+        Mockito.verify(clvmPoolManager, never()).setClvmLockHostId(any(Long.class), any(Long.class));
+        Mockito.verify(clvmPoolManager, never()).getClvmLockHostId(any(Long.class), any(String.class),
+                any(String.class), any(StoragePool.class), Mockito.anyBoolean());
+    }
 }
diff --git a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageSystemDataMotionTest.java b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageSystemDataMotionTest.java
index 808c319b40f2..6f0776b27c8c 100644
--- a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageSystemDataMotionTest.java
+++ b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/KvmNonManagedStorageSystemDataMotionTest.java
@@ -168,6 +168,8 @@ public Boolean supportStoragePoolType(StoragePoolType storagePoolType) {
         supportedTypes.add(StoragePoolType.Filesystem);
         supportedTypes.add(StoragePoolType.NetworkFilesystem);
         supportedTypes.add(StoragePoolType.SharedMountPoint);
+        supportedTypes.add(StoragePoolType.CLVM);
+        supportedTypes.add(StoragePoolType.CLVM_NG);
 
         return supportedTypes.contains(storagePoolType);
     }
@@ -505,6 +507,8 @@ public void validateSupportStoragePoolType() {
         supportedTypes.add(StoragePoolType.Filesystem);
         supportedTypes.add(StoragePoolType.NetworkFilesystem);
         supportedTypes.add(StoragePoolType.SharedMountPoint);
+        supportedTypes.add(StoragePoolType.CLVM);
+        supportedTypes.add(StoragePoolType.CLVM_NG);
 
         for (StoragePoolType poolType : StoragePoolType.values()) {
             boolean isSupported = kvmNonManagedStorageDataMotionStrategy.supportStoragePoolType(poolType);
diff --git a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategyTest.java b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategyTest.java
index 45357fa64b2a..fc51eeba7b6e 100644
--- a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategyTest.java
+++ b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategyTest.java
@@ -369,4 +369,286 @@ public void validateIsStoragePoolTypeInListReturnsFalse() {
 
         assertFalse(strategy.isStoragePoolTypeInList(StoragePoolType.SharedMountPoint, listTypes));
     }
+
+    /**
+     * Test updateMigrateDiskInfoForBlockDevice with CLVM destination pool
+     * Should set driver type to RAW for CLVM
+     */
+    @Test
+    public void testUpdateMigrateDiskInfoForBlockDevice_ClvmDestination() {
+        MigrateCommand.MigrateDiskInfo originalDiskInfo = new MigrateCommand.MigrateDiskInfo(
+                "serial123",
+                MigrateCommand.MigrateDiskInfo.DiskType.FILE,
+                MigrateCommand.MigrateDiskInfo.DriverType.QCOW2,
+                MigrateCommand.MigrateDiskInfo.Source.FILE,
+                "/source/path",
+                null
+        );
+
+        StoragePoolVO destStoragePool = new StoragePoolVO();
+        destStoragePool.setPoolType(StoragePoolType.CLVM);
+
+        MigrateCommand.MigrateDiskInfo updatedDiskInfo = strategy.updateMigrateDiskInfoForBlockDevice(
+                originalDiskInfo, destStoragePool);
+
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DiskType.BLOCK, updatedDiskInfo.getDiskType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DriverType.RAW, updatedDiskInfo.getDriverType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.Source.DEV, updatedDiskInfo.getSource());
+        Assert.assertEquals("serial123", updatedDiskInfo.getSerialNumber());
+        Assert.assertEquals("/source/path", updatedDiskInfo.getSourceText());
+    }
+
+    /**
+     * Test updateMigrateDiskInfoForBlockDevice with CLVM_NG destination pool
+     * Should set driver type to QCOW2 for CLVM_NG
+     */
+    @Test
+    public void testUpdateMigrateDiskInfoForBlockDevice_ClvmNgDestination() {
+        MigrateCommand.MigrateDiskInfo originalDiskInfo = new MigrateCommand.MigrateDiskInfo(
+                "serial456",
+                MigrateCommand.MigrateDiskInfo.DiskType.FILE,
+                MigrateCommand.MigrateDiskInfo.DriverType.RAW,
+                MigrateCommand.MigrateDiskInfo.Source.FILE,
+                "/source/path",
+                "/backing/path"
+        );
+
+        StoragePoolVO destStoragePool = new StoragePoolVO();
+        destStoragePool.setPoolType(StoragePoolType.CLVM_NG);
+
+        MigrateCommand.MigrateDiskInfo updatedDiskInfo = strategy.updateMigrateDiskInfoForBlockDevice(
+                originalDiskInfo, destStoragePool);
+
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DiskType.BLOCK, updatedDiskInfo.getDiskType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DriverType.QCOW2, updatedDiskInfo.getDriverType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.Source.DEV, updatedDiskInfo.getSource());
+        Assert.assertEquals("serial456", updatedDiskInfo.getSerialNumber());
+        Assert.assertEquals("/source/path", updatedDiskInfo.getSourceText());
+        Assert.assertEquals("/backing/path", updatedDiskInfo.getBackingStoreText());
+    }
+
+    /**
+     * Test updateMigrateDiskInfoForBlockDevice with non-CLVM destination pool
+     * Should return original DiskInfo unchanged
+     */
+    @Test
+    public void testUpdateMigrateDiskInfoForBlockDevice_NonClvmDestination() {
+        MigrateCommand.MigrateDiskInfo originalDiskInfo = new MigrateCommand.MigrateDiskInfo(
+                "serial789",
+                MigrateCommand.MigrateDiskInfo.DiskType.FILE,
+                MigrateCommand.MigrateDiskInfo.DriverType.QCOW2,
+                MigrateCommand.MigrateDiskInfo.Source.FILE,
+                "/source/path",
+                null
+        );
+
+        StoragePoolVO destStoragePool = new StoragePoolVO();
+        destStoragePool.setPoolType(StoragePoolType.NetworkFilesystem);
+
+        MigrateCommand.MigrateDiskInfo updatedDiskInfo = strategy.updateMigrateDiskInfoForBlockDevice(
+                originalDiskInfo, destStoragePool);
+
+        Assert.assertSame(originalDiskInfo, updatedDiskInfo);
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DiskType.FILE, updatedDiskInfo.getDiskType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DriverType.QCOW2, updatedDiskInfo.getDriverType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.Source.FILE, updatedDiskInfo.getSource());
+    }
+
+    /**
+     * Test supportStoragePoolType with CLVM and CLVM_NG types
+     */
+    @Test
+    public void testSupportStoragePoolType_ClvmTypes() {
+        assertTrue(strategy.supportStoragePoolType(StoragePoolType.CLVM, StoragePoolType.CLVM, StoragePoolType.CLVM_NG));
+        assertTrue(strategy.supportStoragePoolType(StoragePoolType.CLVM_NG, StoragePoolType.CLVM, StoragePoolType.CLVM_NG));
+
+        assertFalse(strategy.supportStoragePoolType(StoragePoolType.CLVM));
+        assertFalse(strategy.supportStoragePoolType(StoragePoolType.CLVM_NG));
+    }
+
+    /**
+     * Test configureMigrateDiskInfo with CLVM destination
+     */
+    @Test
+    public void testConfigureMigrateDiskInfo_ForClvm() {
+        VolumeObject srcVolumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn("/dev/vg/volume-path").when(srcVolumeInfo).getPath();
+
+        MigrateCommand.MigrateDiskInfo migrateDiskInfo = strategy.configureMigrateDiskInfo(
+                srcVolumeInfo, "/dev/vg/dest-path", null);
+
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DiskType.BLOCK, migrateDiskInfo.getDiskType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DriverType.RAW, migrateDiskInfo.getDriverType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.Source.DEV, migrateDiskInfo.getSource());
+        Assert.assertEquals("/dev/vg/dest-path", migrateDiskInfo.getSourceText());
+        Assert.assertEquals("/dev/vg/volume-path", migrateDiskInfo.getSerialNumber());
+    }
+
+    /**
+     * Test configureMigrateDiskInfo with CLVM_NG destination and backing file
+     */
+    @Test
+    public void testConfigureMigrateDiskInfo_ForClvmNgWithBacking() {
+        VolumeObject srcVolumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn("/dev/vg/volume-path").when(srcVolumeInfo).getPath();
+
+        MigrateCommand.MigrateDiskInfo migrateDiskInfo = strategy.configureMigrateDiskInfo(
+                srcVolumeInfo, "/dev/vg/dest-path", "/dev/vg/backing-template");
+
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DiskType.BLOCK, migrateDiskInfo.getDiskType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.DriverType.RAW, migrateDiskInfo.getDriverType());
+        Assert.assertEquals(MigrateCommand.MigrateDiskInfo.Source.DEV, migrateDiskInfo.getSource());
+        Assert.assertEquals("/dev/vg/dest-path", migrateDiskInfo.getSourceText());
+        Assert.assertEquals("/dev/vg/backing-template", migrateDiskInfo.getBackingStoreText());
+        Assert.assertEquals("/dev/vg/volume-path", migrateDiskInfo.getSerialNumber());
+    }
+
+    /**
+     * Test isStoragePoolTypeInList with CLVM types
+     */
+    @Test
+    public void testIsStoragePoolTypeInList_WithClvmTypes() {
+        StoragePoolType[] clvmTypes = new StoragePoolType[] {
+            StoragePoolType.CLVM,
+            StoragePoolType.CLVM_NG,
+            StoragePoolType.Filesystem
+        };
+
+        assertTrue(strategy.isStoragePoolTypeInList(StoragePoolType.CLVM, clvmTypes));
+        assertTrue(strategy.isStoragePoolTypeInList(StoragePoolType.CLVM_NG, clvmTypes));
+        assertTrue(strategy.isStoragePoolTypeInList(StoragePoolType.Filesystem, clvmTypes));
+        assertFalse(strategy.isStoragePoolTypeInList(StoragePoolType.NetworkFilesystem, clvmTypes));
+    }
+
+    /**
+     * Test supportStoragePoolType with mixed CLVM and NFS types
+     */
+    @Test
+    public void testSupportStoragePoolType_MixedClvmAndNfs() {
+        assertTrue(strategy.supportStoragePoolType(
+                StoragePoolType.CLVM,
+                StoragePoolType.CLVM,
+                StoragePoolType.CLVM_NG,
+                StoragePoolType.NetworkFilesystem
+        ));
+
+        assertTrue(strategy.supportStoragePoolType(
+                StoragePoolType.CLVM_NG,
+                StoragePoolType.CLVM,
+                StoragePoolType.CLVM_NG,
+                StoragePoolType.NetworkFilesystem
+        ));
+
+        assertTrue(strategy.supportStoragePoolType(
+                StoragePoolType.NetworkFilesystem,
+                StoragePoolType.CLVM,
+                StoragePoolType.CLVM_NG
+        ));
+    }
+
+    /**
+     * Test internalCanHandle with CLVM source and managed destination
+     */
+    @Test
+    public void testInternalCanHandle_ClvmSourceManagedDestination() {
+        VolumeObject volumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn(0L).when(volumeInfo).getPoolId();
+
+        DataStore ds = Mockito.spy(new PrimaryDataStoreImpl());
+
+        Map<VolumeInfo, DataStore> volumeMap = new HashMap<>();
+        volumeMap.put(volumeInfo, ds);
+
+        StoragePoolVO sourcePool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM).when(sourcePool).getPoolType();
+        Mockito.doReturn(true).when(sourcePool).isManaged();
+
+        Mockito.doReturn(sourcePool).when(primaryDataStoreDao).findById(0L);
+
+        StrategyPriority result = strategy.internalCanHandle(
+                volumeMap, new HostVO("srcHostUuid"), new HostVO("destHostUuid"));
+
+        Assert.assertEquals(StrategyPriority.HIGHEST, result);
+    }
+
+    /**
+     * Test internalCanHandle with CLVM_NG source and managed destination
+     */
+    @Test
+    public void testInternalCanHandle_ClvmNgSourceManagedDestination() {
+        VolumeObject volumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn(0L).when(volumeInfo).getPoolId();
+
+        DataStore ds = Mockito.spy(new PrimaryDataStoreImpl());
+
+        Map<VolumeInfo, DataStore> volumeMap = new HashMap<>();
+        volumeMap.put(volumeInfo, ds);
+
+        StoragePoolVO sourcePool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM_NG).when(sourcePool).getPoolType();
+        Mockito.doReturn(true).when(sourcePool).isManaged();
+
+        Mockito.doReturn(sourcePool).when(primaryDataStoreDao).findById(0L);
+
+        StrategyPriority result = strategy.internalCanHandle(
+                volumeMap, new HostVO("srcHostUuid"), new HostVO("destHostUuid"));
+
+        Assert.assertEquals(StrategyPriority.HIGHEST, result);
+    }
+
+    /**
+     * Test internalCanHandle with both CLVM source and CLVM_NG destination
+     */
+    @Test
+    public void testInternalCanHandle_ClvmToClvmNg() {
+        VolumeObject volumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn(0L).when(volumeInfo).getPoolId();
+
+        DataStore ds = Mockito.spy(new PrimaryDataStoreImpl());
+
+        Map<VolumeInfo, DataStore> volumeMap = new HashMap<>();
+        volumeMap.put(volumeInfo, ds);
+
+        StoragePoolVO sourcePool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM).when(sourcePool).getPoolType();
+        Mockito.doReturn(true).when(sourcePool).isManaged();
+
+        StoragePoolVO destPool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM_NG).when(destPool).getPoolType();
+
+        Mockito.doReturn(sourcePool).when(primaryDataStoreDao).findById(0L);
+
+        StrategyPriority result = strategy.internalCanHandle(
+                volumeMap, new HostVO("srcHostUuid"), new HostVO("destHostUuid"));
+
+        Assert.assertEquals(StrategyPriority.HIGHEST, result);
+    }
+
+    /**
+     * Test internalCanHandle with CLVM_NG to CLVM migration
+     */
+    @Test
+    public void testInternalCanHandle_ClvmNgToClvm() {
+        VolumeObject volumeInfo = Mockito.spy(new VolumeObject());
+        Mockito.doReturn(0L).when(volumeInfo).getPoolId();
+
+        DataStore ds = Mockito.spy(new PrimaryDataStoreImpl());
+
+        Map<VolumeInfo, DataStore> volumeMap = new HashMap<>();
+        volumeMap.put(volumeInfo, ds);
+
+        StoragePoolVO sourcePool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM_NG).when(sourcePool).getPoolType();
+        Mockito.doReturn(true).when(sourcePool).isManaged();
+
+        StoragePoolVO destPool = Mockito.spy(new StoragePoolVO());
+        Mockito.lenient().doReturn(StoragePoolType.CLVM).when(destPool).getPoolType();
+
+        Mockito.doReturn(sourcePool).when(primaryDataStoreDao).findById(0L);
+
+        StrategyPriority result = strategy.internalCanHandle(
+                volumeMap, new HostVO("srcHostUuid"), new HostVO("destHostUuid"));
+
+        Assert.assertEquals(StrategyPriority.HIGHEST, result);
+    }
 }
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategy.java
index 88f479c09045..d85e862bfb67 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategy.java
@@ -60,6 +60,7 @@
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.CreateSnapshotPayload;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.Snapshot;
@@ -643,6 +644,10 @@ public StrategyPriority canHandle(Snapshot snapshot, Long zoneId, SnapshotOperat
                 return StrategyPriority.DEFAULT;
             }
 
+            if (isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO)) {
+                return StrategyPriority.DEFAULT;
+            }
+
             return StrategyPriority.CANT_HANDLE;
         }
         if (zoneId != null && SnapshotOperation.DELETE.equals(op)) {
@@ -691,4 +696,32 @@ protected boolean isSnapshotStoredOnSameZoneStoreForQCOW2Volume(Snapshot snapsho
                         dataStoreMgr.getStoreZoneId(s.getDataStoreId(), s.getRole()), volumeVO.getDataCenterId()));
     }
 
+    /**
+     * Checks if a CLVM volume snapshot is stored on secondary storage in the same zone.
+     * CLVM snapshots are backed up to secondary storage and removed from primary storage.
+     */
+    protected boolean isSnapshotStoredOnSecondaryForCLVMVolume(Snapshot snapshot, VolumeVO volumeVO) {
+        if (volumeVO == null) {
+            return false;
+        }
+
+        Long poolId = volumeVO.getPoolId();
+        if (poolId == null) {
+            return false;
+        }
+
+        StoragePool pool = (StoragePool) dataStoreMgr.getDataStore(poolId, DataStoreRole.Primary);
+        if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            return false;
+        }
+
+        List<SnapshotDataStoreVO> snapshotStores = snapshotStoreDao.listReadyBySnapshot(snapshot.getId(), DataStoreRole.Image);
+        if (CollectionUtils.isEmpty(snapshotStores)) {
+            return false;
+        }
+
+        return snapshotStores.stream().anyMatch(s -> Objects.equals(
+                dataStoreMgr.getStoreZoneId(s.getDataStoreId(), s.getRole()), volumeVO.getDataCenterId()));
+    }
+
 }
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategy.java
index b71d6cf3afac..665c3a4659ca 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategy.java
@@ -27,6 +27,7 @@
 
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.Snapshot;
+import com.cloud.storage.Storage;
 import com.cloud.storage.dao.SnapshotDao;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
@@ -468,6 +469,13 @@ public boolean revertVMSnapshot(VMSnapshot vmSnapshot) {
 
     @Override
     public StrategyPriority canHandle(VMSnapshot vmSnapshot) {
+        UserVmVO vm = userVmDao.findById(vmSnapshot.getVmId());
+        String cantHandleLog = String.format("Default VM snapshot cannot handle VM snapshot for [%s]", vm);
+
+        if (isRunningVMVolumeOnCLVMStorage(vm, cantHandleLog)) {
+            return StrategyPriority.CANT_HANDLE;
+        }
+
         return StrategyPriority.DEFAULT;
     }
 
@@ -493,10 +501,31 @@ public boolean deleteVMSnapshotFromDB(VMSnapshot vmSnapshot, boolean unmanage) {
         return vmSnapshotDao.remove(vmSnapshot.getId());
     }
 
+    protected boolean isRunningVMVolumeOnCLVMStorage(UserVmVO vm, String cantHandleLog) {
+        Long vmId = vm.getId();
+        if (State.Running.equals(vm.getState())) {
+            List<VolumeVO> volumes = volumeDao.findByInstance(vmId);
+            for (VolumeVO volume : volumes) {
+                StoragePool pool = primaryDataStoreDao.findById(volume.getPoolId());
+                if (pool != null && pool.getPoolType() == Storage.StoragePoolType.CLVM) {
+                    logger.warn("Rejecting VM snapshot request: {} - VM is running on CLVM storage (pool: {}, poolType: CLVM)",
+                            cantHandleLog, pool.getName());
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
     @Override
     public StrategyPriority canHandle(Long vmId, Long rootPoolId, boolean snapshotMemory) {
         UserVmVO vm = userVmDao.findById(vmId);
         String cantHandleLog = String.format("Default VM snapshot cannot handle VM snapshot for [%s]", vm);
+
+        if (isRunningVMVolumeOnCLVMStorage(vm, cantHandleLog)) {
+            return StrategyPriority.CANT_HANDLE;
+        }
+
         if (State.Running.equals(vm.getState()) && !snapshotMemory) {
             logger.debug("{} as it is running and its memory will not be affected.", cantHandleLog, vm);
             return StrategyPriority.CANT_HANDLE;
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
index 31b13fc279e3..4ae6e26fbd96 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
@@ -345,6 +345,13 @@ public StrategyPriority canHandle(VMSnapshot vmSnapshot) {
            }
        }
 
+       Long vmId = vmSnapshot.getVmId();
+       UserVmVO vm = userVmDao.findById(vmId);
+       String cantHandleLog = String.format("Storage VM snapshot strategy cannot handle VM snapshot for [%s]", vm);
+       if (vm != null && isRunningVMVolumeOnCLVMStorage(vm, cantHandleLog)) {
+           return StrategyPriority.CANT_HANDLE;
+       }
+
        if ( SnapshotManager.VmStorageSnapshotKvm.value() && userVm.getHypervisorType() == Hypervisor.HypervisorType.KVM
                     && vmSnapshot.getType() == VMSnapshot.Type.Disk) {
            return StrategyPriority.HYPERVISOR;
diff --git a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategyTest.java b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategyTest.java
index 41bfaa6f0c77..c27d4e13fa4d 100644
--- a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategyTest.java
+++ b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/snapshot/DefaultSnapshotStrategyTest.java
@@ -21,6 +21,7 @@
 import java.util.List;
 
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.StoragePool;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
@@ -322,4 +323,236 @@ public void testIsSnapshotStoredOnSameZoneStoreForQCOW2VolumeHasRef() {
         prepareMocksForIsSnapshotStoredOnSameZoneStoreForQCOW2VolumeTest(100L);
         Assert.assertTrue(defaultSnapshotStrategySpy.isSnapshotStoredOnSameZoneStoreForQCOW2Volume(snapshot, volumeVO));
     }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_NullVolume() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, null));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_NullPoolId() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(null);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_NullPool() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn(null);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_NonCLVMPool() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_RBDPool() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolNoSnapshotStores() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image)).thenReturn(new ArrayList<>());
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolSnapshotInDifferentZone() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(100L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore1 = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore1.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore1.getRole()).thenReturn(DataStoreRole.Image);
+
+        SnapshotDataStoreVO snapshotStore2 = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore2.getDataStoreId()).thenReturn(202L);
+        Mockito.when(snapshotStore2.getRole()).thenReturn(DataStoreRole.Image);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore1, snapshotStore2));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(111L);
+        Mockito.when(dataStoreManager.getStoreZoneId(202L, DataStoreRole.Image)).thenReturn(112L);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolSnapshotInSameZone() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(100L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore.getRole()).thenReturn(DataStoreRole.Image);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(100L);
+
+        Assert.assertTrue(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolMultipleSnapshotsOneMatches() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(100L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore1 = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore1.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore1.getRole()).thenReturn(DataStoreRole.Image);
+
+        SnapshotDataStoreVO snapshotStore2 = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore2.getDataStoreId()).thenReturn(202L);
+        Mockito.when(snapshotStore2.getRole()).thenReturn(DataStoreRole.Image);
+
+        SnapshotDataStoreVO snapshotStore3 = Mockito.mock(SnapshotDataStoreVO.class);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore1, snapshotStore2, snapshotStore3));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(111L);
+        Mockito.when(dataStoreManager.getStoreZoneId(202L, DataStoreRole.Image)).thenReturn(100L);
+
+        Assert.assertTrue(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolNullZoneIds() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(100L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore.getRole()).thenReturn(DataStoreRole.Image);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(null);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolVolumeNullDataCenter() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(1L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore.getRole()).thenReturn(DataStoreRole.Image);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(100L);
+
+        Assert.assertFalse(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
+
+    @Test
+    public void testIsSnapshotStoredOnSecondaryForCLVMVolume_CLVMPoolMultipleSnapshotsAllInSameZone() {
+        Snapshot snapshot = Mockito.mock(Snapshot.class);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeVO.getPoolId()).thenReturn(10L);
+        Mockito.when(volumeVO.getDataCenterId()).thenReturn(100L);
+
+        StoragePool pool = Mockito.mock(StoragePool.class, Mockito.withSettings().extraInterfaces(DataStore.class));
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(dataStoreManager.getDataStore(10L, DataStoreRole.Primary)).thenReturn((DataStore) pool);
+
+        SnapshotDataStoreVO snapshotStore1 = Mockito.mock(SnapshotDataStoreVO.class);
+        Mockito.when(snapshotStore1.getDataStoreId()).thenReturn(201L);
+        Mockito.when(snapshotStore1.getRole()).thenReturn(DataStoreRole.Image);
+
+        SnapshotDataStoreVO snapshotStore2 = Mockito.mock(SnapshotDataStoreVO.class);
+
+        Mockito.when(snapshotDataStoreDao.listReadyBySnapshot(1L, DataStoreRole.Image))
+            .thenReturn(List.of(snapshotStore1, snapshotStore2));
+
+        Mockito.when(dataStoreManager.getStoreZoneId(201L, DataStoreRole.Image)).thenReturn(100L);
+
+        Assert.assertTrue(defaultSnapshotStrategySpy.isSnapshotStoredOnSecondaryForCLVMVolume(snapshot, volumeVO));
+    }
 }
diff --git a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategyTest.java b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategyTest.java
index da377f96ec32..365ba3d4eb31 100644
--- a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategyTest.java
+++ b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/DefaultVMSnapshotStrategyTest.java
@@ -22,6 +22,7 @@
 import java.util.List;
 import java.util.UUID;
 
+import org.apache.cloudstack.engine.subsystem.api.storage.StrategyPriority;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
@@ -39,6 +40,10 @@
 import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeVO;
 import com.cloud.storage.dao.VolumeDao;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine.State;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.snapshot.VMSnapshot;
 
 @RunWith(MockitoJUnitRunner.class)
 public class DefaultVMSnapshotStrategyTest {
@@ -46,6 +51,8 @@ public class DefaultVMSnapshotStrategyTest {
     VolumeDao volumeDao;
     @Mock
     PrimaryDataStoreDao primaryDataStoreDao;
+    @Mock
+    UserVmDao userVmDao;
 
     @Spy
     @InjectMocks
@@ -85,7 +92,7 @@ public void testUpdateVolumePath() {
         Mockito.when(vol2.getChainInfo()).thenReturn(newVolChain);
         Mockito.when(vol2.getSize()).thenReturn(vmSnapshotChainSize);
         Mockito.when(vol2.getId()).thenReturn(volumeId);
-        VolumeVO volumeVO = new VolumeVO("name", 0l, 0l, 0l, 0l, 0l, "folder", "path", Storage.ProvisioningType.THIN, 0l, Volume.Type.ROOT);
+        VolumeVO volumeVO = new VolumeVO("name", 0L, 0L, 0L, 0L, 0L, "folder", "path", Storage.ProvisioningType.THIN, 0L, Volume.Type.ROOT);
         volumeVO.setPoolId(oldPoolId);
         volumeVO.setChainInfo(oldVolChain);
         volumeVO.setPath(oldVolPath);
@@ -103,4 +110,110 @@ public void testUpdateVolumePath() {
         Assert.assertEquals(vmSnapshotChainSize, persistedVolume.getVmSnapshotChainSize());
         Assert.assertEquals(newVolChain, persistedVolume.getChainInfo());
     }
+
+    @Test
+    public void testCanHandleRunningVMOnClvmStorageCantHandle() {
+        Long vmId = 1L;
+        VMSnapshot vmSnapshot = Mockito.mock(VMSnapshot.class);
+        Mockito.when(vmSnapshot.getVmId()).thenReturn(vmId);
+
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getState()).thenReturn(State.Running);
+        Mockito.when(userVmDao.findById(vmId)).thenReturn(vm);
+
+        VolumeVO volumeOnClvm = createVolume(vmId, 1L);
+        List<VolumeVO> volumes = List.of(volumeOnClvm);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(volumes);
+
+        StoragePoolVO clvmPool = createStoragePool("clvm-pool", Storage.StoragePoolType.CLVM);
+        Mockito.when(primaryDataStoreDao.findById(1L)).thenReturn(clvmPool);
+
+        StrategyPriority result = defaultVMSnapshotStrategy.canHandle(vmSnapshot);
+
+        Assert.assertEquals("Should return CANT_HANDLE for running VM on CLVM storage",
+                StrategyPriority.CANT_HANDLE, result);
+    }
+
+    @Test
+    public void testCanHandleStoppedVMOnClvmStorageCanHandle() {
+        Long vmId = 1L;
+        VMSnapshot vmSnapshot = Mockito.mock(VMSnapshot.class);
+        Mockito.when(vmSnapshot.getVmId()).thenReturn(vmId);
+
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getState()).thenReturn(State.Stopped);
+        Mockito.when(userVmDao.findById(vmId)).thenReturn(vm);
+
+        StrategyPriority result = defaultVMSnapshotStrategy.canHandle(vmSnapshot);
+        Assert.assertEquals("Should return DEFAULT for stopped VM on CLVM storage",
+                StrategyPriority.DEFAULT, result);
+    }
+
+    @Test
+    public void testCanHandleRunningVMOnNfsStorageCanHandle() {
+        Long vmId = 1L;
+        VMSnapshot vmSnapshot = Mockito.mock(VMSnapshot.class);
+        Mockito.when(vmSnapshot.getVmId()).thenReturn(vmId);
+
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getState()).thenReturn(State.Running);
+        Mockito.when(userVmDao.findById(vmId)).thenReturn(vm);
+
+        VolumeVO volumeOnNfs = createVolume(vmId, 1L);
+        List<VolumeVO> volumes = List.of(volumeOnNfs);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(volumes);
+
+        StoragePoolVO nfsPool = createStoragePool("nfs-pool", Storage.StoragePoolType.NetworkFilesystem);
+        Mockito.when(primaryDataStoreDao.findById(1L)).thenReturn(nfsPool);
+
+        StrategyPriority result = defaultVMSnapshotStrategy.canHandle(vmSnapshot);
+
+        Assert.assertEquals("Should return DEFAULT for running VM on NFS storage",
+                StrategyPriority.DEFAULT, result);
+    }
+
+    @Test
+    public void testCanHandleRunningVMWithMixedStorageClvmAndNfsCantHandle() {
+        // Arrange - VM has volumes on both CLVM and NFS
+        Long vmId = 1L;
+        VMSnapshot vmSnapshot = Mockito.mock(VMSnapshot.class);
+        Mockito.when(vmSnapshot.getVmId()).thenReturn(vmId);
+
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getState()).thenReturn(State.Running);
+        Mockito.when(userVmDao.findById(vmId)).thenReturn(vm);
+
+        VolumeVO volumeOnClvm = createVolume(vmId, 1L);
+        VolumeVO volumeOnNfs = createVolume(vmId, 2L);
+        List<VolumeVO> volumes = List.of(volumeOnClvm, volumeOnNfs);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(volumes);
+
+        StoragePoolVO clvmPool = createStoragePool("clvm-pool", Storage.StoragePoolType.CLVM);
+        StoragePoolVO nfsPool = createStoragePool("nfs-pool", Storage.StoragePoolType.NetworkFilesystem);
+        Mockito.when(primaryDataStoreDao.findById(1L)).thenReturn(clvmPool);
+
+        StrategyPriority result = defaultVMSnapshotStrategy.canHandle(vmSnapshot);
+
+        Assert.assertEquals("Should return CANT_HANDLE if any volume is on CLVM storage for running VM",
+                StrategyPriority.CANT_HANDLE, result);
+    }
+
+    private VolumeVO createVolume(Long vmId, Long poolId) {
+        VolumeVO volume = new VolumeVO("volume", 0L, 0L, 0L, 0L, 0L,
+                "folder", "path", Storage.ProvisioningType.THIN, 0L, Volume.Type.ROOT);
+        volume.setInstanceId(vmId);
+        volume.setPoolId(poolId);
+        return volume;
+    }
+
+    private StoragePoolVO createStoragePool(String name, Storage.StoragePoolType poolType) {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(pool.getName()).thenReturn(name);
+        Mockito.when(pool.getPoolType()).thenReturn(poolType);
+        return pool;
+    }
 }
diff --git a/engine/storage/src/main/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelector.java b/engine/storage/src/main/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelector.java
index 061d18dc3769..7eee32b9f1b5 100644
--- a/engine/storage/src/main/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelector.java
+++ b/engine/storage/src/main/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelector.java
@@ -32,8 +32,12 @@
 
 import com.cloud.dc.DedicatedResourceVO;
 import com.cloud.dc.dao.DedicatedResourceDao;
+import com.cloud.storage.Volume;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.storage.dao.VolumeDetailsDao;
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.QueryBuilder;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
@@ -46,6 +50,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.storage.LocalHostEndpoint;
 import org.apache.cloudstack.storage.RemoteHostEndPoint;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
 import org.springframework.stereotype.Component;
@@ -59,8 +64,8 @@
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Storage.TemplateType;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import com.cloud.utils.db.DB;
-import com.cloud.utils.db.QueryBuilder;
 import com.cloud.utils.db.SearchCriteria.Op;
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -75,6 +80,12 @@ public class DefaultEndPointSelector implements EndPointSelector {
     private HostDao hostDao;
     @Inject
     private DedicatedResourceDao dedicatedResourceDao;
+    @Inject
+    private PrimaryDataStoreDao _storagePoolDao;
+    @Inject
+    private VolumeDetailsDao _volDetailsDao;
+    @Inject
+    private ClvmPoolManager clvmPoolManager;
 
     private static final String VOL_ENCRYPT_COLUMN_NAME = "volume_encryption_support";
     private final String findOneHostOnPrimaryStorage = "select t.id from "
@@ -264,6 +275,27 @@ public EndPoint select(DataObject srcData, DataObject destData) {
 
     @Override
     public EndPoint select(DataObject srcData, DataObject destData, boolean volumeEncryptionSupportRequired) {
+        if (destData instanceof VolumeInfo) {
+            EndPoint clvmEndpoint = selectClvmEndpointIfApplicable((VolumeInfo) destData, "template-to-volume copy");
+            if (clvmEndpoint != null) {
+                return clvmEndpoint;
+            }
+        }
+
+        // Check if SOURCE is a CLVM volume with active lock (for operations copying FROM CLVM to secondary storage)
+        if (srcData instanceof VolumeInfo) {
+            VolumeInfo srcVolume = (VolumeInfo) srcData;
+            DataStore srcStore = srcVolume.getDataStore();
+            if (srcStore.getRole() == DataStoreRole.Primary) {
+                StoragePoolVO pool = _storagePoolDao.findById(srcStore.getId());
+                EndPoint clvmEp = tryRouteToClvmLockHolder(srcVolume, pool, "copy operation");
+                if (clvmEp != null) {
+                    return clvmEp;
+                }
+            }
+        }
+
+        // Default behavior for non-CLVM or when no destination host is set
         DataStore srcStore = srcData.getDataStore();
         DataStore destStore = destData.getDataStore();
         if (moveBetweenPrimaryImage(srcStore, destStore)) {
@@ -305,7 +337,6 @@ public EndPoint select(DataObject srcData, DataObject destData, StorageAction ac
 
     @Override
     public EndPoint select(DataObject srcData, DataObject destData, StorageAction action, boolean encryptionRequired) {
-        logger.error("IR24 select BACKUPSNAPSHOT from primary to secondary {} dest={}", srcData, destData);
         if (action == StorageAction.BACKUPSNAPSHOT && srcData.getDataStore().getRole() == DataStoreRole.Primary) {
             SnapshotInfo srcSnapshot = (SnapshotInfo)srcData;
             VolumeInfo volumeInfo = srcSnapshot.getBaseVolume();
@@ -314,6 +345,17 @@ public EndPoint select(DataObject srcData, DataObject destData, StorageAction ac
                 if (vm != null && vm.getState() == VirtualMachine.State.Running) {
                     return getEndPointFromHostId(vm.getHostId());
                 }
+                // For CLVM pools, the snapshot LVM device only exists on the lock-holder host.
+                // Route the backup CopyCommand to that same host regardless of VM state.
+                DataStore srcStore = volumeInfo.getDataStore();
+                if (srcStore != null && srcStore.getRole() == DataStoreRole.Primary) {
+                    StoragePoolVO pool = _storagePoolDao.findById(srcStore.getId());
+                    logger.debug("Checking if CLVM store and lock-holder routing applicable for snapshot {}", srcSnapshot.getUuid());
+                    EndPoint clvmEp = tryRouteToClvmLockHolder(volumeInfo, pool, "snapshot backup");
+                    if (clvmEp != null) {
+                        return clvmEp;
+                    }
+                }
             }
             if (srcSnapshot.getHypervisorType() == Hypervisor.HypervisorType.VMware) {
                 if (vm != null) {
@@ -388,18 +430,103 @@ private List<HostVO> listUpAndConnectingSecondaryStorageVmHost(Long dcId) {
         return sc.list();
     }
 
+    /**
+     * Selects endpoint for CLVM volumes with destination host hint.
+     * This ensures volumes are created on the correct host with exclusive locks.
+     *
+     * @param volume The volume to check for CLVM routing
+     * @param operation Description of the operation (for logging)
+     * @return EndPoint for the destination host if CLVM routing applies, null otherwise
+     */
+    private EndPoint selectClvmEndpointIfApplicable(VolumeInfo volume, String operation) {
+        DataStore store = volume.getDataStore();
+
+        if (store.getRole() != DataStoreRole.Primary) {
+            return null;
+        }
+
+
+        // Check if this is a CLVM pool
+        StoragePoolVO pool = _storagePoolDao.findById(store.getId());
+        if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            return null;
+        }
+        if (Volume.State.Allocated == volume.getState()) {
+            // Check if destination host hint is set
+            Long destHostId = volume.getDestinationHostId();
+            if (destHostId == null) {
+                return null;
+            }
+
+            logger.info("CLVM {}: routing volume {} to destination host {} for optimal exclusive lock placement",
+                    operation, volume.getUuid(), destHostId);
+
+            EndPoint ep = getEndPointFromHostId(destHostId);
+            if (ep != null) {
+                return ep;
+            }
+        }
+
+        Long lockHostId = getClvmLockHostId(volume);
+        if (lockHostId == null) {
+            return null;
+        }
+        logger.info("CLVM {}: routing existing volume {} to live lock-holder host {}",
+                operation, volume.getUuid(), lockHostId);
+        EndPoint ep = getEndPointFromHostId(lockHostId);
+        if (ep != null) {
+            return ep;
+        }
+        logger.warn("Could not get endpoint for lock host {}, falling back to default selection", lockHostId);
+        return null;
+    }
+
     @Override
     public EndPoint select(DataObject object, boolean encryptionSupportRequired) {
         DataStore store = object.getDataStore();
+
+        // This ensures volumes are created on the correct host with exclusive locks
+        String operation = "";
+        if (DataStoreRole.Primary == store.getRole()) {
+            VolumeInfo volume = null;
+            if (object instanceof VolumeInfo) {
+                volume = (VolumeInfo) object;
+                operation = "volume creation";
+            } else if (object instanceof SnapshotInfo) {
+                volume = ((SnapshotInfo) object).getBaseVolume();
+                operation = "snapshot creation";
+            }
+
+            if (volume != null) {
+                EndPoint clvmEndpoint = selectClvmEndpointIfApplicable(volume, operation);
+                if (clvmEndpoint != null) {
+                    return clvmEndpoint;
+                }
+            }
+        }
+
+        // Default behavior for non-CLVM or when no destination host is set
         if (store.getRole() == DataStoreRole.Primary) {
             return findEndPointInScope(store.getScope(), findOneHostOnPrimaryStorage, store.getId(), encryptionSupportRequired);
         }
         throw new CloudRuntimeException(String.format("Storage role %s doesn't support encryption", store.getRole()));
     }
 
+
     @Override
     public EndPoint select(DataObject object) {
         DataStore store = object.getDataStore();
+
+        // For CLVM volumes, check if there's a lock host ID to route to
+        if (object instanceof VolumeInfo && store.getRole() == DataStoreRole.Primary) {
+            VolumeInfo volume = (VolumeInfo) object;
+            StoragePoolVO pool = _storagePoolDao.findById(store.getId());
+            EndPoint clvmEp = tryRouteToClvmLockHolder(volume, pool, "operation");
+            if (clvmEp != null) {
+                return clvmEp;
+            }
+        }
+
         EndPoint ep = select(store);
         if (ep != null) {
             return ep;
@@ -493,6 +620,19 @@ public EndPoint select(DataObject object, StorageAction action, boolean encrypti
             }
             case DELETEVOLUME: {
                 VolumeInfo volume = (VolumeInfo) object;
+
+                // For CLVM volumes, route to the host holding the exclusive lock
+                if (volume.getHypervisorType() == Hypervisor.HypervisorType.KVM) {
+                    DataStore store = volume.getDataStore();
+                    if (store.getRole() == DataStoreRole.Primary) {
+                        StoragePoolVO pool = _storagePoolDao.findById(store.getId());
+                        EndPoint clvmEp = tryRouteToClvmLockHolder(volume, pool, "deletion");
+                        if (clvmEp != null) {
+                            return clvmEp;
+                        }
+                    }
+                }
+
                 if (volume.getHypervisorType() == Hypervisor.HypervisorType.VMware) {
                     VirtualMachine vm = volume.getAttachedVM();
                     if (vm != null) {
@@ -540,6 +680,14 @@ protected EndPoint getEndPointForSnapshotOperationsInKvm(SnapshotInfo snapshotIn
 
         if (vm.getState() == VirtualMachine.State.Running) {
             return getEndPointFromHostId(vm.getHostId());
+        } else if (vm.getState() == VirtualMachine.State.Stopped) {
+            StoragePoolVO pool = _storagePoolDao.findById(volumeInfo.getPoolId());
+            if (pool != null && ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+                EndPoint ep = getApplicableEndpointForClvm(snapshotInfo, volumeInfo);
+                if (ep != null) {
+                    return ep;
+                }
+            }
         }
 
         Long hostId = vm.getLastHostId();
@@ -552,6 +700,20 @@ protected EndPoint getEndPointForSnapshotOperationsInKvm(SnapshotInfo snapshotIn
         return select(snapshotInfo, encryptionRequired);
     }
 
+    private EndPoint getApplicableEndpointForClvm(SnapshotInfo snapshotInfo, VolumeInfo volumeInfo) {
+        Long lockHostId = getClvmLockHostId(volumeInfo);
+        if (lockHostId != null) {
+            logger.debug("CLVM snapshot operation: routing snapshot [{}] to lock-holder host [{}]",
+                    snapshotInfo.getUuid(), lockHostId);
+            EndPoint ep = getEndPointFromHostId(lockHostId);
+            if (ep != null) {
+                return ep;
+            }
+            logger.warn("Could not get endpoint for CLVM lock host {}, falling back", lockHostId);
+        }
+        return null;
+    }
+
     @Override
     public EndPoint select(Scope scope, Long storeId) {
         return findEndPointInScope(scope, findOneHostOnPrimaryStorage, storeId);
@@ -589,4 +751,46 @@ public List<EndPoint> selectAll(DataStore store) {
         }
         return endPoints;
     }
+
+    protected EndPoint tryRouteToClvmLockHolder(VolumeInfo volume, StoragePoolVO pool, String operation) {
+        if (pool == null || !ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            return null;
+        }
+        Long lockHostId = getClvmLockHostId(volume);
+        if (lockHostId == null) {
+            logger.debug("No CLVM lock host tracked for volume {}, using default endpoint selection", volume.getUuid());
+            return null;
+        }
+        logger.info("Routing CLVM volume {} {} to lock holder host {}", volume.getUuid(), operation, lockHostId);
+        EndPoint ep = getEndPointFromHostId(lockHostId);
+        if (ep != null) {
+            return ep;
+        }
+        logger.warn("Could not get endpoint for CLVM lock host {}, falling back to default selection", lockHostId);
+        return null;
+    }
+
+    /**
+     * Gets the CLVM lock host ID for a volume by querying actual LVM state.
+     *
+     * @param volume The CLVM volume
+     * @return Host ID holding the lock, or null if not found
+     */
+    protected Long getClvmLockHostId(VolumeInfo volume) {
+        StoragePoolVO pool = _storagePoolDao.findById(volume.getPoolId());
+
+        Long lockHostId = clvmPoolManager.getClvmLockHostId(
+                volume.getId(),
+                volume.getUuid(),
+                volume.getPath(),
+                pool,
+                true
+        );
+
+        if (lockHostId != null) {
+            logger.debug("Found actual lock host {} for volume {} via LVM query", lockHostId, volume.getUuid());
+        }
+
+        return lockHostId;
+    }
 }
diff --git a/engine/storage/src/test/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelectorTest.java b/engine/storage/src/test/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelectorTest.java
index 9f01ab162ba7..ca124ec30f04 100644
--- a/engine/storage/src/test/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelectorTest.java
+++ b/engine/storage/src/test/java/org/apache/cloudstack/storage/endpoint/DefaultEndPointSelectorTest.java
@@ -17,20 +17,41 @@
 package org.apache.cloudstack.storage.endpoint;
 
 
+import com.cloud.host.Host;
+import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Volume;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.Storage.StoragePoolType;
+import com.cloud.storage.VolumeDetailVO;
+import com.cloud.storage.dao.VolumeDetailsDao;
 import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
+import org.apache.cloudstack.engine.subsystem.api.storage.Scope;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
+import org.apache.cloudstack.engine.subsystem.api.storage.StorageAction;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.RemoteHostEndPoint;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.AfterClass;
 import org.junit.Before;
+import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
 import org.mockito.Mock;
+import org.mockito.MockedStatic;
 import org.mockito.Mockito;
-import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mockStatic;
+
 @RunWith(MockitoJUnitRunner.class)
 public class DefaultEndPointSelectorTest {
 
@@ -46,12 +67,55 @@ public class DefaultEndPointSelectorTest {
     @Mock
     private DataStore datastoreMock;
 
-    @Spy
-    private DefaultEndPointSelector defaultEndPointSelectorSpy;
+    @Mock
+    private StoragePoolVO storagePoolVOMock;
+
+    @Mock
+    private PrimaryDataStoreDao _storagePoolDao;
+
+    @Mock
+    private VolumeDetailsDao _volDetailsDao;
+
+    @Mock
+    private VolumeDetailVO volumeDetailVOMock;
+
+    @Mock
+    private EndPoint endPointMock;
+
+    @Mock
+    ClvmPoolManager clvmPoolManager;
+
+    @Mock
+    HostDao hostDao;
+
+    static MockedStatic<RemoteHostEndPoint> remoteHostEndPointMock;
+
+    @InjectMocks
+    private DefaultEndPointSelector defaultEndPointSelectorSpy = Mockito.spy(new DefaultEndPointSelector());
+
+    private static final Long VOLUME_ID = 1L;
+    private static final Long HOST_ID = 10L;
+    private static final Long DEST_HOST_ID = 20L;
+    private static final Long STORE_ID = 100L;
+    private static final String VOLUME_UUID = "test-volume-uuid";
+
+    @BeforeClass
+    public static void init() {
+        remoteHostEndPointMock = mockStatic(RemoteHostEndPoint.class);
+    }
+
+    @AfterClass
+    public static void close() {
+        remoteHostEndPointMock.close();
+    }
 
     @Before
     public void setup() {
         Mockito.doReturn(volumeInfoMock).when(snapshotInfoMock).getBaseVolume();
+
+        // Common volume mock setup
+        Mockito.when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        Mockito.when(volumeInfoMock.getUuid()).thenReturn(VOLUME_UUID);
     }
 
     @Test
@@ -197,4 +261,293 @@ public void getEndPointForSnapshotOperationsInKvmTestVolumeAttachedToStoppedVmAn
         Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).select(snapshotInfoMock, false);
     }
 
+
+    @Test
+    public void testSelectClvmEndpoint_VolumeWithDestinationHost_CLVM() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.when(volumeInfoMock.getDestinationHostId()).thenReturn(DEST_HOST_ID);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(DEST_HOST_ID);
+        Mockito.when(volumeInfoMock.getState()).thenReturn(Volume.State.Allocated);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectClvmEndpoint_VolumeWithDestinationHost_CLVM_NG() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(DEST_HOST_ID);
+        Mockito.doReturn(DEST_HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectClvmEndpoint_VolumeWithoutDestinationHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.when(volumeInfoMock.getDestinationHostId()).thenReturn(null);
+        Mockito.when(datastoreMock.getScope()).thenReturn(Mockito.mock(Scope.class));
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).findEndPointInScope(
+                Mockito.any(), Mockito.anyString(), Mockito.eq(STORE_ID), Mockito.eq(false));
+        Mockito.when(volumeInfoMock.getState()).thenReturn(Volume.State.Allocated);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, false);
+
+        assertNotNull(result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.never()).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectClvmEndpoint_NonCLVMPool() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.NetworkFilesystem);
+        Mockito.when(datastoreMock.getScope()).thenReturn(Mockito.mock(Scope.class));
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).findEndPointInScope(
+                Mockito.any(), Mockito.anyString(), Mockito.eq(STORE_ID), Mockito.eq(false));
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, false);
+
+        assertNotNull(result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.never()).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectClvmEndpoint_SnapshotWithBaseVolumeDestHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(snapshotInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(snapshotInfoMock.getBaseVolume()).thenReturn(volumeInfoMock);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(DEST_HOST_ID);
+        Mockito.doReturn(DEST_HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.when(volumeInfoMock.getState()).thenReturn(Volume.State.Creating);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(snapshotInfoMock, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectWithAction_DeleteVolume_CLVMWithLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(volumeInfoMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(HOST_ID);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, StorageAction.DELETEVOLUME, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(HOST_ID);
+    }
+
+    @Test
+    public void testSelectWithAction_DeleteVolume_CLVM_NG_WithLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(volumeInfoMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+        Mockito.doReturn(HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(HOST_ID);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, StorageAction.DELETEVOLUME, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(HOST_ID);
+    }
+
+    @Test
+    public void testSelectWithAction_DeleteVolume_CLVMWithoutLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(volumeInfoMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).select(volumeInfoMock, false);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, StorageAction.DELETEVOLUME, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).select(volumeInfoMock, false);
+    }
+
+    @Test
+    public void testSelectWithAction_DeleteVolume_NonCLVM() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(volumeInfoMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.NetworkFilesystem);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).select(volumeInfoMock, false);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock, StorageAction.DELETEVOLUME, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(_volDetailsDao, Mockito.never()).findDetail(Mockito.anyLong(), Mockito.anyString());
+    }
+
+    @Test
+    public void testSelectObject_CLVMVolumeWithLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(HOST_ID);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(HOST_ID);
+    }
+
+    @Test
+    public void testSelectObject_CLVM_NG_VolumeWithLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+        Mockito.doReturn(HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(HOST_ID);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(HOST_ID);
+    }
+
+    @Test
+    public void testSelectObject_CLVMVolumeWithoutLockHost() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).select(datastoreMock);
+        RemoteHostEndPoint ep = Mockito.mock(RemoteHostEndPoint.class);
+        Host lockHost = Mockito.mock(Host.class);
+        remoteHostEndPointMock.when(() -> RemoteHostEndPoint.getHypervisorHostEndPoint(lockHost)).thenReturn(ep);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).select(datastoreMock);
+    }
+
+    @Test
+    public void testSelectObject_CLVMVolumeWithInvalidLockHostId() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).select(datastoreMock);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).select(datastoreMock);
+    }
+
+    @Test
+    public void testSelectObject_CLVMVolumeWithEmptyLockHostId() {
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).select(datastoreMock);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(volumeInfoMock);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).select(datastoreMock);
+    }
+
+    @Test
+    public void testSelectTwoObjects_TemplateToVolume_CLVMWithDestHost() {
+        DataObject srcDataMock = Mockito.mock(DataObject.class);
+
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).getEndPointFromHostId(DEST_HOST_ID);
+        Mockito.doReturn(DEST_HOST_ID).when(defaultEndPointSelectorSpy).getClvmLockHostId(volumeInfoMock);
+        Mockito.when(volumeInfoMock.getState()).thenReturn(Volume.State.Creating);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(srcDataMock, volumeInfoMock, false);
+
+        assertNotNull(result);
+        assertEquals(endPointMock, result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).getEndPointFromHostId(DEST_HOST_ID);
+    }
+
+    @Test
+    public void testSelectTwoObjects_TemplateToVolume_CLVMWithoutDestHost() {
+        DataObject srcDataMock = Mockito.mock(DataObject.class);
+        DataStore srcStoreMock = Mockito.mock(DataStore.class);
+
+        Mockito.when(srcDataMock.getDataStore()).thenReturn(srcStoreMock);
+        Mockito.when(srcStoreMock.getRole()).thenReturn(DataStoreRole.Image);
+
+        Mockito.when(volumeInfoMock.getDataStore()).thenReturn(datastoreMock);
+        Mockito.when(datastoreMock.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(datastoreMock.getId()).thenReturn(STORE_ID);
+        Mockito.when(_storagePoolDao.findById(STORE_ID)).thenReturn(storagePoolVOMock);
+        Mockito.when(storagePoolVOMock.getPoolType()).thenReturn(StoragePoolType.CLVM);
+        Mockito.doReturn(endPointMock).when(defaultEndPointSelectorSpy).findEndPointForImageMove(
+                srcStoreMock, datastoreMock, false);
+
+        EndPoint result = defaultEndPointSelectorSpy.select(srcDataMock, volumeInfoMock, false);
+
+        assertNotNull(result);
+        Mockito.verify(defaultEndPointSelectorSpy, Mockito.times(1)).findEndPointForImageMove(srcStoreMock, datastoreMock, false);
+    }
+
 }
diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/provider/DefaultHostListener.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/provider/DefaultHostListener.java
index 7de9000782ec..7644d4688f7e 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/provider/DefaultHostListener.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/provider/DefaultHostListener.java
@@ -37,6 +37,7 @@
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.offerings.NetworkOfferingVO;
 import com.cloud.offerings.dao.NetworkOfferingDao;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.Storage;
 import com.cloud.storage.StorageManager;
@@ -139,6 +140,18 @@ public boolean hostConnect(long hostId, long poolId) throws StorageConflictExcep
         Map<String, String> nfsMountOpts = storageManager.getStoragePoolNFSMountOpts(pool, null).first();
 
         Optional.ofNullable(nfsMountOpts).ifPresent(detailsMap::putAll);
+
+        // Propagate CLVM secure zero-fill setting to the host
+        // Note: This is done during host connection (agent start, MS restart, host reconnection)
+        // so the setting is non-dynamic. Changes require host reconnection to take effect.
+        if (ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            Boolean clvmSecureZeroFill = ClvmPoolManager.CLVMSecureZeroFill.valueIn(poolId);
+            if (clvmSecureZeroFill != null) {
+                detailsMap.put("clvmsecurezerofill", String.valueOf(clvmSecureZeroFill));
+                logger.debug("Added CLVM secure zero-fill setting: {} for storage pool: {}", clvmSecureZeroFill, pool);
+            }
+        }
+
         ModifyStoragePoolCommand cmd = new ModifyStoragePoolCommand(true, pool, detailsMap);
         cmd.setWait(modifyStoragePoolCommandWait);
         HostVO host = hostDao.findById(hostId);
diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeObject.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeObject.java
index 43218b3f6a02..20d677f90137 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeObject.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeObject.java
@@ -24,6 +24,7 @@
 import com.cloud.dc.VsphereStoragePolicyVO;
 import com.cloud.dc.dao.VsphereStoragePolicyDao;
 import com.cloud.storage.StorageManager;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.utils.Pair;
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallbackNoReturn;
@@ -126,6 +127,7 @@ public class VolumeObject implements VolumeInfo {
     private boolean directDownload;
     private String vSphereStoragePolicyId;
     private boolean followRedirects;
+    private Long destinationHostId;  // For CLVM: hints where volume should be created
 
     private List<String> checkpointPaths;
     private Set<String> checkpointImageStoreUrls;
@@ -361,6 +363,30 @@ public void setDirectDownload(boolean directDownload) {
         this.directDownload = directDownload;
     }
 
+    @Override
+    public Long getDestinationHostId() {
+        // If not in memory, try to load from the database (volume_details table)
+        // For CLVM volumes, this uses the CLVM_LOCK_HOST_ID, which serves a dual purpose:
+        // 1. During creation: hints where to create the volume
+        // 2. After creation: tracks which host holds the exclusive lock
+        if (destinationHostId == null && volumeVO != null) {
+            VolumeDetailVO detail = volumeDetailsDao.findDetail(volumeVO.getId(), ClvmPoolManager.CLVM_LOCK_HOST_ID);
+            if (detail != null && detail.getValue() != null && !detail.getValue().isEmpty()) {
+                try {
+                    destinationHostId = Long.parseLong(detail.getValue());
+                } catch (NumberFormatException e) {
+                    logger.warn("Invalid CLVM lock host ID value in volume_details for volume {}: {}", volumeVO.getUuid(), detail.getValue());
+                }
+            }
+        }
+        return destinationHostId;
+    }
+
+    @Override
+    public void setDestinationHostId(Long hostId) {
+        this.destinationHostId = hostId;
+    }
+
     public void update() {
         volumeDao.update(volumeVO.getId(), volumeVO);
         volumeVO = volumeDao.findById(volumeVO.getId());
diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
index 8731e8791ddd..6fe4c2708c59 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
@@ -32,6 +32,8 @@
 
 import javax.inject.Inject;
 
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
@@ -221,6 +223,8 @@ public class VolumeServiceImpl implements VolumeService {
     private PassphraseDao passphraseDao;
     @Inject
     protected DiskOfferingDao diskOfferingDao;
+    @Inject
+    ClvmPoolManager clvmPoolManager;
 
     public VolumeServiceImpl() {
     }
@@ -2970,4 +2974,173 @@ public void moveVolumeOnSecondaryStorageToAnotherAccount(Volume volume, Account
     protected String buildVolumePath(long accountId, long volumeId) {
         return String.format("%s/%s/%s", TemplateConstants.DEFAULT_VOLUME_ROOT_DIR, accountId, volumeId);
     }
+
+    @Override
+    public boolean transferVolumeLock(VolumeInfo volume, Long sourceHostId, Long destHostId) {
+        StoragePoolVO pool = storagePoolDao.findById(volume.getPoolId());
+        if (pool == null) {
+            logger.error("Cannot transfer volume lock for volume {}: storage pool not found", volume.getUuid());
+            return false;
+        }
+
+        logger.info("Transferring CLVM lock for volume {} (pool: {}) from host {} to host {}",
+                volume.getUuid(), pool.getName(), sourceHostId, destHostId);
+
+        return clvmPoolManager.transferClvmVolumeLock(volume.getUuid(), volume.getId(), volume.getPath(),
+                pool, sourceHostId, destHostId);
+    }
+
+    @Override
+    public Long findVolumeLockHost(VolumeInfo volume) {
+        if (volume == null) {
+            logger.warn("Cannot find volume lock host: volume is null");
+            return null;
+        }
+
+        StoragePoolVO pool = storagePoolDao.findById(volume.getPoolId());
+
+        Long lockHostId = clvmPoolManager.getClvmLockHostId(
+                volume.getId(),
+                volume.getUuid(),
+                volume.getPath(),
+                pool,
+                true
+        );
+
+        if (lockHostId != null) {
+            logger.debug("Found actual lock host {} for volume {}", lockHostId, volume.getUuid());
+            return lockHostId;
+        }
+
+        Long instanceId = volume.getInstanceId();
+        if (instanceId != null) {
+            VMInstanceVO vmInstance = vmDao.findById(instanceId);
+            if (vmInstance != null && vmInstance.getHostId() != null) {
+                logger.debug("Volume {} is attached to VM {} on host {}",
+                        volume.getUuid(), vmInstance.getUuid(), vmInstance.getHostId());
+                return vmInstance.getHostId();
+            }
+        }
+
+        if (pool != null && pool.getClusterId() != null) {
+            List<HostVO> hosts = _hostDao.findByClusterId(pool.getClusterId());
+            if (hosts != null && !hosts.isEmpty()) {
+                for (HostVO host : hosts) {
+                    if (host.getStatus() == com.cloud.host.Status.Up) {
+                        logger.debug("Using fallback: first UP host {} in cluster {} for volume {}",
+                                host.getId(), pool.getClusterId(), volume.getUuid());
+                        return host.getId();
+                    }
+                }
+            }
+        }
+
+        logger.warn("Could not determine lock host for volume {}", volume.getUuid());
+        return null;
+    }
+
+    @Override
+    public VolumeInfo performLockMigration(VolumeInfo volume, Long destHostId) {
+        if (volume == null) {
+            throw new CloudRuntimeException("Cannot perform CLVM lock migration: volume is null");
+        }
+
+        String volumeUuid = volume.getUuid();
+        logger.info("Starting CLVM lock migration for volume {} (id: {}) to host {}",
+                volumeUuid, volume.getUuid(), destHostId);
+
+        Long sourceHostId = findVolumeLockHost(volume);
+        if (sourceHostId == null) {
+            logger.warn("Could not determine source host for CLVM volume {} lock, assuming volume is not exclusively locked",
+                    volumeUuid);
+            sourceHostId = destHostId;
+        }
+
+        if (sourceHostId.equals(destHostId)) {
+            logger.info("CLVM volume {} already has lock on destination host {}, no migration needed",
+                    volumeUuid, destHostId);
+            return volume;
+        }
+
+        logger.info("Migrating CLVM volume {} lock from host {} to host {}",
+                volumeUuid, sourceHostId, destHostId);
+
+        boolean success = transferVolumeLock(volume, sourceHostId, destHostId);
+        if (!success) {
+            throw new CloudRuntimeException(
+                    String.format("Failed to transfer CLVM lock for volume %s from host %s to host %s",
+                            volumeUuid, sourceHostId, destHostId));
+        }
+
+        logger.info("Successfully migrated CLVM volume {} lock from host {} to host {}",
+                volumeUuid, sourceHostId, destHostId);
+
+        return volFactory.getVolume(volume.getId());
+    }
+
+    @Override
+    public boolean areBothPoolsClvmType(StoragePoolType volumePoolType, StoragePoolType vmPoolType) {
+        if (volumePoolType == null || vmPoolType == null) {
+            logger.debug("Cannot check if both pools are CLVM type: one or both pool types are null");
+            return false;
+        }
+        return ClvmPoolManager.isClvmPoolType(volumePoolType) &&
+               ClvmPoolManager.isClvmPoolType(vmPoolType);
+    }
+
+    @Override
+    public boolean isLockTransferRequired(VolumeInfo volumeToAttach, StoragePoolType volumePoolType, StoragePoolType vmPoolType,
+                                          Long volumePoolId, Long vmPoolId, Long vmHostId) {
+        if (volumePoolType != null && !ClvmPoolManager.isClvmPoolType(volumePoolType)) {
+            return false;
+        }
+
+        if (volumePoolId == null || !volumePoolId.equals(vmPoolId)) {
+            return false;
+        }
+
+        Long volumeLockHostId = findVolumeLockHost(volumeToAttach);
+
+        if (volumeLockHostId == null) {
+            VolumeVO volumeVO = _volumeDao.findById(volumeToAttach.getId());
+            if (volumeVO != null && volumeVO.getState() == Volume.State.Ready && volumeVO.getInstanceId() == null) {
+                logger.debug("CLVM volume {} is detached on same pool, lock transfer may be needed",
+                        volumeToAttach.getUuid());
+                return true;
+            }
+        }
+
+        if (volumeLockHostId != null && vmHostId != null && !volumeLockHostId.equals(vmHostId)) {
+            logger.info("CLVM lock transfer required: Volume {} lock is on host {} but VM is on host {}",
+                    volumeToAttach.getUuid(), volumeLockHostId, vmHostId);
+            return true;
+        }
+
+        return false;
+    }
+
+    @Override
+    public boolean isLightweightMigrationNeeded(StoragePoolType volumePoolType, StoragePoolType vmPoolType,
+                                                String volumePoolPath, String vmPoolPath) {
+        if (!areBothPoolsClvmType(volumePoolType, vmPoolType)) {
+            return false;
+        }
+
+        String volumeVgName = extractVgNameFromPath(volumePoolPath);
+        String vmVgName = extractVgNameFromPath(vmPoolPath);
+
+        if (volumeVgName != null && volumeVgName.equals(vmVgName)) {
+            logger.info("CLVM lightweight migration detected: Volume is in same VG ({}), only lock transfer needed (no data copy)", volumeVgName);
+            return true;
+        }
+
+        return false;
+    }
+
+    private String extractVgNameFromPath(String poolPath) {
+        if (poolPath == null) {
+            return null;
+        }
+        return poolPath.startsWith("/") ? poolPath.substring(1) : poolPath;
+    }
 }
diff --git a/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java b/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java
new file mode 100644
index 000000000000..38af2a7550b3
--- /dev/null
+++ b/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java
@@ -0,0 +1,520 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.volume;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.eq;
+
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.storage.Storage.StoragePoolType;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+
+/**
+ * Tests for CLVM lock management methods in VolumeServiceImpl.
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class VolumeServiceImplClvmTest {
+
+    @Spy
+    @InjectMocks
+    private VolumeServiceImpl volumeService;
+
+    @Mock
+    private VolumeDao volumeDao;
+
+    @Mock
+    private PrimaryDataStoreDao storagePoolDao;
+
+    @Mock
+    private HostDao _hostDao;
+
+    @Mock
+    private VMInstanceDao vmDao;
+
+    @Mock
+    private VolumeDataFactory volFactory;
+
+    @Mock
+    private VolumeInfo volumeInfoMock;
+
+    @Mock
+    private VolumeVO volumeVOMock;
+
+    @Mock
+    private StoragePoolVO storagePoolVOMock;
+
+    @Mock
+    private HostVO hostVOMock;
+
+    @Mock
+    private VMInstanceVO vmInstanceVOMock;
+
+    @Mock
+    private ClvmPoolManager clvmPoolManager;
+
+    private static final Long VOLUME_ID = 1L;
+    private static final Long POOL_ID_1 = 100L;
+    private static final Long POOL_ID_2 = 200L;
+    private static final Long HOST_ID_1 = 10L;
+    private static final Long HOST_ID_2 = 20L;
+    private static final String POOL_PATH_VG1 = "/vg1";
+
+    @Before
+    public void setup() {
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(volumeInfoMock.getUuid()).thenReturn("test-volume-uuid");
+        when(volumeInfoMock.getPath()).thenReturn("test-volume-path");
+
+        volumeService.storagePoolDao = storagePoolDao;
+        volumeService._hostDao = _hostDao;
+        volumeService.vmDao = vmDao;
+        volumeService.volFactory = volFactory;
+        volumeService._volumeDao = volumeDao;
+        volumeService.clvmPoolManager = clvmPoolManager;
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_BothCLVM() {
+        assertTrue(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM, StoragePoolType.CLVM));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_BothCLVM_NG() {
+        assertTrue(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM_NG, StoragePoolType.CLVM_NG));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_MixedCLVMAndCLVM_NG() {
+        assertTrue(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM, StoragePoolType.CLVM_NG));
+        assertTrue(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM_NG, StoragePoolType.CLVM));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_OneCLVMOneNFS() {
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM, StoragePoolType.NetworkFilesystem));
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.NetworkFilesystem, StoragePoolType.CLVM));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_OneCLVM_NGOneNFS() {
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM_NG, StoragePoolType.NetworkFilesystem));
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.NetworkFilesystem, StoragePoolType.CLVM_NG));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_BothNFS() {
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.NetworkFilesystem, StoragePoolType.NetworkFilesystem));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_NullVolumePoolType() {
+        assertFalse(volumeService.areBothPoolsClvmType(null, StoragePoolType.CLVM));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_NullVmPoolType() {
+        assertFalse(volumeService.areBothPoolsClvmType(StoragePoolType.CLVM, null));
+    }
+
+    @Test
+    public void testAreBothPoolsClvmType_BothNull() {
+        assertFalse(volumeService.areBothPoolsClvmType(null, null));
+    }
+
+
+    @Test
+    public void testIsLockTransferRequired_NonCLVMPool() {
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.NetworkFilesystem, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DifferentPools() {
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_2, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_NullPoolIds() {
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                null, POOL_ID_1, HOST_ID_1));
+
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, null, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DetachedVolumeReady() {
+        when(volumeDao.findById(VOLUME_ID)).thenReturn(volumeVOMock);
+        when(volumeVOMock.getState()).thenReturn(Volume.State.Ready);
+        when(volumeVOMock.getInstanceId()).thenReturn(null); // Detached
+
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(null);
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DetachedVolumeNotReady() {
+        when(volumeDao.findById(VOLUME_ID)).thenReturn(volumeVOMock);
+        when(volumeVOMock.getState()).thenReturn(Volume.State.Allocated);
+
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(null);
+
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DifferentHosts() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_1);
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, HOST_ID_2));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_SameHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_1);
+
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_NullVmHostId() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_1);
+
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_1, null));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_CLVM_NG_DifferentHosts() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_1);
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM_NG, StoragePoolType.CLVM_NG,
+                POOL_ID_1, POOL_ID_1, HOST_ID_2));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_NonCLVMPools() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.NetworkFilesystem, StoragePoolType.NetworkFilesystem,
+                POOL_PATH_VG1, POOL_PATH_VG1));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_OneCLVMOneNFS() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.NetworkFilesystem,
+                POOL_PATH_VG1, POOL_PATH_VG1));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_SameVG() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/vg1", "/vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_SameVG_NoSlash() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "vg1", "vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_SameVG_MixedSlash() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/vg1", "vg1"));
+
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "vg1", "/vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_DifferentVG() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/vg1", "/vg2"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_CLVM_NG_SameVG() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM_NG, StoragePoolType.CLVM_NG,
+                "/vg1", "/vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_CLVM_NG_DifferentVG() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM_NG, StoragePoolType.CLVM_NG,
+                "/vg1", "/vg2"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_MixedCLVM_CLVM_NG_SameVG() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM_NG,
+                "/vg1", "/vg1"));
+
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM_NG, StoragePoolType.CLVM,
+                "/vg1", "/vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_NullVolumePath() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                null, "/vg1"));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_NullVmPath() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/vg1", null));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_BothPathsNull() {
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                null, null));
+    }
+
+    @Test
+    public void testIsLightweightMigrationNeeded_ComplexVGNames() {
+        assertTrue(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/cloudstack-vg-01", "/cloudstack-vg-01"));
+
+        assertFalse(volumeService.isLightweightMigrationNeeded(
+                StoragePoolType.CLVM, StoragePoolType.CLVM,
+                "/cloudstack-vg-01", "/cloudstack-vg-02"));
+    }
+
+    @Test
+    public void testTransferVolumeLock_Success() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(volumeInfoMock.getPath()).thenReturn("/dev/vg1/volume-1");
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(storagePoolVOMock.getName()).thenReturn("test-pool");
+        when(clvmPoolManager.transferClvmVolumeLock(
+                "test-volume-uuid", VOLUME_ID, "/dev/vg1/volume-1", storagePoolVOMock, HOST_ID_1, HOST_ID_2))
+                .thenReturn(true);
+
+        assertTrue(volumeService.transferVolumeLock(volumeInfoMock, HOST_ID_1, HOST_ID_2));
+    }
+
+    @Test
+    public void testTransferVolumeLock_Failure() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(volumeInfoMock.getPath()).thenReturn("/dev/vg1/volume-1");
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(storagePoolVOMock.getName()).thenReturn("test-pool");
+        when(clvmPoolManager.transferClvmVolumeLock(
+                "test-volume-uuid", VOLUME_ID, "/dev/vg1/volume-1", storagePoolVOMock, HOST_ID_1, HOST_ID_2))
+                .thenReturn(false);
+
+        assertFalse(volumeService.transferVolumeLock(volumeInfoMock, HOST_ID_1, HOST_ID_2));
+    }
+
+    @Test
+    public void testTransferVolumeLock_PoolNotFound() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(null);
+
+        assertFalse(volumeService.transferVolumeLock(volumeInfoMock, HOST_ID_1, HOST_ID_2));
+    }
+
+    @Test
+    public void testFindVolumeLockHost_NullVolume() {
+        Long result = volumeService.findVolumeLockHost(null);
+        assertNull(result);
+    }
+
+    @Test
+    public void testFindVolumeLockHost_ExplicitLockFound() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(HOST_ID_1);
+
+        Long result = volumeService.findVolumeLockHost(volumeInfoMock);
+        assertEquals(HOST_ID_1, result);
+    }
+
+    @Test
+    public void testFindVolumeLockHost_FromAttachedVM() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(null);
+        when(volumeInfoMock.getInstanceId()).thenReturn(100L);
+        when(vmDao.findById(100L)).thenReturn(vmInstanceVOMock);
+        when(vmInstanceVOMock.getUuid()).thenReturn("vm-uuid");
+        when(vmInstanceVOMock.getHostId()).thenReturn(HOST_ID_1);
+
+        Long result = volumeService.findVolumeLockHost(volumeInfoMock);
+        assertEquals(HOST_ID_1, result);
+    }
+
+    @Test
+    public void testFindVolumeLockHost_FallbackToClusterHost() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(null);
+        when(volumeInfoMock.getInstanceId()).thenReturn(null);
+        when(storagePoolVOMock.getClusterId()).thenReturn(10L);
+        when(hostVOMock.getId()).thenReturn(HOST_ID_1);
+        when(hostVOMock.getStatus()).thenReturn(com.cloud.host.Status.Up);
+        when(_hostDao.findByClusterId(10L)).thenReturn(java.util.Collections.singletonList(hostVOMock));
+
+        Long result = volumeService.findVolumeLockHost(volumeInfoMock);
+        assertEquals(HOST_ID_1, result);
+    }
+
+    @Test
+    public void testFindVolumeLockHost_NoHostFound() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(null);
+        when(volumeInfoMock.getInstanceId()).thenReturn(null);
+        when(storagePoolVOMock.getClusterId()).thenReturn(10L);
+        when(_hostDao.findByClusterId(10L)).thenReturn(java.util.Collections.emptyList());
+
+        Long result = volumeService.findVolumeLockHost(volumeInfoMock);
+        assertNull(result);
+    }
+
+    @Test
+    public void testPerformLockMigration_Success() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(volumeInfoMock.getPath()).thenReturn("/dev/vg1/volume-1");
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("/dev/vg1/volume-1"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(HOST_ID_1);
+        when(storagePoolVOMock.getName()).thenReturn("test-pool");
+        when(clvmPoolManager.transferClvmVolumeLock(
+                "test-volume-uuid", VOLUME_ID, "/dev/vg1/volume-1", storagePoolVOMock, HOST_ID_1, HOST_ID_2))
+                .thenReturn(true);
+        when(volFactory.getVolume(VOLUME_ID)).thenReturn(volumeInfoMock);
+
+        VolumeInfo result = volumeService.performLockMigration(volumeInfoMock, HOST_ID_2);
+        assertNotNull(result);
+    }
+
+    @Test
+    public void testPerformLockMigration_SameHost() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(HOST_ID_1);
+
+        VolumeInfo result = volumeService.performLockMigration(volumeInfoMock, HOST_ID_1);
+        assertEquals(volumeInfoMock, result);
+    }
+
+    @Test
+    public void testPerformLockMigration_SourceHostNull() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("test-volume-path"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(null);
+        when(volumeInfoMock.getInstanceId()).thenReturn(null);
+        when(storagePoolVOMock.getClusterId()).thenReturn(null);
+
+        VolumeInfo result = volumeService.performLockMigration(volumeInfoMock, HOST_ID_2);
+        assertNotNull(result);
+    }
+
+    @Test(expected = com.cloud.utils.exception.CloudRuntimeException.class)
+    public void testPerformLockMigration_NullVolume() {
+        volumeService.performLockMigration(null, HOST_ID_2);
+    }
+
+    @Test(expected = com.cloud.utils.exception.CloudRuntimeException.class)
+    public void testPerformLockMigration_TransferFails() {
+        when(volumeInfoMock.getPoolId()).thenReturn(POOL_ID_1);
+        when(volumeInfoMock.getId()).thenReturn(VOLUME_ID);
+        when(volumeInfoMock.getPath()).thenReturn("/dev/vg1/volume-1");
+        when(storagePoolDao.findById(POOL_ID_1)).thenReturn(storagePoolVOMock);
+        when(clvmPoolManager.getClvmLockHostId(
+                eq(VOLUME_ID), eq("test-volume-uuid"), eq("/dev/vg1/volume-1"), eq(storagePoolVOMock), eq(true)))
+                .thenReturn(HOST_ID_1);
+        when(storagePoolVOMock.getName()).thenReturn("test-pool");
+        when(clvmPoolManager.transferClvmVolumeLock(
+                "test-volume-uuid", VOLUME_ID, "/dev/vg1/volume-1", storagePoolVOMock, HOST_ID_1, HOST_ID_2))
+                .thenReturn(false);
+
+        volumeService.performLockMigration(volumeInfoMock, HOST_ID_2);
+    }
+}
diff --git a/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java b/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
index 7c5692564c99..c9c48dbb179f 100644
--- a/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
+++ b/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
@@ -119,10 +119,10 @@ public String validateUserData(String userData, BaseCmd.HTTPMethod httpmethod) {
         byte[] decodedUserData = null;
 
         // If GET, use 4K. If POST, support up to 1M.
-        if (httpmethod.equals(BaseCmd.HTTPMethod.GET)) {
-            decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_GET_LENGTH, BaseCmd.HTTPMethod.GET);
-        } else if (httpmethod.equals(BaseCmd.HTTPMethod.POST)) {
+        if (BaseCmd.HTTPMethod.POST.equals(httpmethod)) {
             decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_POST_LENGTH, BaseCmd.HTTPMethod.POST);
+        } else {
+            decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_GET_LENGTH, BaseCmd.HTTPMethod.GET);
         }
 
         // Re-encode so that the '=' paddings are added if necessary since 'isBase64' does not require it, but python does on the VR.
diff --git a/framework/cluster/pom.xml b/framework/cluster/pom.xml
index 2dd28e8e628f..75bcaf9a7ddf 100644
--- a/framework/cluster/pom.xml
+++ b/framework/cluster/pom.xml
@@ -48,6 +48,12 @@
             <artifactId>cloud-api</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-schema</artifactId>
+            <version>${project.version}</version>
+            <scope>compile</scope>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java b/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java
new file mode 100644
index 000000000000..fcaa2a22e341
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.api.ResourceDetail;
+
+@Entity
+@Table(name = "management_server_details")
+public class ManagementServerHostDetailVO implements ResourceDetail {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    long id;
+
+    @Column(name = "management_server_id")
+    long resourceId;
+
+    @Column(name = "name")
+    String name;
+
+    @Column(name = "value")
+    String value;
+
+    @Column(name = "display")
+    private boolean display = true;
+
+    public ManagementServerHostDetailVO(long poolId, String name, String value, boolean display) {
+        this.resourceId = poolId;
+        this.name = name;
+        this.value = value;
+        this.display = display;
+    }
+
+    public ManagementServerHostDetailVO() {
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public long getResourceId() {
+        return resourceId;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public String getValue() {
+        return value;
+    }
+
+    @Override
+    public boolean isDisplay() {
+        return display;
+    }
+}
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java
new file mode 100644
index 000000000000..24fd60d21b3c
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster.dao;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDao;
+
+import com.cloud.cluster.ManagementServerHostDetailVO;
+import com.cloud.utils.db.GenericDao;
+
+public interface ManagementServerHostDetailsDao extends GenericDao<ManagementServerHostDetailVO, Long>, ResourceDetailsDao<ManagementServerHostDetailVO> {
+}
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java
new file mode 100644
index 000000000000..5865bee0926b
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster.dao;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ScopedConfigStorage;
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
+
+import com.cloud.cluster.ManagementServerHostDetailVO;
+
+public class ManagementServerHostDetailsDaoImpl extends ResourceDetailsDaoBase<ManagementServerHostDetailVO> implements ManagementServerHostDetailsDao, ScopedConfigStorage {
+
+    public ManagementServerHostDetailsDaoImpl() {
+    }
+
+    @Override
+    public ConfigKey.Scope getScope() {
+        return ConfigKey.Scope.ManagementServer;
+    }
+
+    @Override
+    public String getConfigValue(long id, String key) {
+        ManagementServerHostDetailVO vo = findDetail(id, key);
+        return vo == null ? null : vo.getValue();
+    }
+
+    @Override
+    public void addDetail(long resourceId, String key, String value, boolean display) {
+        super.addDetail(new ManagementServerHostDetailVO(resourceId, key, value, display));
+    }
+}
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
index 926280bfeade..c334e91feb84 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
@@ -68,4 +68,6 @@ public interface AsyncJobDao extends GenericDao<AsyncJobVO, Long> {
     // Returns the number of pending jobs for the given Management server msids.
     // NOTE: This is the msid and NOT the id
     long countPendingNonPseudoJobs(Long... msIds);
+
+    List<Long> listPendingJobIdsForAccount(long accountId);
 }
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
index 81cc5d4f2a8c..d8385e9aecd1 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
@@ -299,4 +299,14 @@ public long countPendingJobs(String havingInfo, String... cmds) {
         List<Long> results = customSearch(sc, null);
         return results.get(0);
     }
+
+    @Override
+    public List<Long> listPendingJobIdsForAccount(long accountId) {
+        GenericSearchBuilder<AsyncJobVO, Long> sb = createSearchBuilder(Long.class);
+        sb.and("accountId", sb.entity().getAccountId(), SearchCriteria.Op.EQ);
+        sb.selectFields(sb.entity().getId());
+        SearchCriteria<Long> sc = sb.create();
+        sc.setParameters("accountId", accountId);
+        return customSearch(sc, null);
+    }
 }
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
index 58f51eae9fcd..5afef8bc95b6 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
@@ -23,6 +23,7 @@
 import java.util.Comparator;
 import java.util.Date;
 import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
@@ -32,6 +33,9 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.utils.db.TransactionLegacy;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.quota.activationrule.presetvariables.Configuration;
 import org.apache.cloudstack.quota.activationrule.presetvariables.GenericPresetVariable;
@@ -43,9 +47,11 @@
 import org.apache.cloudstack.quota.dao.QuotaAccountDao;
 import org.apache.cloudstack.quota.dao.QuotaBalanceDao;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageVO;
 import org.apache.cloudstack.usage.UsageUnitTypes;
@@ -86,7 +92,8 @@ public class QuotaManagerImpl extends ManagerBase implements QuotaManager {
     private QuotaBalanceDao _quotaBalanceDao;
     @Inject
     private ConfigurationDao _configDao;
-
+    @Inject
+    private QuotaTariffUsageDao quotaTariffUsageDao;
     @Inject
     protected PresetVariableHelper presetVariableHelper;
 
@@ -311,14 +318,14 @@ protected List<QuotaUsageVO> createQuotaUsagesAccordingToQuotaTariffs(AccountVO
         String accountToString = account.reflectionToString();
         logger.info("Calculating quota usage of [{}] usage records for account [{}].", usageRecords.size(), accountToString);
 
-        List<Pair<UsageVO, QuotaUsageVO>> pairsUsageAndQuotaUsage = new ArrayList<>();
+        Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageAndQuotaUsage = new LinkedHashMap<>();
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value())) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value(), QuotaConfig.QuotaActivationRuleTimeout.key())) {
             for (UsageVO usageRecord : usageRecords) {
                 int usageType = usageRecord.getUsageType();
 
                 if (!shouldCalculateUsageRecord(account, usageRecord)) {
-                    pairsUsageAndQuotaUsage.add(new Pair<>(usageRecord, null));
+                    mapUsageAndQuotaUsage.put(usageRecord, null);
                     continue;
                 }
 
@@ -326,18 +333,31 @@ protected List<QuotaUsageVO> createQuotaUsagesAccordingToQuotaTariffs(AccountVO
                 List<QuotaTariffVO> quotaTariffs = pairQuotaTariffsPerUsageTypeAndHasActivationRule.first();
                 boolean hasAnyQuotaTariffWithActivationRule = pairQuotaTariffsPerUsageTypeAndHasActivationRule.second();
 
-                BigDecimal aggregatedQuotaTariffsValue = aggregateQuotaTariffsValues(usageRecord, quotaTariffs, hasAnyQuotaTariffWithActivationRule, jsInterpreter, accountToString);
+                Map<QuotaTariffVO, BigDecimal> aggregatedQuotaTariffsAndValues = aggregateQuotaTariffsValues(usageRecord,
+                        quotaTariffs, hasAnyQuotaTariffWithActivationRule, jsInterpreter, accountToString);
+                BigDecimal aggregatedQuotaTariffsValue = aggregatedQuotaTariffsAndValues.values().stream().reduce(BigDecimal.ZERO, BigDecimal::add);
+                logger.debug("The aggregation of the quota tariffs of account [{}] resulted in [{}] for the usage record [{}].",
+                        account, aggregatedQuotaTariffsValue, usageRecord);
 
                 QuotaUsageVO quotaUsage = createQuotaUsageAccordingToUsageUnit(usageRecord, aggregatedQuotaTariffsValue, accountToString);
+                if (quotaUsage == null) {
+                    mapUsageAndQuotaUsage.put(usageRecord, null);
+                    continue;
+                }
 
-                pairsUsageAndQuotaUsage.add(new Pair<>(usageRecord, quotaUsage));
+                List<QuotaTariffUsageVO> quotaTariffUsages = new ArrayList<>();
+                for (Map.Entry<QuotaTariffVO, BigDecimal> entry : aggregatedQuotaTariffsAndValues.entrySet()) {
+                    QuotaTariffUsageVO quotaTariffUsage = createQuotaTariffUsage(usageRecord, entry.getKey(), entry.getValue());
+                    quotaTariffUsages.add(quotaTariffUsage);
+                }
+                mapUsageAndQuotaUsage.put(usageRecord, new Pair<>(quotaUsage, quotaTariffUsages));
             }
         } catch (Exception e) {
             logger.error(String.format("Failed to calculate the quota usage for account [%s] due to [%s].", accountToString, e.getMessage()), e);
             return new ArrayList<>();
         }
 
-        return persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(pairsUsageAndQuotaUsage);
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<List<QuotaUsageVO>>) status -> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(mapUsageAndQuotaUsage));
     }
 
     protected boolean shouldCalculateUsageRecord(AccountVO accountVO, UsageVO usageRecord) {
@@ -349,31 +369,41 @@ protected boolean shouldCalculateUsageRecord(AccountVO accountVO, UsageVO usageR
         return true;
     }
 
-    protected List<QuotaUsageVO> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(List<Pair<UsageVO, QuotaUsageVO>> pairsUsageAndQuotaUsage) {
+    protected List<QuotaUsageVO> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageAndQuotaTariffUsage) {
         List<QuotaUsageVO> quotaUsages = new ArrayList<>();
 
-        for (Pair<UsageVO, QuotaUsageVO> pairUsageAndQuotaUsage : pairsUsageAndQuotaUsage) {
-            UsageVO usageVo = pairUsageAndQuotaUsage.first();
+        for (Map.Entry<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> usageAndTariffUsage : mapUsageAndQuotaTariffUsage.entrySet()) {
+            UsageVO usageVo = usageAndTariffUsage.getKey();
             usageVo.setQuotaCalculated(1);
             _usageDao.persistUsage(usageVo);
 
-            QuotaUsageVO quotaUsageVo = pairUsageAndQuotaUsage.second();
-            if (quotaUsageVo != null) {
-                _quotaUsageDao.persistQuotaUsage(quotaUsageVo);
-                quotaUsages.add(quotaUsageVo);
+            Pair<QuotaUsageVO, List<QuotaTariffUsageVO>> pairUsageAndTariffUsages = usageAndTariffUsage.getValue();
+            if (pairUsageAndTariffUsages != null) {
+                QuotaUsageVO quotaUsage = pairUsageAndTariffUsages.first();
+                _quotaUsageDao.persistQuotaUsage(quotaUsage);
+                quotaUsages.add(quotaUsage);
+
+                persistQuotaTariffUsages(pairUsageAndTariffUsages.second(), quotaUsage.getId());
             }
         }
 
         return quotaUsages;
     }
 
-    protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<QuotaTariffVO> quotaTariffs, boolean hasAnyQuotaTariffWithActivationRule,
-            JsInterpreter jsInterpreter, String accountToString) {
+    protected void persistQuotaTariffUsages(List<QuotaTariffUsageVO> quotaTariffUsages, Long quotaUsageId) {
+        for (QuotaTariffUsageVO quotaTariffUsage : quotaTariffUsages) {
+            quotaTariffUsage.setQuotaUsageId(quotaUsageId);
+            quotaTariffUsageDao.persistQuotaTariffUsage(quotaTariffUsage);
+        }
+    }
+
+    protected Map<QuotaTariffVO, BigDecimal> aggregateQuotaTariffsValues(UsageVO usageRecord, List<QuotaTariffVO> quotaTariffs, boolean hasAnyQuotaTariffWithActivationRule,
+                                                                         JsInterpreter jsInterpreter, String accountToString) {
         String usageRecordToString = usageRecord.toString(usageAggregationTimeZone);
         logger.debug("Validating usage record [{}] for account [{}] against [{}] quota tariffs.", usageRecordToString, accountToString, quotaTariffs.size());
 
         PresetVariables presetVariables = getPresetVariables(hasAnyQuotaTariffWithActivationRule, usageRecord);
-        BigDecimal aggregatedQuotaTariffsValue = BigDecimal.ZERO;
+        Map<QuotaTariffVO, BigDecimal> aggregatedQuotaTariffsAndValues = new HashMap<>();
 
         quotaTariffs.sort(Comparator.comparing(QuotaTariffVO::getPosition));
 
@@ -382,10 +412,9 @@ protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<Quota
 
         for (QuotaTariffVO quotaTariff : quotaTariffs) {
             if (isQuotaTariffInPeriodToBeApplied(usageRecord, quotaTariff, accountToString)) {
-
                 BigDecimal tariffValue = getQuotaTariffValueToBeApplied(quotaTariff, jsInterpreter, presetVariables, lastTariffs);
 
-                aggregatedQuotaTariffsValue = aggregatedQuotaTariffsValue.add(tariffValue);
+                aggregatedQuotaTariffsAndValues.put(quotaTariff, tariffValue);
 
                 Tariff tariffPresetVariable = new Tariff();
                 tariffPresetVariable.setId(quotaTariff.getUuid());
@@ -394,10 +423,10 @@ protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<Quota
             }
         }
 
-        logger.debug(String.format("The aggregation of the quota tariffs resulted in the value [%s] for the usage record [%s]. We will use this value to calculate the final"
-                + " usage value.", aggregatedQuotaTariffsValue, usageRecordToString));
+        logger.debug("The aggregation of the quota tariffs resulted in [{}] quota tariffs for the usage record [{}]. The values of the quota tariffs will be used"
+                + " to calculate the final usage value.", aggregatedQuotaTariffsAndValues.size(), usageRecordToString);
 
-        return aggregatedQuotaTariffsValue;
+        return aggregatedQuotaTariffsAndValues;
     }
 
     protected PresetVariables getPresetVariables(boolean hasAnyQuotaTariffWithActivationRule, UsageVO usageRecord) {
@@ -408,6 +437,26 @@ protected PresetVariables getPresetVariables(boolean hasAnyQuotaTariffWithActiva
         return null;
     }
 
+    protected QuotaTariffUsageVO createQuotaTariffUsage(UsageVO usageRecord, QuotaTariffVO quotaTariff, BigDecimal quotaTariffValue) {
+        BigDecimal quotaUsageValue = BigDecimal.ZERO;
+
+        if (!quotaTariffValue.equals(BigDecimal.ZERO)) {
+            String quotaUnit = QuotaTypes.getQuotaType(usageRecord.getUsageType()).getQuotaUnit();
+            logger.trace("Calculating the value of the quota tariff [{}] according to its value [{}] and its quota unit [{}].", quotaTariff, quotaTariffValue, quotaUnit);
+            quotaUsageValue = getUsageValueAccordingToUsageUnitType(usageRecord, quotaTariffValue, quotaUnit);
+            logger.debug("The calculation of the value of the quota tariff [{}] according to its value [{}] and its usage unit [{}] resulted in the value [{}].",
+                    quotaTariff, quotaTariffValue, quotaUnit, quotaUsageValue);
+        } else {
+            logger.debug("Quota tariff [{}] has no value to be calculated; therefore, it will be marked as value zero.", quotaTariff);
+        }
+
+        QuotaTariffUsageVO quotaTariffUsage = new QuotaTariffUsageVO();
+        quotaTariffUsage.setTariffId(quotaTariff.getId());
+        quotaTariffUsage.setQuotaUsed(quotaUsageValue);
+
+        return quotaTariffUsage;
+    }
+
     /**
      * Returns the quota tariff value according to the result of the activation rule.<br/>
      * <ul>
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
index 0da0d6e53f77..7b725d57c6ef 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
@@ -20,11 +20,23 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.network.IpAddress;
+import com.cloud.network.Network;
+import com.cloud.network.VpnUser;
+import com.cloud.network.rules.LoadBalancer;
+import com.cloud.network.rules.PortForwardingRule;
+import com.cloud.network.security.SecurityGroup;
+import com.cloud.network.vpc.Vpc;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.storage.Snapshot;
+import com.cloud.storage.Volume;
+import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.backup.BackupOffering;
+import org.apache.cloudstack.storage.object.Bucket;
 import org.apache.cloudstack.usage.UsageTypes;
 import org.apache.cloudstack.usage.UsageUnitTypes;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
-import org.apache.commons.lang3.StringUtils;
 
 public class QuotaTypes extends UsageTypes {
     private final Integer quotaType;
@@ -32,44 +44,46 @@ public class QuotaTypes extends UsageTypes {
     private final String quotaUnit;
     private final String description;
     private final String discriminator;
+    private final Class<?> clazz;
     private final static Map<Integer, QuotaTypes> quotaTypeMap;
 
     static {
         final HashMap<Integer, QuotaTypes> quotaTypeList = new HashMap<Integer, QuotaTypes>();
-        quotaTypeList.put(RUNNING_VM, new QuotaTypes(RUNNING_VM, "RUNNING_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Running Vm Usage"));
-        quotaTypeList.put(ALLOCATED_VM, new QuotaTypes(ALLOCATED_VM, "ALLOCATED_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Allocated Vm Usage"));
-        quotaTypeList.put(IP_ADDRESS, new QuotaTypes(IP_ADDRESS, "IP_ADDRESS", UsageUnitTypes.IP_MONTH.toString(), "IP Address Usage"));
-        quotaTypeList.put(NETWORK_BYTES_SENT, new QuotaTypes(NETWORK_BYTES_SENT, "NETWORK_BYTES_SENT", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Sent)"));
-        quotaTypeList.put(NETWORK_BYTES_RECEIVED, new QuotaTypes(NETWORK_BYTES_RECEIVED, "NETWORK_BYTES_RECEIVED", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Received)"));
-        quotaTypeList.put(VOLUME, new QuotaTypes(VOLUME, "VOLUME", UsageUnitTypes.GB_MONTH.toString(), "Volume Usage"));
-        quotaTypeList.put(TEMPLATE, new QuotaTypes(TEMPLATE, "TEMPLATE", UsageUnitTypes.GB_MONTH.toString(), "Template Usage"));
-        quotaTypeList.put(ISO, new QuotaTypes(ISO, "ISO", UsageUnitTypes.GB_MONTH.toString(), "ISO Usage"));
-        quotaTypeList.put(SNAPSHOT, new QuotaTypes(SNAPSHOT, "SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "Snapshot Usage"));
-        quotaTypeList.put(SECURITY_GROUP, new QuotaTypes(SECURITY_GROUP, "SECURITY_GROUP", UsageUnitTypes.POLICY_MONTH.toString(), "Security Group Usage"));
-        quotaTypeList.put(LOAD_BALANCER_POLICY, new QuotaTypes(LOAD_BALANCER_POLICY, "LOAD_BALANCER_POLICY", UsageUnitTypes.POLICY_MONTH.toString(), "Load Balancer Usage"));
-        quotaTypeList.put(PORT_FORWARDING_RULE, new QuotaTypes(PORT_FORWARDING_RULE, "PORT_FORWARDING_RULE", UsageUnitTypes.POLICY_MONTH.toString(), "Port Forwarding Usage"));
-        quotaTypeList.put(NETWORK_OFFERING, new QuotaTypes(NETWORK_OFFERING, "NETWORK_OFFERING", UsageUnitTypes.POLICY_MONTH.toString(), "Network Offering Usage"));
-        quotaTypeList.put(VPN_USERS, new QuotaTypes(VPN_USERS, "VPN_USERS", UsageUnitTypes.POLICY_MONTH.toString(), "VPN users usage"));
-        quotaTypeList.put(VM_DISK_IO_READ, new QuotaTypes(VM_DISK_IO_READ, "VM_DISK_IO_READ", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Read)"));
-        quotaTypeList.put(VM_DISK_IO_WRITE, new QuotaTypes(VM_DISK_IO_WRITE, "VM_DISK_IO_WRITE", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Write)"));
-        quotaTypeList.put(VM_DISK_BYTES_READ, new QuotaTypes(VM_DISK_BYTES_READ, "VM_DISK_BYTES_READ", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Read)"));
-        quotaTypeList.put(VM_DISK_BYTES_WRITE, new QuotaTypes(VM_DISK_BYTES_WRITE, "VM_DISK_BYTES_WRITE", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Write)"));
-        quotaTypeList.put(VM_SNAPSHOT, new QuotaTypes(VM_SNAPSHOT, "VM_SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot storage usage"));
-        quotaTypeList.put(VOLUME_SECONDARY, new QuotaTypes(VOLUME_SECONDARY, "VOLUME_SECONDARY", UsageUnitTypes.GB_MONTH.toString(), "Volume secondary storage usage"));
-        quotaTypeList.put(VM_SNAPSHOT_ON_PRIMARY, new QuotaTypes(VM_SNAPSHOT_ON_PRIMARY, "VM_SNAPSHOT_ON_PRIMARY", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot primary storage usage"));
-        quotaTypeList.put(BACKUP, new QuotaTypes(BACKUP, "BACKUP", UsageUnitTypes.GB_MONTH.toString(), "Backup storage usage"));
-        quotaTypeList.put(BUCKET, new QuotaTypes(BUCKET, "BUCKET", UsageUnitTypes.GB_MONTH.toString(), "Object Store bucket usage"));
-        quotaTypeList.put(NETWORK, new QuotaTypes(NETWORK, "NETWORK", UsageUnitTypes.COMPUTE_MONTH.toString(), "Network usage"));
-        quotaTypeList.put(VPC, new QuotaTypes(VPC, "VPC", UsageUnitTypes.COMPUTE_MONTH.toString(), "VPC usage"));
+        quotaTypeList.put(RUNNING_VM, new QuotaTypes(RUNNING_VM, "RUNNING_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Running Vm Usage", VirtualMachine.class));
+        quotaTypeList.put(ALLOCATED_VM, new QuotaTypes(ALLOCATED_VM, "ALLOCATED_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Allocated Vm Usage", VirtualMachine.class));
+        quotaTypeList.put(IP_ADDRESS, new QuotaTypes(IP_ADDRESS, "IP_ADDRESS", UsageUnitTypes.IP_MONTH.toString(), "IP Address Usage", IpAddress.class));
+        quotaTypeList.put(NETWORK_BYTES_SENT, new QuotaTypes(NETWORK_BYTES_SENT, "NETWORK_BYTES_SENT", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Sent)", Network.class));
+        quotaTypeList.put(NETWORK_BYTES_RECEIVED, new QuotaTypes(NETWORK_BYTES_RECEIVED, "NETWORK_BYTES_RECEIVED", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Received)", Network.class));
+        quotaTypeList.put(VOLUME, new QuotaTypes(VOLUME, "VOLUME", UsageUnitTypes.GB_MONTH.toString(), "Volume Usage", Volume.class));
+        quotaTypeList.put(TEMPLATE, new QuotaTypes(TEMPLATE, "TEMPLATE", UsageUnitTypes.GB_MONTH.toString(), "Template Usage", VirtualMachineTemplate.class));
+        quotaTypeList.put(ISO, new QuotaTypes(ISO, "ISO", UsageUnitTypes.GB_MONTH.toString(), "ISO Usage", VirtualMachineTemplate.class));
+        quotaTypeList.put(SNAPSHOT, new QuotaTypes(SNAPSHOT, "SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "Snapshot Usage", Snapshot.class));
+        quotaTypeList.put(SECURITY_GROUP, new QuotaTypes(SECURITY_GROUP, "SECURITY_GROUP", UsageUnitTypes.POLICY_MONTH.toString(), "Security Group Usage",  SecurityGroup.class));
+        quotaTypeList.put(LOAD_BALANCER_POLICY, new QuotaTypes(LOAD_BALANCER_POLICY, "LOAD_BALANCER_POLICY", UsageUnitTypes.POLICY_MONTH.toString(), "Load Balancer Usage", LoadBalancer.class));
+        quotaTypeList.put(PORT_FORWARDING_RULE, new QuotaTypes(PORT_FORWARDING_RULE, "PORT_FORWARDING_RULE", UsageUnitTypes.POLICY_MONTH.toString(), "Port Forwarding Usage", PortForwardingRule.class));
+        quotaTypeList.put(NETWORK_OFFERING, new QuotaTypes(NETWORK_OFFERING, "NETWORK_OFFERING", UsageUnitTypes.POLICY_MONTH.toString(), "Network Offering Usage", NetworkOffering.class));
+        quotaTypeList.put(VPN_USERS, new QuotaTypes(VPN_USERS, "VPN_USERS", UsageUnitTypes.POLICY_MONTH.toString(), "VPN users usage", VpnUser.class));
+        quotaTypeList.put(VM_DISK_IO_READ, new QuotaTypes(VM_DISK_IO_READ, "VM_DISK_IO_READ", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Read)", Volume.class));
+        quotaTypeList.put(VM_DISK_IO_WRITE, new QuotaTypes(VM_DISK_IO_WRITE, "VM_DISK_IO_WRITE", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Write)", Volume.class));
+        quotaTypeList.put(VM_DISK_BYTES_READ, new QuotaTypes(VM_DISK_BYTES_READ, "VM_DISK_BYTES_READ", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Read)", Volume.class));
+        quotaTypeList.put(VM_DISK_BYTES_WRITE, new QuotaTypes(VM_DISK_BYTES_WRITE, "VM_DISK_BYTES_WRITE", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Write)", Volume.class));
+        quotaTypeList.put(VM_SNAPSHOT, new QuotaTypes(VM_SNAPSHOT, "VM_SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot storage usage", Snapshot.class));
+        quotaTypeList.put(VOLUME_SECONDARY, new QuotaTypes(VOLUME_SECONDARY, "VOLUME_SECONDARY", UsageUnitTypes.GB_MONTH.toString(), "Volume secondary storage usage", Volume.class));
+        quotaTypeList.put(VM_SNAPSHOT_ON_PRIMARY, new QuotaTypes(VM_SNAPSHOT_ON_PRIMARY, "VM_SNAPSHOT_ON_PRIMARY", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot primary storage usage", Snapshot.class));
+        quotaTypeList.put(BACKUP, new QuotaTypes(BACKUP, "BACKUP", UsageUnitTypes.GB_MONTH.toString(), "Backup storage usage", BackupOffering.class));
+        quotaTypeList.put(BUCKET, new QuotaTypes(BUCKET, "BUCKET", UsageUnitTypes.GB_MONTH.toString(), "Object Store bucket usage", Bucket.class));
+        quotaTypeList.put(NETWORK, new QuotaTypes(NETWORK, "NETWORK", UsageUnitTypes.COMPUTE_MONTH.toString(), "Network usage", Network.class));
+        quotaTypeList.put(VPC, new QuotaTypes(VPC, "VPC", UsageUnitTypes.COMPUTE_MONTH.toString(), "VPC usage", Vpc.class));
         quotaTypeMap = Collections.unmodifiableMap(quotaTypeList);
     }
 
-    private QuotaTypes(Integer quotaType, String name, String unit, String description) {
+    private QuotaTypes(Integer quotaType, String name, String unit, String description, Class<?> clazz) {
         this.quotaType = quotaType;
         this.description = description;
         this.quotaName = name;
         this.quotaUnit = unit;
         this.discriminator = "None";
+        this.clazz = clazz;
     }
 
     public static Map<Integer, QuotaTypes> listQuotaTypes() {
@@ -104,22 +118,20 @@ static public String getDescription(int quotaType) {
         return null;
     }
 
+    public Class<?> getClazz() {
+        return clazz;
+    }
+
     static public QuotaTypes getQuotaType(int quotaType) {
         return quotaTypeMap.get(quotaType);
     }
 
-    static public QuotaTypes getQuotaTypeByName(String name) {
-        if (StringUtils.isBlank(name)) {
-            throw new CloudRuntimeException("Could not retrieve Quota type by name because the value passed as parameter is null, empty, or blank.");
-        }
-
-        for (QuotaTypes type : quotaTypeMap.values()) {
-            if (type.getQuotaName().equals(name)) {
-                return type;
-            }
+    static public Class<?> getClazz(int quotaType) {
+        QuotaTypes t = quotaTypeMap.get(quotaType);
+        if (t != null) {
+            return t.getClazz();
         }
-
-        throw new CloudRuntimeException(String.format("Could not find Quota type with name [%s].", name));
+        return null;
     }
 
     @Override
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
index 126fa11413f7..ead70ae35012 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
@@ -26,6 +26,6 @@
 
 public interface QuotaUsageJoinDao extends GenericDao<QuotaUsageJoinVO, Long> {
 
-    List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, Long domainId, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId);
+    List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, List<Long> domainIds, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId);
 
 }
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
index b98ea2b3a5d2..e69b1a05ba4d 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
@@ -61,7 +61,7 @@ public void init() {
 
     private void prepareQuotaUsageSearchBuilder(SearchBuilder<QuotaUsageJoinVO> searchBuilder) {
         searchBuilder.and("accountId", searchBuilder.entity().getAccountId(), SearchCriteria.Op.EQ);
-        searchBuilder.and("domainId", searchBuilder.entity().getDomainId(), SearchCriteria.Op.EQ);
+        searchBuilder.and("domainIds", searchBuilder.entity().getDomainId(), SearchCriteria.Op.IN);
         searchBuilder.and("usageType", searchBuilder.entity().getUsageType(), SearchCriteria.Op.EQ);
         searchBuilder.and("resourceId", searchBuilder.entity().getResourceId(), SearchCriteria.Op.EQ);
         searchBuilder.and("networkId", searchBuilder.entity().getNetworkId(), SearchCriteria.Op.EQ);
@@ -71,11 +71,13 @@ private void prepareQuotaUsageSearchBuilder(SearchBuilder<QuotaUsageJoinVO> sear
     }
 
     @Override
-    public List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, Long domainId, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId) {
+    public List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, List<Long> domainIds, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId) {
         SearchCriteria<QuotaUsageJoinVO> sc = tariffId == null ? searchQuotaUsages.create() : searchQuotaUsagesJoinTariffUsages.create();
 
         sc.setParametersIfNotNull("accountId", accountId);
-        sc.setParametersIfNotNull("domainId", domainId);
+        if (domainIds != null) {
+            sc.setParameters("domainIds", domainIds.toArray());
+        }
         sc.setParametersIfNotNull("usageType", usageType);
         sc.setParametersIfNotNull("resourceId", resourceId);
         sc.setParametersIfNotNull("networkId", networkId);
diff --git a/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java b/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
index a33faa054de4..1e08e7d7fc00 100644
--- a/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
+++ b/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
@@ -22,6 +22,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -33,7 +34,9 @@
 import org.apache.cloudstack.quota.activationrule.presetvariables.Value;
 import org.apache.cloudstack.quota.constant.QuotaTypes;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageVO;
 import org.apache.cloudstack.usage.UsageUnitTypes;
@@ -89,6 +92,9 @@ public class QuotaManagerImplTest {
     @Mock
     PresetVariables presetVariablesMock;
 
+    @Mock
+    QuotaTariffUsageDao quotaTariffUsageDaoMock;
+
     SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
 
     @Test
@@ -484,47 +490,49 @@ public void getPresetVariablesTestHasTariffsWithActivationRuleReturnPresetVariab
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsWereNotInPeriodToBeAppliedReturnZero() {
+    public void aggregateQuotaTariffsValuesTestTariffsWereNotInPeriodToBeAppliedReturnEmptyMap() {
         List<QuotaTariffVO> tariffs = createTariffList();
 
         Mockito.doReturn(false).when(quotaManagerImplSpy).isQuotaTariffInPeriodToBeApplied(Mockito.any(), Mockito.any(), Mockito.anyString());
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.ZERO, result);
+        Assert.assertTrue(result.isEmpty());
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsIsEmptyReturnZero() {
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, new ArrayList<>(), false, jsInterpreterMock, "");
+    public void aggregateQuotaTariffsValuesTestTariffsIsEmptyReturnEmptyMap() {
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, new ArrayList<>(), false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.ZERO, result);
+        Assert.assertTrue(result.isEmpty());
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsAreInPeriodToBeAppliedReturnAggregation() {
+    public void aggregateQuotaTariffsValuesTestTariffsAreInPeriodToBeAppliedReturnTariffsWithTheirValues() {
         List<QuotaTariffVO> tariffs = createTariffList();
 
         Mockito.doReturn(true, false, true).when(quotaManagerImplSpy).isQuotaTariffInPeriodToBeApplied(Mockito.any(), Mockito.any(), Mockito.anyString());
         Mockito.doReturn(BigDecimal.TEN).when(quotaManagerImplSpy).getQuotaTariffValueToBeApplied(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.TEN.multiply(new BigDecimal(2)), result);
+        Assert.assertEquals(2, result.size());
+        Assert.assertTrue(result.values().stream().allMatch(value -> value.equals(BigDecimal.TEN)));
     }
 
     @Test
     public void persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsagesTestReturnOnlyPersistedQuotaUsageVo() {
-        List<Pair<UsageVO, QuotaUsageVO>> listPair = new ArrayList<>();
+        Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageQuotaUsage = new LinkedHashMap<>();
         QuotaUsageVO quotaUsageVoMock1 = Mockito.mock(QuotaUsageVO.class);
         QuotaUsageVO quotaUsageVoMock2 = Mockito.mock(QuotaUsageVO.class);
 
-        listPair.add(new Pair<>(new UsageVO(), quotaUsageVoMock1));
-        listPair.add(new Pair<>(new UsageVO(), null));
-        listPair.add(new Pair<>(new UsageVO(), quotaUsageVoMock2));
+        mapUsageQuotaUsage.put(new UsageVO(), new Pair<>(quotaUsageVoMock1, new ArrayList<>()));
+        mapUsageQuotaUsage.put(new UsageVO(), null);
+        mapUsageQuotaUsage.put(new UsageVO(), new Pair<>(quotaUsageVoMock2, new ArrayList<>()));
 
         Mockito.doReturn(null).when(usageDaoMock).persistUsage(Mockito.any());
         Mockito.doReturn(null).when(quotaUsageDaoMock).persistQuotaUsage(Mockito.any());
+        Mockito.doNothing().when(quotaManagerImplSpy).persistQuotaTariffUsages(Mockito.any(), Mockito.any());
 
-        List<QuotaUsageVO> result = quotaManagerImplSpy.persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(listPair);
+        List<QuotaUsageVO> result = quotaManagerImplSpy.persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(mapUsageQuotaUsage);
 
         Assert.assertEquals(2, result.size());
         Assert.assertEquals(quotaUsageVoMock1, result.get(0));
@@ -551,4 +559,41 @@ private static List<Tariff> createLastAppliedTariffsPresetVariableList(int numbe
         return lastTariffs;
     }
 
+    @Test
+    public void createQuotaTariffUsageTestTariffValueIsNotZeroReturnDetailedVo() {
+        Mockito.doReturn(1).when(usageVoMock).getUsageType();
+        Mockito.doReturn(BigDecimal.TEN).when(quotaManagerImplSpy).getUsageValueAccordingToUsageUnitType(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doReturn(1L).when(quotaTariffVoMock).getId();
+
+        QuotaTariffUsageVO result = quotaManagerImplSpy.createQuotaTariffUsage(usageVoMock, quotaTariffVoMock, BigDecimal.TEN);
+
+        Assert.assertEquals(1L, result.getTariffId().longValue());
+        Assert.assertEquals(BigDecimal.TEN, result.getQuotaUsed());
+    }
+
+    @Test
+    public void persistQuotaTariffUsagesTestZeroQuotaTariffUsagesZeroPersisted() {
+        List<QuotaTariffUsageVO> quotaTariffUsages = new ArrayList<>();
+
+        quotaManagerImplSpy.persistQuotaTariffUsages(quotaTariffUsages, 1L);
+
+        Mockito.verify(quotaTariffUsageDaoMock, Mockito.never()).persistQuotaTariffUsage(Mockito.any());
+    }
+
+    @Test
+    public void persistQuotaTariffUsagesTestTwoQuotaUsageDetailsTwoPersisted() {
+        List<QuotaTariffUsageVO> quotaUsageDetails = new ArrayList<>();
+        QuotaTariffUsageVO quotaUsageDetailVoMock1 = Mockito.mock(QuotaTariffUsageVO.class);
+        QuotaTariffUsageVO quotaUsageDetailVoMock2 = Mockito.mock(QuotaTariffUsageVO.class);
+
+        quotaUsageDetails.add(quotaUsageDetailVoMock1);
+        quotaUsageDetails.add(quotaUsageDetailVoMock2);
+
+        Mockito.doNothing().when(quotaTariffUsageDaoMock).persistQuotaTariffUsage(Mockito.any());
+
+        quotaManagerImplSpy.persistQuotaTariffUsages(quotaUsageDetails, 1L);
+
+        Mockito.verify(quotaTariffUsageDaoMock, Mockito.times(2)).persistQuotaTariffUsage(Mockito.any());
+    }
+
 }
diff --git a/packaging/el8/cloud.spec b/packaging/el8/cloud.spec
index 13c0a36cb106..3ba2e4d5789e 100644
--- a/packaging/el8/cloud.spec
+++ b/packaging/el8/cloud.spec
@@ -127,6 +127,8 @@ Requires: rng-tools
 Requires: (libgcrypt > 1.8.3 or libgcrypt20)
 Requires: (selinux-tools if selinux-tools)
 Requires: sysstat
+Requires: python3-libnbd
+Requires: socat
 Provides: cloud-agent
 Group: System Environment/Libraries
 %description agent
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java
new file mode 100644
index 000000000000..00dcb8fa5752
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java
@@ -0,0 +1,118 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.command;
+
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.response.AccountResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
+import org.apache.cloudstack.api.response.QuotaResponseBuilder;
+import org.apache.cloudstack.api.response.QuotaResourceStatementResponse;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.ObjectUtils;
+
+import javax.inject.Inject;
+
+import java.util.Date;
+
+@APICommand(name = "quotaResourceStatement", responseObject = QuotaResourceStatementResponse.class, since = "4.23.0.0",
+        description = "Generates a detailed Quota statement for a specific resource.", requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false)
+public class QuotaResourceStatementCmd extends BaseCmd {
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.STRING, required = true, description = "ID of the resource.")
+    private String id;
+
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
+            description = "Generate the statement for this Account. A resource may have belonged to different owners at distinct points in time, " +
+                    "so this parameter can be used to only consider the period for which it belonged to a specific Account.")
+    private Long accountId;
+
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
+            description = "Generate the statement for this Project. A resource may have belonged to different owners at distinct points in time, " +
+                    "so this parameter can be used to only consider the period for which it belonged to a specific Project.")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "ID of the Domain for which the Quota statement will be generated.")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.USAGE_TYPE, type = CommandType.INTEGER, required = true, description = "Usage type of the Quota usage.")
+    private Integer usageType;
+
+    @Parameter(name = ApiConstants.START_DATE, type = CommandType.DATE, required = true, description = "Start date for the query. " +
+            ApiConstants.PARAMETER_DESCRIPTION_START_DATE_POSSIBLE_FORMATS)
+    private Date startDate;
+
+    @Parameter(name = ApiConstants.END_DATE, type = CommandType.DATE, required = true, description = "End date for the query. " +
+            ApiConstants.PARAMETER_DESCRIPTION_END_DATE_POSSIBLE_FORMATS)
+    private Date endDate;
+
+    @Parameter(name = ApiConstants.IS_RECURSIVE, type = CommandType.BOOLEAN, description = "Whether to include usage records from children of the filtered domain. "
+            + " Defaults to false.")
+    private Boolean recursive;
+
+    @Inject
+    QuotaResponseBuilder responseBuilder;
+
+    @Override
+    public void execute() {
+        QuotaResourceStatementResponse response = responseBuilder.createQuotaResourceStatement(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        if (ObjectUtils.allNull(accountId, projectId)) {
+            return -1;
+        }
+        return _accountService.finalizeAccountId(accountId, null, null, projectId);
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public Integer getUsageType() {
+        return usageType;
+    }
+
+    public Date getStartDate() {
+        return startDate;
+    }
+
+    public Date getEndDate() {
+        return endDate;
+    }
+
+    public Long getAccountId() {
+        return accountId;
+    }
+
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public boolean isRecursive() {
+        return BooleanUtils.isTrue(recursive);
+    }
+
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
index bfe26a9f4250..f3a27ea58718 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
@@ -20,7 +20,6 @@
 
 import javax.inject.Inject;
 
-import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseCmd;
@@ -32,18 +31,17 @@
 import org.apache.cloudstack.api.response.QuotaStatementItemResponse;
 import org.apache.cloudstack.api.response.QuotaStatementResponse;
 
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.ObjectUtils;
 
 @APICommand(name = "quotaStatement", responseObject = QuotaStatementItemResponse.class, description = "Create a Quota statement for the provided Account, Project, or Domain.",
         since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, httpMethod = "GET")
 public class QuotaStatementCmd extends BaseCmd {
 
-    @ACL
     @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING,
             description = "Name of the Account for which the Quota statement will be generated. Deprecated, please use accountid instead.")
     private String accountName;
 
-    @ACL
     @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
             description = "ID of the Domain for which the Quota statement will be generated. May be used individually or with account.")
     private Long domainId;
@@ -60,16 +58,18 @@ public class QuotaStatementCmd extends BaseCmd {
             description = "Consider only Quota usage records for the specified usage type in the statement.")
     private Integer usageType;
 
-    @ACL
     @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
             description = "ID of the Account for which the Quota statement will be generated. Can not be specified with projectid.")
     private Long accountId;
 
-    @ACL
     @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
             description = "ID of the Project for which the Quota statement will be generated. Can not be specified with accountid.", since = "4.23.0")
     private Long projectId;
 
+    @Parameter(name = ApiConstants.IS_RECURSIVE, type = CommandType.BOOLEAN, description = "Whether to include usage records from children of the filtered domain. "
+            + " Defaults to false.")
+    private Boolean recursive;
+
     @Parameter(name = ApiConstants.SHOW_RESOURCES, type = CommandType.BOOLEAN, description = "List the resources of each Quota type in the period.", since = "4.23.0")
     private boolean showResources;
 
@@ -152,4 +152,9 @@ public void execute() {
         response.setResponseName(getCommandName());
         setResponseObject(response);
     }
+
+    public boolean isRecursive() {
+        return BooleanUtils.isTrue(recursive);
+    }
+
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java
new file mode 100644
index 000000000000..9f0a28389a9d
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java
@@ -0,0 +1,82 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.response;
+
+import java.math.BigDecimal;
+import java.util.Date;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+
+public class QuotaResourceStatementItemResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.TARIFF_ID)
+    @Param(description = "ID of the tariff.")
+    private String tariffId;
+
+    @SerializedName(ApiConstants.TARIFF_NAME)
+    @Param(description = "Name of the tariff.")
+    private String tariffName;
+
+    @SerializedName(ApiConstants.QUOTA_CONSUMED)
+    @Param(description = "Amount of quota used.")
+    private BigDecimal quotaUsed;
+
+    @SerializedName(ApiConstants.START_DATE)
+    @Param(description = "Item's start date.")
+    private Date startDate;
+
+    @SerializedName(ApiConstants.END_DATE)
+    @Param(description = "Item's end date.")
+    private Date endDate;
+
+    @SerializedName(ApiConstants.ACCOUNT_ID)
+    @Param(description = "UUID of the resource's owner.")
+    private String accountId;
+
+    public QuotaResourceStatementItemResponse() {
+        super("quotaresourcestatementitem");
+    }
+
+    public void setTariffId(String tariffId) {
+        this.tariffId = tariffId;
+    }
+
+    public void setTariffName(String tariffName) {
+        this.tariffName = tariffName;
+    }
+
+    public void setQuotaUsed(BigDecimal quotaUsed) {
+        this.quotaUsed = quotaUsed;
+    }
+
+    public void setStartDate(Date startDate) {
+        this.startDate = startDate;
+    }
+
+    public void setEndDate(Date endDate) {
+        this.endDate = endDate;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java
new file mode 100644
index 000000000000..ce3ab1f177ba
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java
@@ -0,0 +1,66 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.response;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import java.math.BigDecimal;
+import java.util.List;
+
+public class QuotaResourceStatementResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.USAGE_NAME)
+    @Param(description = "Name of the usage type.")
+    private String usageName;
+
+    @SerializedName(ApiConstants.UNIT)
+    @Param(description = "Unit of the usage type.")
+    private String unit;
+
+    @SerializedName(ApiConstants.ITEMS)
+    @Param(description = "List of Quota tariff usages.", responseObject = QuotaResourceStatementItemResponse.class)
+    private List<QuotaResourceStatementItemResponse> items;
+
+    @SerializedName(ApiConstants.TOTAL_QUOTA)
+    @Param(description = "Total amount of quota used.")
+    private BigDecimal totalQuotaUsed;
+
+    public QuotaResourceStatementResponse() {
+        super("quotaresourcestatement");
+    }
+
+    public void setUsageName(String usageName) {
+        this.usageName = usageName;
+    }
+
+    public void setUnit(String unit) {
+        this.unit = unit;
+    }
+
+    public void setQuotaUsageDetails(List<QuotaResourceStatementItemResponse> items) {
+        this.items = items;
+    }
+
+    public void setTotalQuotaUsed(BigDecimal totalQuotaUsed) {
+        this.totalQuotaUsed = totalQuotaUsed;
+    }
+
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
index f0390bf626d0..63bf043f4fa9 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
@@ -23,6 +23,7 @@
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -83,4 +84,6 @@ public interface QuotaResponseBuilder {
     Pair<List<QuotaCreditsResponse>, Integer> createQuotaCreditsListResponse(QuotaCreditsListCmd cmd);
 
     QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateActivationRuleCmd cmd);
+
+    QuotaResourceStatementResponse createQuotaResourceStatement(QuotaResourceStatementCmd cmd);
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index 231ba777e600..b71057e64234 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -66,11 +66,14 @@
 import com.cloud.user.UserVO;
 import com.cloud.utils.DateUtil;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
@@ -78,6 +81,7 @@
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -107,16 +111,20 @@
 import org.apache.cloudstack.quota.dao.QuotaEmailTemplatesDao;
 import org.apache.cloudstack.quota.dao.QuotaSummaryDao;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
+import org.apache.cloudstack.quota.dao.QuotaUsageJoinDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.quota.vo.QuotaCreditsVO;
 import org.apache.cloudstack.quota.vo.QuotaEmailConfigurationVO;
 import org.apache.cloudstack.quota.vo.QuotaEmailTemplatesVO;
 import org.apache.cloudstack.quota.vo.QuotaSummaryVO;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageJoinVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageResourceVO;
+import org.apache.cloudstack.usage.UsageTypes;
 import org.apache.cloudstack.utils.jsinterpreter.JsInterpreter;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.commons.collections4.CollectionUtils;
@@ -181,7 +189,12 @@ public class QuotaResponseBuilderImpl implements QuotaResponseBuilder {
     private VMTemplateDao vmTemplateDao;
     @Inject
     private VolumeDao volumeDao;
-
+    @Inject
+    private QuotaUsageJoinDao quotaUsageJoinDao;
+    @Inject
+    private QuotaTariffUsageDao quotaTariffUsageDao;
+    @Inject
+    private EntityManager entityMgr;
 
     private final Class<?>[] assignableClasses = {GenericPresetVariable.class, ComputingResources.class, ResourceCounting.class};
 
@@ -342,9 +355,9 @@ public QuotaBalanceResponse createQuotaBalanceResponse(QuotaBalanceCmd cmd) {
 
     @Override
     public QuotaStatementResponse createQuotaStatementResponse(QuotaStatementCmd cmd) {
-        Long accountId = getAccountIdForQuotaStatement(cmd);
-        Long domainId = getDomainIdForQuotaStatement(cmd, accountId);
-        List<QuotaUsageJoinVO> quotaUsages = _quotaService.getQuotaUsage(accountId, null, domainId, cmd.getUsageType(), cmd.getStartDate(), cmd.getEndDate());
+        Long accountId = getAccountIdForQuotaStatement(cmd.getEntityOwnerId(), null);
+        Pair<Long, List<Long>> baseDomainAndFilteredDomains = getDomainIdsForQuotaStatement(accountId, cmd.getDomainId(), cmd.isRecursive());
+        List<QuotaUsageJoinVO> quotaUsages = _quotaService.getQuotaUsage(accountId, null, baseDomainAndFilteredDomains.second(), cmd.getUsageType(), cmd.getStartDate(), cmd.getEndDate());
 
         logger.debug("Creating quota statement from [{}] usage records for parameters [{}].", quotaUsages.size(),
                 ReflectionToStringBuilderUtils.reflectOnlySelectedFields(cmd, "accountName", "accountId", "projectId", "domainId", "startDate", "endDate", "usageType", "showResources"));
@@ -367,52 +380,16 @@ public QuotaStatementResponse createQuotaStatementResponse(QuotaStatementCmd cmd
             Account account = _accountDao.findByIdIncludingRemoved(accountId);
             statement.setAccountId(account.getUuid());
             statement.setAccountName(account.getAccountName());
-            domainId = account.getDomainId();
         }
-        if (domainId != null) {
-            DomainVO domain = domainDao.findByIdIncludingRemoved(domainId);
+        Long baseDomainId = baseDomainAndFilteredDomains.first();
+        if (baseDomainId != null) {
+            DomainVO domain = domainDao.findByIdIncludingRemoved(baseDomainId);
             statement.setDomainId(domain.getUuid());
         }
 
         return statement;
     }
 
-    protected Long getAccountIdForQuotaStatement(QuotaStatementCmd cmd) {
-        if (Account.Type.NORMAL.equals(CallContext.current().getCallingAccount().getType())) {
-            logger.debug("Limiting the Quota statement for the calling Account, as they are a User Account.");
-            return CallContext.current().getCallingAccountId();
-        }
-
-        long accountId = cmd.getEntityOwnerId();
-        if (accountId != -1) {
-            return accountId;
-        }
-
-        if (cmd.getDomainId() == null) {
-            logger.debug("Limiting the Quota statement for the calling Account, as 'domainid' was not informed.");
-            return CallContext.current().getCallingAccountId();
-        }
-
-        logger.debug("Allowing admin/domain admin to generate the Quota statement for the provided Domain.");
-        return null;
-    }
-
-    protected Long getDomainIdForQuotaStatement(QuotaStatementCmd cmd, Long accountId) {
-        if (accountId != null) {
-            logger.debug("Quota statement is already limited to Account [{}].", accountId);
-            Account account = _accountDao.findByIdIncludingRemoved(accountId);
-            return account.getDomainId();
-        }
-
-        Long domainId = cmd.getDomainId();
-        if (domainId != null) {
-            return domainId;
-        }
-
-        logger.debug("Limiting the Quota statement for the calling Account's Domain.");
-        return CallContext.current().getCallingAccount().getDomainId();
-    }
-
     protected void createDummyRecordForEachQuotaTypeIfUsageTypeIsNotInformed(List<QuotaUsageJoinVO> quotaUsages, Integer usageType) {
         if (usageType != null) {
             logger.debug("As the usage type [{}] was informed as parameter of the API quotaStatement, we will not create dummy records.", usageType);
@@ -1138,7 +1115,7 @@ public QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateA
         addAllPresetVariables(PresetVariables.class, quotaType, usageTypeVariablesAndDescriptions, null);
         List<String> usageTypeVariables = usageTypeVariablesAndDescriptions.stream().map(Pair::first).collect(Collectors.toList());
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value())) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value(), QuotaConfig.QuotaActivationRuleTimeout.key())) {
             Map<String, String> newVariables = injectUsageTypeVariables(jsInterpreter, usageTypeVariables);
             String scriptToExecute = jsInterpreterHelper.replaceScriptVariables(activationRule, newVariables);
             jsInterpreter.executeScript(String.format("new Function(\"%s\")", scriptToExecute.replaceAll("\n", "")));
@@ -1158,6 +1135,184 @@ public QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateA
         return createValidateActivationRuleResponse(activationRule, quotaName, false, message);
     }
 
+    @Override
+    public QuotaResourceStatementResponse createQuotaResourceStatement(QuotaResourceStatementCmd cmd) {
+        String resourceUuid = cmd.getId();
+        Integer usageType = cmd.getUsageType();
+        Date startDate = cmd.getStartDate();
+        Date endDate = cmd.getEndDate();
+
+        if (startDate.after(endDate)) {
+            throw new InvalidParameterValueException(String.format("The start date [%s] must be before the end date [%s].", startDate, endDate));
+        }
+
+        InternalIdentity resource = retrieveResource(resourceUuid, usageType);
+        if (resource == null) {
+            logger.error("Could not find resource [{}] of type [{}]. Returning an empty list.", resourceUuid, usageType);
+            return createQuotaResourceStatementResponse(resourceUuid, usageType,  new ArrayList<>(), new BigDecimal(0));
+        }
+
+        long id = resource.getId();
+
+        Long currentOwnerId = null;
+        if (resource instanceof ControlledEntity) {
+            currentOwnerId = ((ControlledEntity) resource).getAccountId();
+        }
+        Long accountId = getAccountIdForQuotaStatement(cmd.getEntityOwnerId(), currentOwnerId);
+        Pair<Long, List<Long>> baseDomainAndFilteredDomains = getDomainIdsForQuotaStatement(accountId, cmd.getDomainId(), cmd.isRecursive());
+
+        Long resourceId = null;
+        Long networkId = null;
+        Long offeringId = null;
+
+        switch (usageType) {
+            case UsageTypes.NETWORK_OFFERING:
+            case UsageTypes.BACKUP:
+                offeringId = id;
+                break;
+            case UsageTypes.NETWORK_BYTES_RECEIVED:
+            case UsageTypes.NETWORK_BYTES_SENT:
+                networkId = id;
+                break;
+            default:
+                resourceId = id;
+        }
+
+        logger.debug("Attempting to find quota usages with parameters usage type [{}], usage id [{}], network id [{}], offering id [{}], and between [{}] and [{}].",
+                usageType, resourceId, networkId, offeringId, startDate, endDate);
+
+        List<QuotaUsageJoinVO> quotaUsageJoinList = quotaUsageJoinDao.findQuotaUsage(accountId, baseDomainAndFilteredDomains.second(), usageType, resourceId, networkId, offeringId, startDate, endDate, null);
+
+        logger.debug("Found [{}] quota usages using as parameter usage type [{}], usage id [{}], network id [{}], offering id [{}], and between [{}] and [{}].",
+                quotaUsageJoinList.size(), usageType, resourceId, networkId, offeringId, startDate, endDate);
+
+        List<QuotaResourceStatementItemResponse> quotaResourceStatementItemResponseList = new ArrayList<>();
+        BigDecimal totalQuotaUsed = new BigDecimal(0);
+        List<QuotaTariffVO> quotaTariffs = _quotaTariffDao.listQuotaTariffs(null, null, usageType, null, null, true, null, null).first();
+
+        for (QuotaUsageJoinVO quotaUsageJoin : quotaUsageJoinList) {
+            Account account = _accountMgr.getAccount(quotaUsageJoin.getAccountId());
+            String accountUuid = account.getUuid();
+
+            List<QuotaTariffUsageVO> quotaTariffUsageList = quotaTariffUsageDao.listQuotaTariffUsages(quotaUsageJoin.getId());
+            logger.debug("Found [{}] quota tariff usages associated to the quota usage [{}] of resource [{}] and type [{}] between [{}] and [{}].",
+                    quotaTariffUsageList.size(), quotaUsageJoin, resourceUuid, usageType, startDate, endDate);
+            for (QuotaTariffUsageVO quotaTariffUsage: quotaTariffUsageList) {
+                quotaResourceStatementItemResponseList.add(createQuotaResourceStatementItemResponse(quotaTariffUsage, quotaTariffs, quotaUsageJoin.getStartDate(),
+                        quotaUsageJoin.getEndDate(), accountUuid));
+                totalQuotaUsed = totalQuotaUsed.add(quotaTariffUsage.getQuotaUsed());
+            }
+        }
+        logger.debug("The total quota used of type [{}] between [{}] and [{}] for the resource [{}] was [{}].", usageType, startDate, endDate, resourceUuid, totalQuotaUsed);
+
+        return createQuotaResourceStatementResponse(resourceUuid, usageType, quotaResourceStatementItemResponseList, totalQuotaUsed);
+    }
+
+    protected Long getAccountIdForQuotaStatement(long providedAccountId, Long fallbackAccountId) {
+        Account caller = CallContext.current().getCallingAccount();
+
+        if (providedAccountId != -1L) {
+            Account account = _accountDao.findByIdIncludingRemoved(providedAccountId);
+            _accountMgr.checkAccess(caller, null, false, account);
+            logger.debug("Limiting the Quota resource statement for the provided Account [{}].", providedAccountId);
+            return providedAccountId;
+        }
+
+        Account.Type callerType = caller.getType();
+        if (Account.Type.ADMIN.equals(callerType) || Account.Type.DOMAIN_ADMIN.equals(callerType)) {
+            logger.debug("Not limiting the Quota resource statement for a specific Account, as no specific Account was provided and the caller is either an admin or domain admin.");
+            return null;
+        }
+
+        if (fallbackAccountId != null) {
+            Account fallbackAccount = _accountDao.findByIdIncludingRemoved(fallbackAccountId);
+            _accountMgr.checkAccess(caller, null, false, fallbackAccount);
+            logger.debug("Limiting the Quota statement for the fallback Account [{}], as no specific Account was provided.", fallbackAccountId);
+            return fallbackAccountId;
+        }
+
+        logger.debug("Limiting the Quota resource statement for the calling account, as no specific Account was provided and no fallback account was provided.");
+        return caller.getAccountId();
+    }
+
+    protected Pair<Long, List<Long>> getDomainIdsForQuotaStatement(Long finalAccountId, Long providedDomainId, boolean isRecursive) {
+        if (finalAccountId != null) {
+            // Access to the provided account has already been validated
+            logger.debug("Not limiting the Quota statement for a specific Domain, as we are already limiting by Account.");
+            return new Pair<>(null, null);
+        }
+
+        // User accounts will have already been limited to themselves
+        Account caller = CallContext.current().getCallingAccount();
+        Long domainId = providedDomainId;
+
+        if (domainId != null) {
+            Domain domain = domainDao.findByIdIncludingRemoved(domainId);
+            _accountMgr.checkAccess(caller, domain);
+            logger.debug("Limiting the Quota statement for the provided Domain [{}].", domainId);
+        } else {
+            domainId = caller.getDomainId();
+            logger.debug("Limiting the Quota statement for the caller's Domain [{}], as no 'domainid' was provided.", domainId);
+        }
+
+        if (isRecursive) {
+            logger.debug("Allowing the Quota statement for the Domain's children, as the 'isrecursive' parameter was provided.");
+            return new Pair<>(domainId, domainDao.getDomainAndChildrenIds(domainId));
+        }
+
+        return new Pair<>(domainId, List.of(domainId));
+    }
+
+    protected InternalIdentity retrieveResource(String resourceUuid, Integer usageType) {
+        Class<?> clazz = QuotaTypes.getClazz(usageType);
+        if (clazz == null) {
+            throw new InvalidParameterValueException(String.format("Invalid usage type [%s] provided.", usageType));
+        }
+
+        logger.debug("Attempting to find a resource with ID [{}] and of type [{}].", resourceUuid, usageType);
+        Object object = entityMgr.findByUuidIncludingRemoved(clazz, resourceUuid);
+        if (object == null) {
+            return null;
+        }
+        return (InternalIdentity) object;
+    }
+
+    protected QuotaResourceStatementItemResponse createQuotaResourceStatementItemResponse(QuotaTariffUsageVO quotaTariffUsage, List<QuotaTariffVO> quotaTariffs,
+                                                                                          Date startDate, Date endDate, String accountUuid) {
+        logger.trace("Creating quota resource statement item associated to quota tariff usage [{}].", quotaTariffUsage);
+        QuotaResourceStatementItemResponse quotaResourceStatementItemResponse = new QuotaResourceStatementItemResponse();
+
+        QuotaTariffVO quotaTariff = quotaTariffs.stream().filter(quotaTariffVO -> quotaTariffUsage.getTariffId().equals(quotaTariffVO.getId())).findAny().orElse(null);
+
+        quotaResourceStatementItemResponse.setQuotaUsed(quotaTariffUsage.getQuotaUsed());
+        quotaResourceStatementItemResponse.setStartDate(startDate);
+        quotaResourceStatementItemResponse.setEndDate(endDate);
+        quotaResourceStatementItemResponse.setAccountId(accountUuid);
+        if (quotaTariff != null) {
+            logger.trace("Quota usage details item will be associated to the quota tariff [{}].", quotaTariff);
+            quotaResourceStatementItemResponse.setTariffId(quotaTariff.getUuid());
+            quotaResourceStatementItemResponse.setTariffName(quotaTariff.getName());
+        }
+
+        return quotaResourceStatementItemResponse;
+    }
+
+    protected QuotaResourceStatementResponse createQuotaResourceStatementResponse(String resourceUuid, Integer usageType,
+                                                                                  List<QuotaResourceStatementItemResponse> quotaUsageDetailsItems, BigDecimal totalQuotaUsed) {
+        logger.trace("Creating quota usage details list response associated to the resource of  UUID [{}], with an usage type of [{}], [{}] quota" +
+                " usage details items, and a total quota used of [{}].", resourceUuid, usageType, quotaUsageDetailsItems.size(), totalQuotaUsed);
+        QuotaResourceStatementResponse quotaResourceStatementResponse = new QuotaResourceStatementResponse();
+
+        QuotaTypes quotaType = QuotaTypes.getQuotaType(usageType);
+        quotaResourceStatementResponse.setUsageName(quotaType.getQuotaName());
+        quotaResourceStatementResponse.setUnit(quotaType.getQuotaUnit());
+
+        quotaResourceStatementResponse.setQuotaUsageDetails(quotaUsageDetailsItems);
+        quotaResourceStatementResponse.setTotalQuotaUsed(totalQuotaUsed);
+
+        return quotaResourceStatementResponse;
+    }
+
     /**
      * Checks whether script variables are compatible with the usage type. First, we remove all script variables that correspond to the script's usage type variables.
      * Then, returns true if none of the remaining script variables match any usage types variables, and false otherwise.
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
index 81cb1011182d..c30780582d36 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
@@ -31,11 +31,11 @@ public class QuotaStatementResponse  extends BaseResponse {
     @Param(description = "ID of the Account.")
     private String accountId;
 
-    @SerializedName(ApiConstants.ACCOUNT)
+    @SerializedName(ApiConstants.ACCOUNT_NAME)
     @Param(description = "Name of the Account.")
     private String accountName;
 
-    @SerializedName(ApiConstants.DOMAIN)
+    @SerializedName(ApiConstants.DOMAIN_ID)
     @Param(description = "ID of the Domain.")
     private String domainId;
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
index 478e43d2e203..cc257c233def 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
@@ -28,7 +28,7 @@
 
 public interface QuotaService extends PluggableService {
 
-    List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, Long domainId, Integer usageType, Date startDate, Date endDate);
+    List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, List<Long> domainIds, Integer usageType, Date startDate, Date endDate);
 
     List<QuotaBalanceVO> listQuotaBalancesForAccount(Long accountId, Date startDate, Date endDate);
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
index e1ec2ebb2a60..a788f0c8b01e 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
@@ -38,6 +38,7 @@
 import org.apache.cloudstack.api.command.QuotaEnabledCmd;
 import org.apache.cloudstack.api.command.QuotaListEmailConfigurationCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -131,6 +132,7 @@ public List<Class<?>> getCommands() {
         cmdList.add(QuotaListEmailConfigurationCmd.class);
         cmdList.add(QuotaPresetVariablesListCmd.class);
         cmdList.add(QuotaValidateActivationRuleCmd.class);
+        cmdList.add(QuotaResourceStatementCmd.class);
         return cmdList;
     }
 
@@ -203,15 +205,15 @@ protected void validateStartDateAndEndDateForListQuotaBalancesForAccount(Date st
     }
 
     @Override
-    public List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, Long domainId, Integer usageType, Date startDate, Date endDate) {
+    public List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, List<Long> domainIds, Integer usageType, Date startDate, Date endDate) {
         if (startDate.after(endDate)) {
             throw new InvalidParameterValueException("Incorrect Date Range. Start date: " + startDate + " is after end date:" + endDate);
         }
 
-        logger.debug("Getting quota records of type [{}] for account [{}] in domain [{}], between [{}] and [{}].",
-                usageType, accountId, domainId, startDate, endDate);
+        logger.debug("Getting quota records of type [{}] for account [{}] in domains [{}], between [{}] and [{}].",
+                usageType, accountId, domainIds, startDate, endDate);
 
-        return quotaUsageJoinDao.findQuotaUsage(accountId, domainId, usageType, null, null, null, startDate, endDate, null);
+        return quotaUsageJoinDao.findQuotaUsage(accountId, domainIds, usageType, null, null, null, startDate, endDate, null);
     }
 
     @Override
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
index 0c7610461c15..37307db45629 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
@@ -38,14 +38,15 @@
 import com.cloud.user.AccountManager;
 import com.cloud.user.UserVO;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
-import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaValidateActivationRuleCmd;
 import org.apache.cloudstack.context.CallContext;
@@ -156,7 +157,7 @@ public class QuotaResponseBuilderImplTest extends TestCase {
     Date date = new Date();
 
     @Mock
-    Account accountMock;
+    AccountVO accountMock;
 
     @Mock
     DomainVO domainVoMock;
@@ -188,6 +189,9 @@ public class QuotaResponseBuilderImplTest extends TestCase {
     @Mock
     User callerUserMock;
 
+    @Mock
+    EntityManager entityManagerMock;
+
     @Before
     public void setup() {
         CallContext.register(callerUserMock, callerAccountMock);
@@ -1024,107 +1028,161 @@ public void setStatementItemResourcesTestDoNotShowResourcesDoNothing() {
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestLimitsToCallingAccountForNormalUser() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsProvidedAccount() {
+        long providedAccountId = 200L;
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.NORMAL).when(accountMock).getType();
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(providedAccountId)).thenReturn(accountMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+        long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(providedAccountId, null);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
-
-            Assert.assertEquals(Long.valueOf(callerAccountMock.getAccountId()), result);
-        }
+        Assert.assertEquals(200L, result);
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestReturnsEntityOwnerIdWhenProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsAdminWithoutProvidedAccount() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.ADMIN);
 
-        Mockito.doReturn(42L).when(cmd).getEntityOwnerId();
+        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, null);
+
+        assertNull(result);
+        Mockito.verify(accountManagerMock, Mockito.never()).getAccount(Mockito.anyLong());
+    }
+
+    @Test
+    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsDomainAdminWithoutProvidedAccount() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.DOMAIN_ADMIN);
 
-        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, null);
 
-        Assert.assertEquals(Long.valueOf(42L), result);
+        assertNull(result);
+        Mockito.verify(accountManagerMock, Mockito.never()).getAccount(Mockito.anyLong());
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestLimitsToCallingAccountWhenCallerIsAdminAndDomainIsNotProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsFallbackAccountWhenNoAccountProvidedAndCallerIsNotAdmin() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.NORMAL);
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.ADMIN).when(accountMock).getType();
-        Mockito.doReturn(-1L).when(cmd).getEntityOwnerId();
-        Mockito.doReturn(null).when(cmd).getDomainId();
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(300L)).thenReturn(accountMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+        long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, 300L);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        assertEquals(300L, result);
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
+    }
 
-            Assert.assertEquals(Long.valueOf(callerAccountMock.getAccountId()), result);
-        }
+    @Test
+    public void getAccountIdForQuotaStatementTestAccessDeniedForProvidedAccount() {
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(200L)).thenReturn(accountMock);
+        Mockito.doThrow(new PermissionDeniedException("Access denied"))
+                .when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
+
+        Assert.assertThrows(PermissionDeniedException.class,
+                () -> quotaResponseBuilderSpy.getAccountIdForQuotaStatement(200L, null));
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsAdminAndDomainIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getDomainIdsForQuotaStatementTestReturnsNullPairWhenAccountIsProvided() {
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(100L, null, false);
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.ADMIN).when(accountMock).getType();
-        Mockito.doReturn(-1L).when(cmd).getEntityOwnerId();
-        Mockito.doReturn(10L).when(cmd).getDomainId();
+        assertNull(result.first());
+        assertNull(result.second());
+        Mockito.verify(domainDaoMock, Mockito.never()).findByIdIncludingRemoved(Mockito.anyLong());
+    }
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+    @Test
+    public void getDomainIdsForQuotaStatementTestReturnsProvidedDomainIdNonRecursively() {
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, false);
 
-            Assert.assertNull(result);
-        }
+        assertEquals(5L, (long) result.first());
+        assertEquals(List.of(5L), result.second());
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestReturnsAccountDomainIdWhenAccountIdIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
-        AccountVO account = Mockito.mock(AccountVO.class);
+    public void getDomainIdsForQuotaStatementTestReturnsCallerDomainNonRecursively() {
+        Mockito.when(callerAccountMock.getDomainId()).thenReturn(7L);
 
-        Mockito.doReturn(account).when(accountDaoMock).findByIdIncludingRemoved(55L);
-        Mockito.doReturn(77L).when(account).getDomainId();
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, null, false);
 
-        Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, 55L);
+        assertEquals(7L, (long) result.first());
+        assertEquals(List.of(7L), result.second());
+        Mockito.verify(domainDaoMock, Mockito.never()).findByIdIncludingRemoved(Mockito.anyLong());
+    }
+
+    @Test
+    public void getDomainIdsForQuotaStatementTestReturnsProvidedDomainRecursively() {
+        List<Long> domainAndChildren = List.of(5L, 10L, 15L);
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.when(domainDaoMock.getDomainAndChildrenIds(5L)).thenReturn(domainAndChildren);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-        Assert.assertEquals(Long.valueOf(77L), result);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, true);
+
+        assertEquals(5L, (long) result.first());
+        assertEquals(domainAndChildren, result.second());
+        Mockito.verify(domainDaoMock).getDomainAndChildrenIds(5L);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestReturnsProvidedDomainIdWhenAccountIdIsNull() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getDomainIdsForQuotaStatementReturnsCallerDomainRecursively() {
+        List<Long> domainAndChildren = List.of(1L, 2L, 3L);
+        Mockito.when(callerAccountMock.getDomainId()).thenReturn(1L);
 
-        Mockito.doReturn(99L).when(cmd).getDomainId();
+        Mockito.when(domainDaoMock.getDomainAndChildrenIds(1L)).thenReturn(domainAndChildren);
 
-        Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, null);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, null, true);
 
-        Assert.assertEquals(Long.valueOf(99L), result);
+        assertEquals(1L, (long) result.first());
+        assertEquals(domainAndChildren, result.second());
+        Mockito.verify(domainDaoMock).getDomainAndChildrenIds(1L);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestFallsBackToCallingAccountDomainIdWhenNeitherAccountNorDomainIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
-        Account account = Mockito.mock(Account.class);
+    public void getDomainIdsForQuotaStatementTestThrowsAccessDeniedForProvidedDomain() {
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.doThrow(new PermissionDeniedException("Access denied"))
+                .when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-        Mockito.doReturn(null).when(cmd).getDomainId();
-        Mockito.doReturn(123L).when(account).getDomainId();
-        Mockito.doReturn(account).when(callContextMock).getCallingAccount();
+        Assert.assertThrows(PermissionDeniedException.class,
+                () -> quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, false));
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
+    }
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+    @Test(expected = InvalidParameterValueException.class)
+    public void retrieveResourceTestThrowsExceptionForInvalidUsageType() {
+        Integer invalidUsageType = 999;
+        quotaResponseBuilderSpy.retrieveResource("validUuid", invalidUsageType);
+    }
+
+    @Test
+    public void retrieveResourceTestReturnsNullForNonexistentResource() {
+        String invalidUuid = "nonexistentUuid";
+        Integer validUsageType = QuotaTypes.ALLOCATED_VM;
 
-            Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, null);
+        Mockito.doReturn(null).when(entityManagerMock).findByUuidIncludingRemoved(Mockito.any(), Mockito.eq(invalidUuid));
+        InternalIdentity result = quotaResponseBuilderSpy.retrieveResource(invalidUuid, validUsageType);
 
-            Assert.assertEquals(123L, result.longValue());
-        }
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void retrieveResourceTestReturnsCorrectResource() {
+        String validUuid = "validUuid";
+        Integer validUsageType = QuotaTypes.ALLOCATED_VM;
+        InternalIdentity mockResource = Mockito.mock(InternalIdentity.class);
+
+        Mockito.doReturn(mockResource).when(entityManagerMock).findByUuidIncludingRemoved(Mockito.any(), Mockito.eq(validUuid));
+
+        InternalIdentity result = quotaResponseBuilderSpy.retrieveResource(validUuid, validUsageType);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(mockResource, result);
     }
 }
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
index 89c48b1cc660..c0ee6c5fc3fe 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
@@ -117,12 +117,12 @@ public void setup() throws IllegalAccessException, NoSuchFieldException, Configu
     public void testGetQuotaUsage() {
         final long accountId = 2L;
         final String accountName = "admin123";
-        final long domainId = 1L;
+        final List<Long> domainIds = List.of(1L);
         final Date startDate = new DateTime().minusDays(2).toDate();
         final Date endDate = new Date();
 
-        quotaServiceImplSpy.getQuotaUsage(accountId, accountName, domainId, QuotaTypes.IP_ADDRESS, startDate, endDate);
-        Mockito.verify(quotaUsageJoinDaoMock, Mockito.times(1)).findQuotaUsage(Mockito.eq(accountId), Mockito.eq(domainId), Mockito.eq(QuotaTypes.IP_ADDRESS), Mockito.any(),
+        quotaServiceImplSpy.getQuotaUsage(accountId, accountName, domainIds, QuotaTypes.IP_ADDRESS, startDate, endDate);
+        Mockito.verify(quotaUsageJoinDaoMock, Mockito.times(1)).findQuotaUsage(Mockito.eq(accountId), Mockito.eq(domainIds), Mockito.eq(QuotaTypes.IP_ADDRESS), Mockito.any(),
                 Mockito.any(), Mockito.any(), Mockito.any(Date.class), Mockito.any(Date.class), Mockito.any());
     }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java
new file mode 100644
index 000000000000..2e9852f7bc1e
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java
@@ -0,0 +1,123 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+/**
+ * Communicates with the cloudstack-image-server control socket via socat.
+ *
+ * Protocol: newline-delimited JSON over a Unix domain socket.
+ * Actions: register, unregister, status.
+ */
+public class ImageServerControlSocket {
+    private static final Logger LOGGER = LogManager.getLogger(ImageServerControlSocket.class);
+    static final String CONTROL_SOCKET_PATH = "/var/run/cloudstack/image-server.sock";
+    private static final Gson GSON = new GsonBuilder().create();
+
+    private ImageServerControlSocket() {
+    }
+
+    /**
+     * Send a JSON message to the image server control socket and return the
+     * parsed response, or null on communication failure.
+     */
+    static JsonObject sendMessage(Map<String, Object> message) {
+        String json = GSON.toJson(message);
+        Script script = new Script("/bin/bash", LOGGER);
+        script.add("-c");
+        script.add(String.format("echo '%s' | socat -t5 - UNIX-CONNECT:%s",
+                json.replace("'", "'\\''"), CONTROL_SOCKET_PATH));
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        String result = script.execute(parser);
+        if (result != null) {
+            LOGGER.error("Control socket communication failed: {}", result);
+            return null;
+        }
+        String output = parser.getLines();
+        if (output == null || output.trim().isEmpty()) {
+            LOGGER.error("Empty response from control socket");
+            return null;
+        }
+        try {
+            return JsonParser.parseString(output.trim()).getAsJsonObject();
+        } catch (Exception e) {
+            LOGGER.error("Failed to parse control socket response: {}", output, e);
+            return null;
+        }
+    }
+
+    /**
+     * Register a transfer config with the image server.
+     * @return true if the server accepted the registration.
+     */
+    public static boolean registerTransfer(String transferId, Map<String, Object> config) {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "register");
+        msg.put("transfer_id", transferId);
+        msg.put("config", config);
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return false;
+        }
+        return "ok".equals(resp.has("status") ? resp.get("status").getAsString() : null);
+    }
+
+    /**
+     * Unregister a transfer from the image server.
+     * @return the number of remaining active transfers, or -1 on error.
+     */
+    public static int unregisterTransfer(String transferId) {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "unregister");
+        msg.put("transfer_id", transferId);
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return -1;
+        }
+        if (!"ok".equals(resp.has("status") ? resp.get("status").getAsString() : null)) {
+            return -1;
+        }
+        return resp.has("active_transfers") ? resp.get("active_transfers").getAsInt() : -1;
+    }
+
+    /**
+     * Check whether the image server control socket is responsive.
+     * @return true if the server responded with status "ok".
+     */
+    public static boolean isReady() {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "status");
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return false;
+        }
+        return "ok".equals(resp.has("status") ? resp.get("status").getAsString() : null);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 06b668b801d3..4a93b1bce4a1 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -79,6 +79,7 @@
 import org.apache.cloudstack.command.ReconcileCommandUtils;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
 import org.apache.cloudstack.gpu.GpuDevice;
+import org.apache.cloudstack.storage.command.browser.ListDataStoreObjectsAnswer;
 import org.apache.cloudstack.storage.command.browser.ListDataStoreObjectsCommand;
 import org.apache.cloudstack.storage.configdrive.ConfigDrive;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
@@ -228,6 +229,7 @@
 import com.cloud.storage.Storage;
 import com.cloud.storage.Storage.StoragePoolType;
 import com.cloud.storage.StorageLayer;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.Volume;
 import com.cloud.storage.resource.StorageSubsystemCommandHandler;
 import com.cloud.storage.resource.StorageSubsystemCommandHandlerBase;
@@ -387,6 +389,9 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
 
     public static final String CHECKPOINT_DELETE_COMMAND = "virsh checkpoint-delete --domain %s --checkpointname %s  --metadata";
 
+    public static final int IMAGE_SERVER_DEFAULT_PORT = 54322;
+    public static final String IMAGE_SERVER_SYSTEMD_UNIT_NAME = "cloudstack-image-server";
+
     protected int qcow2DeltaMergeTimeout;
 
     private String modifyVlanPath;
@@ -400,6 +405,9 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
     private String heartBeatPath;
     private String vmActivityCheckPath;
     private String nasBackupPath;
+    private String imageServerPath;
+    private boolean imageServerTlsEnabled = false;
+    private String imageServerListenAddress;
     private String securityGroupPath;
     private String ovsPvlanDhcpHostPath;
     private String ovsPvlanVmPath;
@@ -814,6 +822,18 @@ public String getNasBackupPath() {
         return nasBackupPath;
     }
 
+    public String getImageServerPath() {
+        return imageServerPath;
+    }
+
+    public boolean isImageServerTlsEnabled() {
+        return imageServerTlsEnabled;
+    }
+
+    public String getImageServerListenAddress() {
+        return imageServerListenAddress;
+    }
+
     public String getOvsPvlanDhcpHostPath() {
         return ovsPvlanDhcpHostPath;
     }
@@ -1077,6 +1097,9 @@ public boolean configure(final String name, final Map<String, Object> params) th
 
         cachePath = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HOST_CACHE_LOCATION);
 
+        imageServerTlsEnabled = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.IMAGE_SERVER_TLS_ENABLED);
+        imageServerListenAddress = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.IMAGE_SERVER_LISTEN_ADDRESS);
+
         params.put("domr.scripts.dir", domrScriptsDir);
 
         virtRouterResource = new VirtualRoutingResource(this);
@@ -1140,6 +1163,12 @@ public boolean configure(final String name, final Map<String, Object> params) th
             throw new ConfigurationException("Unable to find nasbackup.sh");
         }
 
+        String imageServerMain = Script.findScript(kvmScriptsDir, "imageserver/__main__.py");
+        if (imageServerMain == null) {
+            throw new ConfigurationException("Unable to find imageserver package");
+        }
+        imageServerPath = new File(imageServerMain).getParent();
+
         createTmplPath = Script.findScript(storageScriptsDir, "createtmplt.sh");
         if (createTmplPath == null) {
             throw new ConfigurationException("Unable to find the createtmplt.sh");
@@ -2557,6 +2586,8 @@ public String getResizeScriptType(final KVMStoragePool pool, final KVMPhysicalDi
 
         if (pool.getType() == StoragePoolType.CLVM && volFormat == PhysicalDiskFormat.RAW) {
             return "CLVM";
+        } else if (poolType == StoragePoolType.CLVM_NG) {
+            return "CLVM_NG";
         } else if ((poolType == StoragePoolType.NetworkFilesystem
                 || poolType == StoragePoolType.SharedMountPoint
                 || poolType == StoragePoolType.Filesystem
@@ -3795,13 +3826,18 @@ public int compare(final DiskTO arg0, final DiskTO arg1) {
                     final String glusterVolume = pool.getSourceDir().replace("/", "");
                     disk.defNetworkBasedDisk(glusterVolume + path.replace(mountpoint, ""), pool.getSourceHost(), pool.getSourcePort(), null,
                             null, devId, diskBusType, DiskProtocol.GLUSTER, DiskDef.DiskFmtType.QCOW2);
-                } else if (pool.getType() == StoragePoolType.CLVM || physicalDisk.getFormat() == PhysicalDiskFormat.RAW) {
+                } else if (pool.getType() == StoragePoolType.CLVM || pool.getType() == StoragePoolType.CLVM_NG || physicalDisk.getFormat() == PhysicalDiskFormat.RAW) {
                     if (volume.getType() == Volume.Type.DATADISK && !(isWindowsTemplate && isUefiEnabled)) {
                         disk.defBlockBasedDisk(physicalDisk.getPath(), devId, diskBusTypeData);
-                    }
-                    else {
+                    } else {
                         disk.defBlockBasedDisk(physicalDisk.getPath(), devId, diskBusType);
                     }
+
+                    // CLVM_NG uses QCOW2 format on block devices, override the default RAW format
+                    if (pool.getType() == StoragePoolType.CLVM_NG) {
+                        disk.setDiskFormatType(DiskDef.DiskFmtType.QCOW2);
+                    }
+
                     if (pool.getType() == StoragePoolType.Linstor && isQemuDiscardBugFree(diskBusType)) {
                         disk.setDiscard(DiscardType.UNMAP);
                     }
@@ -5349,6 +5385,24 @@ public void removeCheckpointsOnVm(String vmName, String volumeUuid, List<String>
         logger.debug("Removed all checkpoints of volume [{}] on VM [{}].", volumeUuid, vmName);
     }
 
+    public Map<String, String> getDiskPathLabelMap(String vmName) {
+        try {
+            Connect conn = LibvirtConnection.getConnectionByVmName(vmName);
+            List<DiskDef> disks = getDisks(conn, vmName);
+            Map<String, String> diskPathLabelMap = new HashMap<>();
+            for (DiskDef disk : disks) {
+                if (disk.getDeviceType() != DeviceType.DISK) {
+                    continue;
+                }
+                diskPathLabelMap.put(disk.getDiskPath(), disk.getDiskLabel());
+            }
+            return diskPathLabelMap;
+        } catch (LibvirtException e) {
+            logger.error("Failed to get disk path label map for VM [{}] due to: [{}].", vmName, e.getMessage(), e);
+            throw new CloudRuntimeException(e);
+        }
+    }
+
     public boolean recreateCheckpointsOnVm(List<VolumeObjectTO> volumes, String vmName, Connect conn) {
         logger.debug("Trying to recreate checkpoints on VM [{}] with volumes [{}].", vmName, volumes);
         try {
@@ -5683,10 +5737,73 @@ public boolean configureDefaultNetworkRulesForSystemVm(final Connect conn, final
 
     public Answer listFilesAtPath(ListDataStoreObjectsCommand command) {
         DataStoreTO store = command.getStore();
-        KVMStoragePool storagePool = storagePoolManager.getStoragePool(StoragePoolType.NetworkFilesystem, store.getUuid());
+        StoragePoolType poolType = StoragePoolType.NetworkFilesystem;
+        if (store instanceof PrimaryDataStoreTO) {
+            poolType = ((PrimaryDataStoreTO) store).getPoolType();
+        }
+        KVMStoragePool storagePool = storagePoolManager.getStoragePool(poolType, store.getUuid());
+        if (ClvmPoolManager.isClvmPoolType(poolType)) {
+            return listLvmVolumes(storagePool.getLocalPath(), command.getStartIndex(), command.getPageSize());
+        }
         return listFilesAtPath(storagePool.getLocalPath(), command.getPath(), command.getStartIndex(), command.getPageSize());
     }
 
+    private Answer listLvmVolumes(String localPath, int startIndex, int pageSize) {
+        String vgName = localPath;
+        if (vgName.startsWith("/")) {
+            String[] parts = vgName.split("/");
+            for (int i = parts.length - 1; i >= 0; i--) {
+                if (!parts[i].isEmpty()) {
+                    vgName = parts[i];
+                    break;
+                }
+            }
+        }
+
+        Script lvs = new Script("lvs", 30000, logger);
+        lvs.add("--noheadings");
+        lvs.add("--nosuffix");
+        lvs.add("-o", "lv_name,lv_size");
+        lvs.add("--units", "b");
+        lvs.add(vgName);
+        AllLinesParser parser = new AllLinesParser();
+        String result = lvs.execute(parser);
+
+        List<String> names = new ArrayList<>();
+        List<String> paths = new ArrayList<>();
+        List<String> absPaths = new ArrayList<>();
+        List<Boolean> isDirs = new ArrayList<>();
+        List<Long> sizes = new ArrayList<>();
+        List<Long> lastModified = new ArrayList<>();
+
+        if (result != null) {
+            logger.warn("lvs listing failed for VG {}: {}", vgName, result);
+            return new ListDataStoreObjectsAnswer(false, 0, names, paths, absPaths, isDirs, sizes, lastModified);
+        }
+
+        List<String[]> entries = new ArrayList<>();
+        for (String line : parser.getLines().split("\n")) {
+            String trimmed = line.trim();
+            if (trimmed.isEmpty()) continue;
+            String[] cols = trimmed.split("\\s+");
+            if (cols.length >= 2) entries.add(cols);
+        }
+
+        int count = entries.size();
+        for (int i = startIndex; i < startIndex + pageSize && i < count; i++) {
+            String lvName = entries.get(i)[0];
+            long size = 0;
+            try { size = Long.parseLong(entries.get(i)[1]); } catch (NumberFormatException ignored) {}
+            names.add(lvName);
+            paths.add("/" + lvName);
+            absPaths.add("/dev/" + vgName + "/" + lvName);
+            isDirs.add(false);
+            sizes.add(size);
+            lastModified.add(0L);
+        }
+        return new ListDataStoreObjectsAnswer(true, count, names, paths, absPaths, isDirs, sizes, lastModified);
+    }
+
     public boolean addNetworkRules(final String vmName, final String vmId, final String guestIP, final String guestIP6, final String sig, final String seq, final String mac, final String rules, final String vif, final String brname,
                                    final String secIps) {
         if (!canBridgeFirewall) {
@@ -6775,4 +6892,237 @@ public String getHypervisorPath() {
     public String getGuestCpuArch() {
         return guestCpuArch;
     }
+
+    /**
+     * CLVM volume state for migration operations on source host
+     */
+    public enum ClvmVolumeState {
+        /** Shared mode (-asy) - used before migration to allow both hosts to access volume */
+        SHARED("-asy", "shared", "Before migration: activating in shared mode"),
+
+        /** Deactivate (-an) - used after successful migration to release volume on source */
+        DEACTIVATE("-an", "deactivated", "After successful migration: deactivating volume"),
+
+        /** Exclusive mode (-aey) - used after failed migration to revert to original exclusive state */
+        EXCLUSIVE("-aey", "exclusive", "After failed migration: reverting to exclusive mode");
+
+        private final String lvchangeFlag;
+        private final String description;
+        private final String logMessage;
+
+        ClvmVolumeState(String lvchangeFlag, String description, String logMessage) {
+            this.lvchangeFlag = lvchangeFlag;
+            this.description = description;
+            this.logMessage = logMessage;
+        }
+
+        public String getLvchangeFlag() {
+            return lvchangeFlag;
+        }
+
+        public String getDescription() {
+            return description;
+        }
+
+        public String getLogMessage() {
+            return logMessage;
+        }
+    }
+
+    public static void modifyClvmVolumesStateForMigration(List<DiskDef> disks, VirtualMachineTO vmSpec, ClvmVolumeState state) {
+        for (DiskDef disk : disks) {
+            if (isClvmVolume(disk, vmSpec)) {
+                String volumePath = disk.getDiskPath();
+                try {
+                    modifyClvmVolumeState(volumePath, state.getLvchangeFlag(), state.getDescription(), state.getLogMessage());
+                } catch (Exception e) {
+                    LOGGER.error("[CLVM Migration] Exception while setting volume [{}] to {} state: {}",
+                            volumePath, state.getDescription(), e.getMessage(), e);
+                }
+            }
+        }
+    }
+
+    private static void modifyClvmVolumeState(String volumePath, String lvchangeFlag,
+                                       String stateDescription, String logMessage) {
+        try {
+            LOGGER.info("{} for volume [{}]", logMessage, volumePath);
+
+            Script cmd = new Script("lvchange", Duration.standardSeconds(300), LOGGER);
+            cmd.add(lvchangeFlag);
+            cmd.add(volumePath);
+
+            String result = cmd.execute();
+            if (result != null) {
+                String errorMsg = String.format(
+                        "Failed to set volume [%s] to %s state. Command result: %s",
+                        volumePath, stateDescription, result);
+                LOGGER.error(errorMsg);
+                throw new CloudRuntimeException(errorMsg);
+            } else {
+                LOGGER.info("Successfully set volume [{}] to {} state.",
+                        volumePath, stateDescription);
+            }
+        } catch (CloudRuntimeException e) {
+            throw e;
+        } catch (Exception e) {
+            String errorMsg = String.format(
+                    "Exception while setting volume [%s] to %s state: %s",
+                    volumePath, stateDescription, e.getMessage());
+            LOGGER.error(errorMsg, e);
+            throw new CloudRuntimeException(errorMsg, e);
+        }
+    }
+
+    public static void activateClvmVolumeExclusive(String volumePath) {
+        modifyClvmVolumeState(volumePath, ClvmVolumeState.EXCLUSIVE.getLvchangeFlag(),
+                ClvmVolumeState.EXCLUSIVE.getDescription(),
+                "Activating CLVM volume in exclusive mode");
+    }
+
+    public static void deactivateClvmVolume(String volumePath) {
+        try {
+            modifyClvmVolumeState(volumePath, ClvmVolumeState.DEACTIVATE.getLvchangeFlag(),
+                    ClvmVolumeState.DEACTIVATE.getDescription(),
+                    "Deactivating CLVM volume");
+        } catch (Exception e) {
+            LOGGER.warn("Failed to deactivate CLVM volume {}: {}", volumePath, e.getMessage());
+        }
+    }
+
+    public static void setClvmVolumeToSharedMode(String volumePath) {
+        try {
+            modifyClvmVolumeState(volumePath, ClvmVolumeState.SHARED.getLvchangeFlag(),
+                    ClvmVolumeState.SHARED.getDescription(),
+                    "Setting CLVM volume to shared mode");
+        } catch (Exception e) {
+            LOGGER.warn("Failed to set CLVM volume {} to shared mode: {}", volumePath, e.getMessage());
+        }
+    }
+
+    /**
+     * Determines if a disk is on a CLVM storage pool by checking the actual pool type from VirtualMachineTO.
+     * This is the most reliable method as it uses CloudStack's own storage pool information.
+     *
+     * @param disk The disk definition to check
+     * @param resource The LibvirtComputingResource instance (unused but kept for compatibility)
+     * @param vmSpec The VirtualMachineTO specification containing disk and pool information
+     * @return true if the disk is on a CLVM storage pool, false otherwise
+     */
+    private static boolean isClvmVolume(DiskDef disk, VirtualMachineTO vmSpec) {
+        String diskPath = disk.getDiskPath();
+        if (diskPath == null || vmSpec == null) {
+            return false;
+        }
+
+        try {
+            if (vmSpec.getDisks() != null) {
+                for (DiskTO diskTO : vmSpec.getDisks()) {
+                    if (!(diskTO.getData() instanceof VolumeObjectTO)) {
+                        continue;
+                    }
+                    VolumeObjectTO volumeTO = (VolumeObjectTO) diskTO.getData();
+                    if (!diskPath.equals(volumeTO.getPath()) && !diskPath.equals(diskTO.getPath())) {
+                        continue;
+                    }
+                    DataStoreTO dataStore = volumeTO.getDataStore();
+                    if (!(dataStore instanceof PrimaryDataStoreTO)) {
+                        continue;
+                    }
+                    PrimaryDataStoreTO primaryStore = (PrimaryDataStoreTO) dataStore;
+                    boolean isClvm = StoragePoolType.CLVM == primaryStore.getPoolType() ||
+                                     StoragePoolType.CLVM_NG == primaryStore.getPoolType();
+                    LOGGER.debug("Disk {} identified as CLVM/CLVM_NG={} via VirtualMachineTO pool type: {}",
+                                diskPath, isClvm, primaryStore.getPoolType());
+                    return isClvm;
+                }
+            }
+
+            if (diskPath.startsWith("/dev/") && !diskPath.contains("/dev/mapper/")) {
+                String vgName = extractVolumeGroupFromPath(diskPath);
+                if (vgName != null) {
+                    boolean isClustered = checkIfVolumeGroupIsClustered(vgName);
+                    LOGGER.debug("Disk {} VG {} identified as clustered={} via vgs attribute check",
+                                diskPath, vgName, isClustered);
+                    return isClustered;
+                }
+            }
+
+        } catch (Exception e) {
+            LOGGER.error("Error determining if volume {} is CLVM: {}", diskPath, e.getMessage(), e);
+        }
+
+        return false;
+    }
+
+    /**
+     * Extracts the volume group name from a device path.
+     *
+     * @param devicePath The device path (e.g., /dev/vgname/lvname)
+     * @return The volume group name, or null if cannot be determined
+     */
+     static String extractVolumeGroupFromPath(String devicePath) {
+        if (devicePath == null || !devicePath.startsWith("/dev/")) {
+            return null;
+        }
+
+        // Format: /dev/<vgname>/<lvname>
+        String[] parts = devicePath.split("/");
+        if (parts.length >= 3) {
+            return parts[2]; // ["", "dev", "vgname", ...]
+        }
+
+        return null;
+    }
+
+    /**
+     * Checks if a volume group is clustered (CLVM) by examining its attributes.
+     * Uses 'vgs' command to check for the clustered/shared flag in VG attributes.
+     *
+     * VG Attr format (6 characters): wz--nc or wz--ns
+     *   Position 6: Clustered flag - 'c' = CLVM (clustered), 's' = shared (lvmlockd), '-' = not clustered
+     *
+     * @param vgName The volume group name
+     * @return true if the VG is clustered or shared, false otherwise
+     */
+     static boolean checkIfVolumeGroupIsClustered(String vgName) {
+        if (vgName == null) {
+            return false;
+        }
+
+        try {
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            Script vgsCmd = new Script("vgs", 30000, LOGGER);
+            vgsCmd.add("--noheadings");
+            vgsCmd.add("--unbuffered");
+            vgsCmd.add("-o");
+            vgsCmd.add("vg_attr");
+            vgsCmd.add(vgName);
+
+            String result = vgsCmd.execute(parser);
+
+            if (result == null && parser.getLines() != null) {
+                String output = parser.getLines();
+                if (output != null && !output.isEmpty()) {
+                    String vgAttr = output.trim();
+                    if (vgAttr.length() >= 6) {
+                        char clusterFlag = vgAttr.charAt(5);  // Position 6 (0-indexed 5)
+                        boolean isClustered = (clusterFlag == 'c' || clusterFlag == 's');
+                        LOGGER.debug("VG {} has attributes '{}', cluster/shared flag '{}' = {}",
+                                    vgName, vgAttr, clusterFlag, isClustered);
+                        return isClustered;
+                    } else {
+                        LOGGER.warn("VG {} attributes '{}' have unexpected format (expected 6+ chars)", vgName, vgAttr);
+                    }
+                }
+            } else {
+                LOGGER.warn("Failed to get VG attributes for {}: {}", vgName, result);
+            }
+
+        } catch (Exception e) {
+            LOGGER.debug("Error checking if VG {} is clustered: {}", vgName, e.getMessage());
+        }
+
+        return false;
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapper.java
new file mode 100644
index 000000000000..18c4324addf5
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapper.java
@@ -0,0 +1,173 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferAnswer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+import com.cloud.utils.script.OutputInterpreter;
+
+@ResourceWrapper(handles = ClvmLockTransferCommand.class)
+public class LibvirtClvmLockTransferCommandWrapper
+        extends CommandWrapper<ClvmLockTransferCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(ClvmLockTransferCommand cmd, LibvirtComputingResource serverResource) {
+        String lvPath = cmd.getLvPath();
+        ClvmLockTransferCommand.Operation operation = cmd.getOperation();
+        String volumeUuid = cmd.getVolumeUuid();
+
+        logger.info("Executing CLVM lock transfer: operation={}, lv={}, volume={}",
+                operation, lvPath, volumeUuid);
+
+        try {
+
+            if (operation == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE) {
+                return handleQueryLockState(cmd, lvPath, volumeUuid);
+            }
+
+            String lvchangeOpt;
+            String operationDesc;
+            switch (operation) {
+                case DEACTIVATE:
+                    lvchangeOpt = "-an";
+                    operationDesc = "deactivated";
+                    break;
+                case ACTIVATE_EXCLUSIVE:
+                    lvchangeOpt = "-aey";
+                    operationDesc = "activated exclusively";
+                    break;
+                case ACTIVATE_SHARED:
+                    lvchangeOpt = "-asy";
+                    operationDesc = "activated in shared mode";
+                    break;
+                default:
+                    return new ClvmLockTransferAnswer(cmd, false, "Unknown operation: " + operation);
+            }
+
+            Script script = new Script("/usr/sbin/lvchange", 60000, logger);
+            script.add(lvchangeOpt);
+            script.add(lvPath);
+
+            String result = script.execute();
+
+            if (result != null) {
+                logger.error("CLVM lock transfer failed for volume {}: {}",
+                        volumeUuid, result);
+                return new ClvmLockTransferAnswer(cmd, false,
+                    String.format("lvchange %s %s failed: %s", lvchangeOpt, lvPath, result));
+            }
+
+            logger.info("Successfully executed CLVM lock transfer: {} {} for volume {}",
+                    lvchangeOpt, lvPath, volumeUuid);
+
+            return new ClvmLockTransferAnswer(cmd, true,
+                String.format("Successfully %s CLVM volume %s", operationDesc, volumeUuid));
+
+        } catch (Exception e) {
+            logger.error("Exception during CLVM lock transfer for volume {}: {}",
+                    volumeUuid, e.getMessage(), e);
+            return new ClvmLockTransferAnswer(cmd, false, "Exception: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Query whether this host currently has the CLVM LV activated locally.
+     * Executes: lvs -o lv_attr,lv_host,lv_active --noheadings <lvPath>
+     *
+     * lv_attr[4]=='a' (isActive) is LOCAL and is the authoritative signal — true only on
+     * the host where the LV is currently activated. The management server fans out this
+     * query to all cluster hosts; the one returning isActive=true is the lock holder.
+     * lv_attr[5]=='o' (isOpen) means a VM has the device open on this host (doing I/O).
+     * lv_host is retained for diagnostic logging only — do NOT use it to identify the
+     * lock holder.
+     */
+    private Answer handleQueryLockState(ClvmLockTransferCommand cmd, String lvPath, String volumeUuid) {
+        try {
+            Script script = new Script("/usr/sbin/lvs", 30000, logger);
+            script.add("-o");
+            script.add("lv_attr,lv_host");
+            script.add("--noheadings");
+            script.add(lvPath);
+
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            String result = script.execute(parser);
+
+            if (result != null) {
+                logger.error("Failed to query lock state for volume {}: {}", volumeUuid, result);
+                return new ClvmLockTransferAnswer(cmd, false,
+                    String.format("lvs command failed: %s", result));
+            }
+
+            String[] lines = parser.getLines().split("\n");
+            String dataLine = null;
+
+            for (String line : lines) {
+                String trimmed = line.trim();
+                if (!trimmed.isEmpty() &&
+                    trimmed.length() >= 10 &&
+                    "-wrsvmpco".indexOf(trimmed.charAt(0)) >= 0) {
+                    dataLine = trimmed;
+                    break;
+                }
+            }
+
+            if (dataLine == null) {
+                String allOutput = parser.getLines();
+                logger.warn("Could not find lv_attr data line in lvs output for volume {}: {}",
+                          volumeUuid, allOutput);
+                return new ClvmLockTransferAnswer(cmd, false,
+                    String.format("Could not parse lvs output. Full output: %s", allOutput));
+            }
+
+            logger.debug("Parsed lv_attr data line for volume {}: {}", volumeUuid, dataLine);
+
+            String[] parts = dataLine.split("\\s+");
+            if (parts.length < 1) {
+                return new ClvmLockTransferAnswer(cmd, false, "Invalid lvs output format");
+            }
+
+            String lvAttr = parts[0];
+            // lv_host: for diagnostics only, unreliable for lock-holder identification
+            String hostname = parts.length > 1 ? parts[1] : null;
+
+            // lv_attr[4]=='a' → LV is active on THIS host (local activation state)
+            boolean isActive = lvAttr.length() > 4 && lvAttr.charAt(4) == 'a';
+            // lv_attr[5]=='o' → a process has the device file open on this host (VM doing I/O)
+            boolean isOpen   = lvAttr.length() > 5 && lvAttr.charAt(5) == 'o';
+
+            logger.info("Queried lock state for volume {}: attr={}, hostname={}, active={}, open={}",
+                    volumeUuid, lvAttr, hostname, isActive, isOpen);
+
+            return new ClvmLockTransferAnswer(cmd, true,
+                    String.format("Lock state: active=%s, open=%s, host=%s",
+                            isActive, isOpen, hostname != null ? hostname : "none"),
+                    hostname, isActive, isOpen, lvAttr);
+
+        } catch (Exception e) {
+            logger.error("Exception during lock state query for volume {}: {}",
+                    volumeUuid, e.getMessage(), e);
+            return new ClvmLockTransferAnswer(cmd, false, "Exception: " + e.getMessage());
+        }
+    }
+
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java
new file mode 100644
index 000000000000..7cf05da9b211
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java
@@ -0,0 +1,178 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.CreateImageTransferAnswer;
+import org.apache.cloudstack.backup.CreateImageTransferCommand;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.storage.resource.IpTablesHelper;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = CreateImageTransferCommand.class)
+public class LibvirtCreateImageTransferCommandWrapper extends CommandWrapper<CreateImageTransferCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private static final String IMAGE_SERVER_TLS_CERT_FILE = "/etc/cloudstack/agent/cloud.crt";
+    private static final String IMAGE_SERVER_TLS_KEY_FILE = "/etc/cloudstack/agent/cloud.key";
+
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    private static String shellQuote(String value) {
+        return "'" + value.replace("'", "'\\''") + "'";
+    }
+
+    private boolean startImageServerIfNotRunning(int imageServerPort, String listenAddress, LibvirtComputingResource resource) {
+        final String imageServerPackageDir = resource.getImageServerPath();
+        final String imageServerParentDir = new File(imageServerPackageDir).getParent();
+        final String imageServerModuleName = new File(imageServerPackageDir).getName();
+        final boolean tlsEnabled = resource.isImageServerTlsEnabled();
+        String unitName = resource.IMAGE_SERVER_SYSTEMD_UNIT_NAME;
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult == null && ImageServerControlSocket.isReady()) {
+            return true;
+        }
+
+        resetService(unitName);
+        if (checkResult != null) {
+            StringBuilder systemdRunCmd = new StringBuilder(String.format(
+                    "systemd-run --unit=%s --property=Restart=no --property=WorkingDirectory=%s /usr/bin/python3 -m %s --listen %s --port %d",
+                    unitName, shellQuote(imageServerParentDir), imageServerModuleName, shellQuote(listenAddress), imageServerPort));
+
+            if (tlsEnabled) {
+                systemdRunCmd.append(" --tls-enabled");
+                systemdRunCmd.append(" --tls-cert-file ").append(IMAGE_SERVER_TLS_CERT_FILE);
+                systemdRunCmd.append(" --tls-key-file ").append(IMAGE_SERVER_TLS_KEY_FILE);
+            }
+
+            Script startScript = new Script("/bin/bash", logger);
+            startScript.add("-c");
+            startScript.add(systemdRunCmd.toString());
+            String startResult = startScript.execute();
+
+            if (startResult != null) {
+                logger.error(String.format("Failed to start the Image server: %s", startResult));
+                return false;
+            }
+        }
+
+        int maxWaitSeconds = 10;
+        int pollIntervalMs = 1000;
+        int maxAttempts = (maxWaitSeconds * 1000) / pollIntervalMs;
+        boolean serverReady = false;
+
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            if (ImageServerControlSocket.isReady()) {
+                serverReady = true;
+                logger.info(String.format("Image server control socket is ready (attempt %d)", attempt + 1));
+                break;
+            }
+            try {
+                Thread.sleep(pollIntervalMs);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                return false;
+            }
+        }
+
+        if (!serverReady) {
+            logger.error(String.format("Image server control socket not ready within %d seconds", maxWaitSeconds));
+            return false;
+        }
+
+        String rule = String.format("-p tcp -m state --state NEW -m tcp --dport %d -j ACCEPT", imageServerPort);
+        IpTablesHelper.addConditionally(IpTablesHelper.INPUT_CHAIN, true, rule,
+                String.format("Error in opening up image server port %d", imageServerPort));
+
+        return true;
+    }
+
+    public Answer execute(CreateImageTransferCommand cmd, LibvirtComputingResource resource) {
+        final String transferId = cmd.getTransferId();
+        ImageTransfer.Backend backend = cmd.getBackend();
+
+        if (StringUtils.isBlank(transferId)) {
+            return new CreateImageTransferAnswer(cmd, false, "transferId is empty.");
+        }
+
+        final Map<String, Object> payload = new HashMap<>();
+        payload.put("backend", backend.toString());
+        payload.put("idle_timeout_seconds", cmd.getIdleTimeoutSeconds());
+
+        if (backend == ImageTransfer.Backend.file) {
+            final String filePath = cmd.getFile();
+            if (StringUtils.isBlank(filePath)) {
+                return new CreateImageTransferAnswer(cmd, false, "file path is empty for file backend.");
+            }
+            payload.put("file", filePath);
+        } else {
+            String socket = cmd.getSocket();
+            final String exportName = cmd.getExportName();
+            if (StringUtils.isBlank(socket)) {
+                return new CreateImageTransferAnswer(cmd, false, "Empty socket.");
+            }
+            if (StringUtils.isBlank(exportName)) {
+                return new CreateImageTransferAnswer(cmd, false, "exportName is empty.");
+            }
+            payload.put("socket", "/tmp/imagetransfer/" + socket + ".sock");
+            payload.put("export", exportName);
+            String checkpointId = cmd.getCheckpointId();
+            if (checkpointId != null) {
+                payload.put("export_bitmap", cmd.getCheckpointId());
+            }
+        }
+
+        final int imageServerPort = LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT;
+        String listenAddress = resource.getImageServerListenAddress();
+        if (StringUtils.isBlank(listenAddress)) {
+            listenAddress = resource.getPrivateIp();
+        }
+        if (!startImageServerIfNotRunning(imageServerPort, listenAddress, resource)) {
+            return new CreateImageTransferAnswer(cmd, false, "Failed to start image server.");
+        }
+
+        if (!ImageServerControlSocket.registerTransfer(transferId, payload)) {
+            return new CreateImageTransferAnswer(cmd, false, "Failed to register transfer with image server.");
+        }
+
+        final String transferScheme = resource.isImageServerTlsEnabled() ? "https" : "http";
+        final String transferUrl = String.format("%s://%s:%d/images/%s", transferScheme, listenAddress, imageServerPort, transferId);
+        return new CreateImageTransferAnswer(cmd, true, "Image transfer prepared on KVM host.", transferId, transferUrl);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java
new file mode 100644
index 000000000000..ddb84ab29cb3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java
@@ -0,0 +1,79 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Map;
+
+import org.apache.cloudstack.backup.DeleteVmCheckpointCommand;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = DeleteVmCheckpointCommand.class)
+public class LibvirtDeleteVmCheckpointCommandWrapper extends CommandWrapper<DeleteVmCheckpointCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(DeleteVmCheckpointCommand cmd, LibvirtComputingResource resource) {
+        if (cmd.isStoppedVM()) {
+            return deleteBitmapsOnDisks(cmd);
+        }
+        return deleteDomainCheckpoint(cmd);
+    }
+
+    private Answer deleteDomainCheckpoint(DeleteVmCheckpointCommand cmd) {
+        String vmName = cmd.getVmName();
+        String checkpointId = cmd.getCheckpointId();
+        String virshCmd = String.format("virsh checkpoint-delete %s %s", vmName, checkpointId);
+        Script script = new Script("/bin/bash");
+        script.add("-c");
+        script.add(virshCmd);
+        String result = script.execute();
+        if (result != null) {
+            return new Answer(cmd, false, "Failed to delete checkpoint: " + result);
+        }
+        return new Answer(cmd, true, "Checkpoint deleted");
+    }
+
+    /**
+     * Stopped VM: persistent bitmaps on disk images ({@code qemu-img bitmap --remove}), matching {@link LibvirtStartBackupCommandWrapper} bitmap --add.
+     */
+    private Answer deleteBitmapsOnDisks(DeleteVmCheckpointCommand cmd) {
+        String checkpointId = cmd.getCheckpointId();
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        if (diskPathUuidMap == null || diskPathUuidMap.isEmpty()) {
+            return new Answer(cmd, false, "No disks provided for bitmap removal");
+        }
+        for (Map.Entry<String, String> entry : diskPathUuidMap.entrySet()) {
+            String diskPath = entry.getKey();
+            Script script = new Script("qemu-img");
+            script.add("bitmap");
+            script.add("--remove");
+            script.add(diskPath);
+            script.add(checkpointId);
+            String result = script.execute();
+            if (result != null) {
+                return new Answer(cmd, false,
+                        "Failed to remove bitmap " + checkpointId + " from disk " + diskPath + ": " + result);
+            }
+        }
+        return new Answer(cmd, true, "Checkpoint bitmap removed from disks");
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java
new file mode 100644
index 000000000000..3d9f6563d5eb
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java
@@ -0,0 +1,101 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.FinalizeImageTransferCommand;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = FinalizeImageTransferCommand.class)
+public class LibvirtFinalizeImageTransferCommandWrapper extends CommandWrapper<FinalizeImageTransferCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    private boolean stopImageServer(int imageServerPort, LibvirtComputingResource resource) {
+        String unitName = resource.IMAGE_SERVER_SYSTEMD_UNIT_NAME;
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult != null) {
+            logger.info("Image server not running, resetting failed state");
+            resetService(unitName);
+            removeFirewallRule(imageServerPort);
+            return true;
+        }
+
+        Script stopScript = new Script("/bin/bash", logger);
+        stopScript.add("-c");
+        stopScript.add(String.format("systemctl stop %s", unitName));
+        stopScript.execute();
+        resetService(unitName);
+        logger.info("Image server {} stopped", unitName);
+
+        removeFirewallRule(imageServerPort);
+
+        return true;
+    }
+
+    private void removeFirewallRule(int port) {
+        String rule = String.format("-p tcp -m state --state NEW -m tcp --dport %d -j ACCEPT", port);
+        Script removeScript = new Script("/bin/bash", logger);
+        removeScript.add("-c");
+        removeScript.add(String.format("iptables -D INPUT %s || true", rule));
+        String result = removeScript.execute();
+        if (result != null && !result.isEmpty() && !result.contains("iptables: Bad rule")) {
+            logger.debug("Firewall rule removal result for port {}: {}", port, result);
+        } else {
+            logger.info("Firewall rule removed for port {} (or did not exist)", port);
+        }
+    }
+
+    public Answer execute(FinalizeImageTransferCommand cmd, LibvirtComputingResource resource) {
+        final String transferId = cmd.getTransferId();
+        final int imageServerPort = LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT;
+        if (StringUtils.isBlank(transferId)) {
+            return new Answer(cmd, false, "transferId is empty.");
+        }
+
+        int activeTransfers = ImageServerControlSocket.unregisterTransfer(transferId);
+        if (activeTransfers < 0) {
+            logger.warn("Could not reach image server to unregister transfer {}; assuming server is down", transferId);
+            stopImageServer(imageServerPort, resource);
+            return new Answer(cmd, true, "Image transfer finalized (server unreachable, forced stop).");
+        }
+
+        if (activeTransfers == 0) {
+            stopImageServer(imageServerPort, resource);
+        }
+
+        return new Answer(cmd, true, "Image transfer finalized.");
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java
index f54918bbc228..ed02ae6da38d 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java
@@ -1,5 +1,3 @@
-//
-// Licensed to the Apache Software Foundation (ASF) under one
 // or more contributor license agreements.  See the NOTICE file
 // distributed with this work for additional information
 // regarding copyright ownership.  The ASF licenses this file
@@ -42,9 +40,16 @@
 import javax.xml.transform.TransformerException;
 
 import com.cloud.agent.api.VgpuTypesInfo;
+import com.cloud.agent.api.to.DataTO;
 import com.cloud.agent.api.to.GPUDeviceTO;
 import com.cloud.hypervisor.kvm.resource.LibvirtGpuDef;
 import com.cloud.hypervisor.kvm.resource.LibvirtXMLParser;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.utils.security.ParserUtils;
 import org.apache.commons.collections.MapUtils;
 import org.apache.commons.collections4.CollectionUtils;
@@ -69,7 +74,6 @@
 import com.cloud.agent.api.MigrateAnswer;
 import com.cloud.agent.api.MigrateCommand;
 import com.cloud.agent.api.MigrateCommand.MigrateDiskInfo;
-import com.cloud.agent.api.to.DataTO;
 import com.cloud.agent.api.to.DiskTO;
 import com.cloud.agent.api.to.DpdkTO;
 import com.cloud.agent.api.to.VirtualMachineTO;
@@ -82,11 +86,6 @@
 import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.InterfaceDef;
 import com.cloud.hypervisor.kvm.resource.MigrateKVMAsync;
 import com.cloud.hypervisor.kvm.resource.VifDriver;
-import com.cloud.resource.CommandWrapper;
-import com.cloud.resource.ResourceWrapper;
-import com.cloud.utils.Ternary;
-import com.cloud.utils.exception.CloudRuntimeException;
-import com.cloud.vm.VirtualMachine;
 
 @ResourceWrapper(handles =  MigrateCommand.class)
 public final class LibvirtMigrateCommandWrapper extends CommandWrapper<MigrateCommand, Answer, LibvirtComputingResource> {
@@ -117,7 +116,8 @@ public Answer execute(final MigrateCommand command, final LibvirtComputingResour
         Command.State commandState = null;
 
         List<InterfaceDef> ifaces = null;
-        List<DiskDef> disks;
+        List<DiskDef> disks = new ArrayList<>();
+        VirtualMachineTO to = null;
 
         Domain dm = null;
         Connect dconn = null;
@@ -136,7 +136,7 @@ public Answer execute(final MigrateCommand command, final LibvirtComputingResour
             if (logger.isDebugEnabled()) {
                 logger.debug(String.format("Found domain with name [%s]. Starting VM migration to host [%s].", vmName, destinationUri));
             }
-            VirtualMachineTO to = command.getVirtualMachine();
+            to = command.getVirtualMachine();
 
             dm = conn.domainLookupByName(vmName);
             /*
@@ -338,6 +338,14 @@ Use VIR_DOMAIN_XML_SECURE (value = 1) prior to v1.0.0.
                     logger.debug(String.format("Cleaning the disks of VM [%s] in the source pool after VM migration finished.", vmName));
                 }
                 resumeDomainIfPaused(destDomain, vmName);
+
+                // For cross-pool CLVM migration, skip deactivation so the source LV stays
+                // active (in shared mode) and deletion can route directly to the source host
+                // without fanning out across the cluster to find an inactive LV.
+                if (to != null && !command.isClvmCrossPoolMigration()) {
+                    LibvirtComputingResource.modifyClvmVolumesStateForMigration(disks, to, LibvirtComputingResource.ClvmVolumeState.DEACTIVATE);
+                }
+
                 deleteOrDisconnectDisksOnSourcePool(libvirtComputingResource, migrateDiskInfoList, disks);
                 libvirtComputingResource.cleanOldSecretsByDiskDef(conn, disks);
             }
@@ -384,6 +392,10 @@ Use VIR_DOMAIN_XML_SECURE (value = 1) prior to v1.0.0.
                 if (destDomain != null) {
                     destDomain.free();
                 }
+                // Revert CLVM volumes to exclusive mode on failure
+                if (to != null && result != null) {
+                    LibvirtComputingResource.modifyClvmVolumesStateForMigration(disks, to, LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE);
+                }
             } catch (final LibvirtException e) {
                 logger.trace("Ignoring libvirt error.", e);
             }
@@ -683,7 +695,7 @@ protected String replaceDpdkInterfaces(String xmlDesc, Map<String, DpdkTO> dpdkP
     protected void deleteOrDisconnectDisksOnSourcePool(final LibvirtComputingResource libvirtComputingResource, final List<MigrateDiskInfo> migrateDiskInfoList,
             List<DiskDef> disks) {
         for (DiskDef disk : disks) {
-            MigrateDiskInfo migrateDiskInfo = searchDiskDefOnMigrateDiskInfoList(migrateDiskInfoList, disk);
+            MigrateCommand.MigrateDiskInfo migrateDiskInfo = searchDiskDefOnMigrateDiskInfoList(migrateDiskInfoList, disk);
             if (migrateDiskInfo != null && migrateDiskInfo.isSourceDiskOnStorageFileSystem()) {
                 deleteLocalVolume(disk.getDiskPath());
             } else {
@@ -800,7 +812,10 @@ protected String replaceStorage(String xmlDesc, Map<String, MigrateCommand.Migra
                             for (int z = 0; z < diskChildNodes.getLength(); z++) {
                                 Node diskChildNode = diskChildNodes.item(z);
 
-                                if (migrateStorageManaged && "driver".equals(diskChildNode.getNodeName())) {
+                                boolean shouldUpdateDriverType = shouldUpdateDriverTypeForMigration(
+                                    migrateStorageManaged, migrateDiskInfo);
+
+                                if (shouldUpdateDriverType && "driver".equals(diskChildNode.getNodeName())) {
                                     Node driverNode = diskChildNode;
 
                                     NamedNodeMap driverNodeAttributes = driverNode.getAttributes();
@@ -1066,4 +1081,64 @@ public static String maskSensitiveInfoInXML(String xmlDesc) {
         return xmlDesc.replaceAll("(graphics\\s+[^>]*type=['\"]vnc['\"][^>]*passwd=['\"])([^'\"]*)(['\"])",
                 "$1*****$3");
     }
+
+    /**
+     * Checks if any of the destination disks in the migration target a CLVM or CLVM_NG storage pool.
+     * This is used to determine if incremental migration should be disabled to avoid libvirt
+     * precreate errors with QCOW2-on-LVM setups.
+     *
+     * @param mapMigrateStorage the map containing migration disk information with destination pool types
+     * @return true if any destination disk targets CLVM or CLVM_NG, false otherwise
+     */
+    protected boolean hasClvmDestinationDisks(Map<String, MigrateCommand.MigrateDiskInfo> mapMigrateStorage) {
+        if (MapUtils.isEmpty(mapMigrateStorage)) {
+            return false;
+        }
+
+        try {
+            for (Map.Entry<String, MigrateCommand.MigrateDiskInfo> entry : mapMigrateStorage.entrySet()) {
+                MigrateCommand.MigrateDiskInfo diskInfo = entry.getValue();
+               if (isClvmBlockDevice(diskInfo)) {
+                    logger.debug("Found disk targeting CLVM/CLVM_NG destination pool");
+                    return true;
+               }
+            }
+        } catch (final Exception e) {
+            logger.debug("Failed to check for CLVM destination disks: {}. Assuming no CLVM disks.", e.getMessage());
+        }
+
+        return false;
+    }
+
+    private boolean isClvmBlockDevice(MigrateCommand.MigrateDiskInfo diskInfo) {
+        if (diskInfo == null ||diskInfo.getDestPoolType() == null) {
+            return false;
+        }
+        return (Storage.StoragePoolType.CLVM.equals(diskInfo.getDestPoolType()) || Storage.StoragePoolType.CLVM_NG.equals(diskInfo.getDestPoolType()));
+    }
+
+    /**
+     * Determines if the driver type should be updated during migration based on CLVM involvement.
+     * The driver type needs to be updated when:
+     * - Managed storage is being migrated, OR
+     * - Source pool is CLVM or CLVM_NG, OR
+     * - Destination pool is CLVM or CLVM_NG
+     *
+     * This ensures the libvirt XML driver type matches the destination format (raw/qcow2/etc).
+     *
+     * @param migrateStorageManaged true if migrating managed storage
+     * @param migrateDiskInfo the migration disk information containing source and destination pool types
+     * @return true if driver type should be updated, false otherwise
+     */
+    private boolean shouldUpdateDriverTypeForMigration(boolean migrateStorageManaged,
+                                                        MigrateCommand.MigrateDiskInfo migrateDiskInfo) {
+        boolean sourceIsClvm = Storage.StoragePoolType.CLVM == migrateDiskInfo.getSourcePoolType() ||
+                Storage.StoragePoolType.CLVM_NG == migrateDiskInfo.getSourcePoolType();
+
+        boolean destIsClvm = Storage.StoragePoolType.CLVM == migrateDiskInfo.getDestPoolType() ||
+                Storage.StoragePoolType.CLVM_NG == migrateDiskInfo.getDestPoolType();
+
+        boolean isClvmRelatedMigration = sourceIsClvm || destIsClvm;
+        return migrateStorageManaged || isClvmRelatedMigration;
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapper.java
index 990cefda8f33..bc22d7bfd70a 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapper.java
@@ -52,9 +52,19 @@ public Answer execute(final ModifyStoragePoolCommand command, final LibvirtCompu
 
         final KVMStoragePool storagepool;
         try {
+            Map<String, String> poolDetails = command.getDetails();
+            if (poolDetails == null) {
+                poolDetails = new HashMap<>();
+            }
+
+            // Ensure CLVM secure zero-fill setting has a default value if not provided by MS
+            if (!poolDetails.containsKey(KVMStoragePool.CLVM_SECURE_ZERO_FILL)) {
+                poolDetails.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+            }
+
             storagepool =
                     storagePoolMgr.createStoragePool(command.getPool().getUuid(), command.getPool().getHost(), command.getPool().getPort(), command.getPool().getPath(), command.getPool()
-                            .getUserInfo(), command.getPool().getType(), command.getDetails());
+                            .getUserInfo(), command.getPool().getType(), poolDetails);
             if (storagepool == null) {
                 return new Answer(command, false, " Failed to create storage pool");
             }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapper.java
new file mode 100644
index 000000000000..608770974dc1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapper.java
@@ -0,0 +1,82 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.List;
+
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.libvirt.Connect;
+import org.libvirt.LibvirtException;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.PostMigrationAnswer;
+import com.cloud.agent.api.PostMigrationCommand;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.DiskDef;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+
+/**
+ * Wrapper for PostMigrationCommand on KVM hypervisor.
+ * Handles post-migration tasks on the destination host after a VM has been successfully migrated.
+ * Primary responsibility: Convert CLVM volumes from shared mode to exclusive mode on destination.
+ */
+@ResourceWrapper(handles = PostMigrationCommand.class)
+public final class LibvirtPostMigrationCommandWrapper extends CommandWrapper<PostMigrationCommand, Answer, LibvirtComputingResource> {
+
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(final PostMigrationCommand command, final LibvirtComputingResource libvirtComputingResource) {
+        final VirtualMachineTO vm = command.getVirtualMachine();
+        final String vmName = command.getVmName();
+
+        if (vm == null || vmName == null) {
+            return new PostMigrationAnswer(command, "VM or VM name is null");
+        }
+
+        logger.debug("Executing post-migration tasks for VM {} on destination host", vmName);
+
+        try {
+            final Connect conn = LibvirtConnection.getConnectionByVmName(vmName);
+
+            List<DiskDef> disks = libvirtComputingResource.getDisks(conn, vmName);
+            logger.debug("[CLVM Post-Migration] Processing volumes for VM {} to claim exclusive locks on any CLVM volumes", vmName);
+            LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                disks,
+                vm,
+                LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE
+            );
+
+            logger.debug("Successfully completed post-migration tasks for VM {}", vmName);
+            return new PostMigrationAnswer(command);
+
+        } catch (final LibvirtException e) {
+            logger.error("Libvirt error during post-migration for VM {}: {}", vmName, e.getMessage(), e);
+            return new PostMigrationAnswer(command, e);
+        } catch (final Exception e) {
+            logger.error("Error during post-migration for VM {}: {}", vmName, e.getMessage(), e);
+            return new PostMigrationAnswer(command, e);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapper.java
new file mode 100644
index 000000000000..c47760040c88
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapper.java
@@ -0,0 +1,84 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.PreMigrationCommand;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.DiskDef;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+
+import java.util.List;
+
+/**
+ * Handles PreMigrationCommand on the source host before live migration.
+ * Converts CLVM volume locks from exclusive to shared mode so the destination host can access them.
+ */
+@ResourceWrapper(handles = PreMigrationCommand.class)
+public class LibvirtPreMigrationCommandWrapper extends CommandWrapper<PreMigrationCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(PreMigrationCommand command, LibvirtComputingResource libvirtComputingResource) {
+        String vmName = command.getVmName();
+        VirtualMachineTO vmSpec = command.getVirtualMachine();
+
+        logger.info("Preparing source host for migration of VM: {}", vmName);
+
+        Connect conn = null;
+        Domain dm = null;
+
+        try {
+            LibvirtUtilitiesHelper libvirtUtilitiesHelper = libvirtComputingResource.getLibvirtUtilitiesHelper();
+            conn = libvirtUtilitiesHelper.getConnectionByVmName(vmName);
+            dm = conn.domainLookupByName(vmName);
+
+            List<DiskDef> disks = libvirtComputingResource.getDisks(conn, vmName);
+            logger.info("Converting CLVM volumes to shared mode for VM: {}", vmName);
+            LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                disks,
+                vmSpec,
+                LibvirtComputingResource.ClvmVolumeState.SHARED
+            );
+
+            logger.info("Successfully prepared source host for migration of VM: {}", vmName);
+            return new Answer(command, true, "Source host prepared for migration");
+
+        } catch (LibvirtException e) {
+            logger.error("Failed to prepare source host for migration of VM: {}", vmName, e);
+            return new Answer(command, false, "Failed to prepare source host: " + e.getMessage());
+        } finally {
+            if (dm != null) {
+                try {
+                    dm.free();
+                } catch (LibvirtException e) {
+                    logger.warn("Failed to free domain {}: {}", vmName, e.getMessage());
+                }
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareForMigrationCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareForMigrationCommandWrapper.java
index d9323df4477d..f7ca79127dad 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareForMigrationCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareForMigrationCommandWrapper.java
@@ -21,6 +21,7 @@
 
 import java.net.URISyntaxException;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.apache.cloudstack.storage.configdrive.ConfigDrive;
@@ -124,6 +125,19 @@ public Answer execute(final PrepareForMigrationCommand command, final LibvirtCom
                 return new PrepareForMigrationAnswer(command, "failed to connect physical disks to host");
             }
 
+            // Activate CLVM volumes in shared mode on destination host for live migration
+            try {
+                List<LibvirtVMDef.DiskDef> disks = libvirtComputingResource.getDisks(conn, vm.getName());
+                LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    disks,
+                    vm,
+                    LibvirtComputingResource.ClvmVolumeState.SHARED
+                );
+            } catch (Exception e) {
+                logger.warn("Failed to activate CLVM volumes in shared mode on destination for VM {}: {}",
+                    vm.getName(), e.getMessage(), e);
+            }
+
             logger.info("Successfully prepared destination host for migration of VM {}", vm.getName());
             return createPrepareForMigrationAnswer(command, dpdkInterfaceMapping, libvirtComputingResource, vm);
         } catch (final LibvirtException | CloudRuntimeException | InternalErrorException | URISyntaxException e) {
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtResizeVolumeCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtResizeVolumeCommandWrapper.java
index f2af46d4cc8a..a43b584dd6d6 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtResizeVolumeCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtResizeVolumeCommandWrapper.java
@@ -113,7 +113,8 @@ public Answer execute(final ResizeVolumeCommand command, final LibvirtComputingR
             logger.debug("Resizing volume: " + path + ", from: " + toHumanReadableSize(currentSize) + ", to: " + toHumanReadableSize(newSize) + ", type: " + type + ", name: " + vmInstanceName + ", shrinkOk: " + shrinkOk);
 
             /* libvirt doesn't support resizing (C)LVM devices, and corrupts QCOW2 in some scenarios, so we have to do these via qemu-img */
-            if (pool.getType() != StoragePoolType.CLVM && pool.getType() != StoragePoolType.Linstor && pool.getType() != StoragePoolType.PowerFlex
+            if (pool.getType() != StoragePoolType.CLVM && pool.getType() != StoragePoolType.CLVM_NG
+                    && pool.getType() != StoragePoolType.Linstor && pool.getType() != StoragePoolType.PowerFlex
                     && vol.getFormat() != PhysicalDiskFormat.QCOW2) {
                 logger.debug("Volume " + path +  " can be resized by libvirt. Asking libvirt to resize the volume.");
                 try {
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
index 5d76d140f229..16c1a5a2fac1 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
@@ -117,7 +117,7 @@ public Answer execute(final RevertSnapshotCommand command, final LibvirtComputin
                     secondaryStoragePool = storagePoolMgr.getStoragePoolByURI(snapshotImageStore.getUrl());
                 }
 
-                if (primaryPool.getType() == StoragePoolType.CLVM) {
+                if (primaryPool.getType() == StoragePoolType.CLVM || primaryPool.getType() == StoragePoolType.CLVM_NG) {
                     Script cmd = new Script(libvirtComputingResource.manageSnapshotPath(), libvirtComputingResource.getCmdsTimeout(), logger);
                     cmd.add("-v", getFullPathAccordingToStorage(secondaryStoragePool, snapshotRelPath));
                     cmd.add("-n", snapshotDisk.getName());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java
new file mode 100644
index 000000000000..629fd179afb2
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java
@@ -0,0 +1,300 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.StartBackupAnswer;
+import org.apache.cloudstack.backup.StartBackupCommand;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
+import org.apache.cloudstack.utils.qemu.QemuCommand;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.json.JSONArray;
+import org.json.JSONObject;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StartBackupCommand.class)
+public class LibvirtStartBackupCommandWrapper extends CommandWrapper<StartBackupCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(StartBackupCommand cmd, LibvirtComputingResource resource) {
+        if (cmd.isStoppedVM()) {
+            return handleStoppedVmBackup(cmd, cmd.getToCheckpointId());
+        }
+        return handleRunningVmBackup(cmd, resource);
+    }
+
+    public Answer handleRunningVmBackup(StartBackupCommand cmd, LibvirtComputingResource resource) {
+        String vmName = cmd.getVmName();
+        String toCheckpointId = cmd.getToCheckpointId();
+        String fromCheckpointId = cmd.getFromCheckpointId();
+        Long fromCheckpointCreateTime = cmd.getFromCheckpointCreateTime();
+        String socket = cmd.getSocket();
+
+        try {
+            if (StringUtils.isNotBlank(fromCheckpointId)) {
+                Answer redefineAnswer = ensureFromCheckpointExists(cmd, fromCheckpointId, fromCheckpointCreateTime);
+                if (redefineAnswer != null) {
+                    return redefineAnswer;
+                }
+            }
+
+            File dir = new File("/tmp/imagetransfer");
+            if (!dir.exists()) {
+                dir.mkdirs();
+            }
+
+            // Create backup XML
+            String backupXml = createBackupXml(cmd, fromCheckpointId, socket, resource);
+            String checkpointXml = createCheckpointXml(toCheckpointId);
+
+            // Write XMLs to temp files
+            File backupXmlFile = File.createTempFile("backup-", ".xml");
+            File checkpointXmlFile = File.createTempFile("checkpoint-", ".xml");
+
+            try (FileWriter writer = new FileWriter(backupXmlFile)) {
+                writer.write(backupXml);
+            }
+            try (FileWriter writer = new FileWriter(checkpointXmlFile)) {
+                writer.write(checkpointXml);
+            }
+
+            // Execute virsh backup-begin
+            String backupCmd = String.format("virsh backup-begin %s %s --checkpointxml %s",
+                vmName, backupXmlFile.getAbsolutePath(), checkpointXmlFile.getAbsolutePath());
+
+            Script script = new Script("/bin/bash");
+            script.add("-c");
+            script.add(backupCmd);
+            String result = script.execute();
+
+            backupXmlFile.delete();
+            checkpointXmlFile.delete();
+
+            if (result != null) {
+                return new StartBackupAnswer(cmd, false, "Backup begin failed: " + result);
+            }
+
+            long checkpointCreateTime = getCheckpointCreateTime();
+            return new StartBackupAnswer(cmd, true, "Backup started successfully", checkpointCreateTime);
+
+        } catch (Exception e) {
+            return new StartBackupAnswer(cmd, false, "Error starting backup: " + e.getMessage());
+        }
+    }
+
+    private Answer ensureFromCheckpointExists(StartBackupCommand cmd, String fromCheckpointId, Long fromCheckpointCreateTime) {
+        String vmName = cmd.getVmName();
+        Script dumpScript = new Script("/bin/bash");
+        dumpScript.add("-c");
+        dumpScript.add(String.format("virsh checkpoint-dumpxml --domain %s --checkpointname %s --no-domain",
+            vmName, fromCheckpointId));
+        if (dumpScript.execute() == null) {
+            return null;
+        }
+        if (fromCheckpointCreateTime == null) {
+            return new StartBackupAnswer(cmd, false, "From checkpoint create time is null for checkpoint " + fromCheckpointId);
+        }
+
+        String redefineXml = createCheckpointXmlForRedefine(fromCheckpointId, fromCheckpointCreateTime);
+        File redefineFile;
+        try {
+            redefineFile = File.createTempFile("checkpoint-redefine-", ".xml");
+        } catch (Exception e) {
+            return new StartBackupAnswer(cmd, false, "Failed to create temp file for checkpoint redefine: " + e.getMessage());
+        }
+        try (FileWriter writer = new FileWriter(redefineFile)) {
+            writer.write(redefineXml);
+        } catch (Exception e) {
+            redefineFile.delete();
+            return new StartBackupAnswer(cmd, false, "Failed to write checkpoint redefine XML: " + e.getMessage());
+        }
+        String createCmd = String.format(LibvirtComputingResource.CHECKPOINT_CREATE_COMMAND, vmName, redefineFile.getAbsolutePath());
+        Script createScript = new Script("/bin/bash");
+        createScript.add("-c");
+        createScript.add(createCmd);
+        String result = createScript.execute();
+        redefineFile.delete();
+        if (result != null) {
+            return new StartBackupAnswer(cmd, false, "Failed to redefine from-checkpoint " + fromCheckpointId + ": " + result);
+        }
+        return null;
+    }
+
+    private String createCheckpointXmlForRedefine(String checkpointName, Long createTime) {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domaincheckpoint>\n");
+        xml.append("  <name>").append(checkpointName).append("</name>\n");
+        xml.append("  <creationTime>").append(createTime).append("</creationTime>\n");
+        xml.append("</domaincheckpoint>");
+        return xml.toString();
+    }
+
+    private String createBackupXml(StartBackupCommand cmd, String fromCheckpointId, String socket, LibvirtComputingResource resource) throws LibvirtException {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domainbackup mode=\"pull\">\n");
+
+        xml.append(String.format("  <server transport=\"unix\" socket=\"/tmp/imagetransfer/%s.sock\"/>\n", socket));
+
+        xml.append("  <disks>\n");
+
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        Map<String, String> diskPathLabelMap = resource.getDiskPathLabelMap(cmd.getVmName());
+        Map<String, Boolean> diskPathHasFromCheckpointMap = new HashMap<>();
+        if (StringUtils.isNotBlank(fromCheckpointId)) {
+            Domain vm = null;
+            try {
+                vm = resource.getDomain(resource.getLibvirtUtilitiesHelper().getConnection(), cmd.getVmName());
+                if (vm != null) {
+                    diskPathHasFromCheckpointMap = getVmDiskPathHasFromCheckpointMap(vm, fromCheckpointId);
+                } else {
+                    logger.warn("Failed to get domain for VM [{}] while evaluating export bitmap [{}]. Falling back to full Backup",
+                            cmd.getVmName(), fromCheckpointId);
+                }
+            } finally {
+                if (vm != null) {
+                   vm.free();
+                }
+            }
+        }
+
+        for (Map.Entry<String, String> entry : diskPathLabelMap.entrySet()) {
+            String diskPath = entry.getKey();
+            if (!diskPathUuidMap.containsKey(diskPath)) {
+                continue;
+            }
+            String diskName = entry.getValue();
+            String export = diskPathUuidMap.get(diskPath);
+            String scratchFile = "/var/tmp/scratch-" + export + ".qcow2";
+            xml.append("    <disk name=\"").append(diskName).append("\" type=\"file\" exportname=\"").append(export);
+            if (StringUtils.isNotBlank(fromCheckpointId) && Boolean.TRUE.equals(diskPathHasFromCheckpointMap.get(diskPath))) {
+                xml.append("\" backupmode=\"incremental\"")
+                        .append(" incremental=\"").append(fromCheckpointId)
+                        .append("\" exportbitmap=\"").append(fromCheckpointId);
+            }
+            xml.append("\">\n");
+            xml.append("      <scratch file=\"").append(scratchFile).append("\"/>\n");
+            xml.append("    </disk>\n");
+        }
+
+        xml.append("  </disks>\n");
+        xml.append("</domainbackup>");
+
+        return xml.toString();
+    }
+
+    private String createCheckpointXml(String checkpointId) {
+        return "<domaincheckpoint>\n" +
+               "  <name>" + checkpointId + "</name>\n" +
+               "</domaincheckpoint>";
+    }
+
+    private Answer handleStoppedVmBackup(StartBackupCommand cmd, String toCheckpointId) {
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        Map<String, byte[]> diskPathPassphraseMap = cmd.getDiskPathPassphraseMap();
+        for (Map.Entry<String, String> entry : diskPathUuidMap.entrySet()) {
+            String diskPath = entry.getKey();
+            Script script = new Script("qemu-img");
+            byte[] passphrase = diskPathPassphraseMap.get(diskPath);
+
+            script.add("bitmap");
+            script.add("--add");
+
+            if (passphrase != null && passphrase.length > 0) {
+                KeyFile srcKey;
+                try {
+                    srcKey = new KeyFile(passphrase);
+                } catch (IOException ex) {
+                    return new StartBackupAnswer(cmd, false, "Failed to create KeyFile while adding bitmap " + toCheckpointId + " to disk " + diskPath);
+                }
+                script.add("--object");
+                script.add(String.format("secret,id=sec0,file=%s", srcKey));
+                script.add("--image-opts");
+                script.add(String.format("driver=qcow2,file.driver=file,file.filename=%s,encrypt.key-secret=sec0", diskPath));
+            } else {
+                script.add(diskPath);
+            }
+
+            script.add(toCheckpointId);
+            String result = script.execute();
+            if (result != null) {
+                return new StartBackupAnswer(cmd, false,
+                    "Failed to add bitmap " + toCheckpointId + " to disk " + diskPath + ": " + result);
+            }
+        }
+        long checkpointCreateTime = getCheckpointCreateTime();
+        return new StartBackupAnswer(cmd, true, "Stopped VM backup: checkpoint bitmap added successfully",
+            checkpointCreateTime);
+    }
+
+    private long getCheckpointCreateTime() {
+        return System.currentTimeMillis() / 1000;
+    }
+
+    private Map<String, Boolean> getVmDiskPathHasFromCheckpointMap(Domain vm, String fromCheckpointId) throws LibvirtException {
+        Map<String, Boolean> diskPathHasFromCheckpointMap = new HashMap<>();
+        String queryBlock = vm.qemuMonitorCommand(QemuCommand.buildQemuCommand("query-block", null), 0);
+        JSONObject response = new JSONObject(queryBlock);
+        JSONArray blocks = response.optJSONArray("return");
+        if (blocks == null) {
+            logger.warn("Couldn't get bitmap information for the VM [{}]. Falling back to full Backup", vm.getName());
+            return diskPathHasFromCheckpointMap;
+        }
+        for (int i = 0; i < blocks.length(); i++) {
+            JSONObject block = blocks.getJSONObject(i);
+            JSONObject inserted = block.optJSONObject("inserted");
+            if (inserted == null) {
+                continue;
+            }
+            String file = inserted.optString("file");
+            if (StringUtils.isBlank(file)) {
+                continue;
+            }
+            JSONArray dirtyBitmaps = inserted.optJSONArray("dirty-bitmaps");
+            boolean hasFromCheckpointBitmap = false;
+            if (dirtyBitmaps != null) {
+                for (int j = 0; j < dirtyBitmaps.length(); j++) {
+                    JSONObject dirtyBitmap = dirtyBitmaps.optJSONObject(j);
+                    if (dirtyBitmap == null) {
+                        continue;
+                    }
+                    String bitmapName = dirtyBitmap.optString("name");
+                    if (fromCheckpointId.equals(bitmapName)) {
+                        hasFromCheckpointBitmap = true;
+                        break;
+                    }
+                }
+            }
+            diskPathHasFromCheckpointMap.put(file, hasFromCheckpointBitmap);
+        }
+        return diskPathHasFromCheckpointMap;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java
new file mode 100644
index 000000000000..661344677640
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java
@@ -0,0 +1,197 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.apache.cloudstack.backup.StartNBDServerAnswer;
+import org.apache.cloudstack.backup.StartNBDServerCommand;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StartNBDServerCommand.class)
+public class LibvirtStartNBDServerCommandWrapper extends CommandWrapper<StartNBDServerCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private String createSystemdRunCmd(StartNBDServerCommand cmd, String unitName, String volumePath, String exportName, String socket) throws IOException {
+        String socketName = "/tmp/imagetransfer/" + socket + ".sock";
+
+        String bitmapArg = "";
+        if (StringUtils.isNotBlank(cmd.getFromCheckpointId())
+                && isBitmapPresentOnDisk(volumePath, cmd.getFromCheckpointId())) {
+            bitmapArg = "-B " + cmd.getFromCheckpointId();
+        }
+
+        byte[] passphrase = cmd.getPassphrase(); // may be null
+        String readOnlyArg = cmd.getDirection().equals("download") ? "--read-only" : "";
+        String imageArg = volumePath;
+        String secretArg = "";
+        if (passphrase != null && passphrase.length > 0) {
+            KeyFile srcKey = new KeyFile(passphrase);
+            secretArg = String.format("--object secret,id=sec0,file=%s", srcKey);
+            imageArg = String.format("--image-opts driver=qcow2,file.driver=file,file.filename=%s,encrypt.key-secret=sec0", volumePath);
+        }
+
+        // --persistent: Don't stop the service when the last client disconnects.
+        // --shared=NUM: Allow up to NUM clients to share the device (default 1), 0 for unlimited. Number of parallel connections is managed by the image server.
+        String systemdRunCmd = String.format(
+                "systemd-run --unit=%s --property=Restart=no qemu-nbd %s " +
+                        "--export-name %s --socket %s --persistent --shared=0 %s %s %s",
+                unitName,
+                secretArg,
+                exportName,
+                socketName,
+                bitmapArg,
+                readOnlyArg,
+                imageArg
+        );
+        return systemdRunCmd;
+    }
+
+    @Override
+    public Answer execute(StartNBDServerCommand cmd, LibvirtComputingResource resource) {
+        String volumePath = cmd.getVolumePath();
+        String socket = cmd.getSocket();
+        String exportName = cmd.getExportName();
+        String transferId = cmd.getTransferId();
+
+        if (StringUtils.isBlank(volumePath)) {
+            return new StartNBDServerAnswer(cmd, false, "Volume path is required for the nbd server");
+        }
+        if (StringUtils.isBlank(exportName)) {
+            return new StartNBDServerAnswer(cmd, false, "Export name is required for the nbd server");
+        }
+        if (StringUtils.isBlank(socket)) {
+            return new StartNBDServerAnswer(cmd, false, "Socket is required for the nbd server");
+        }
+
+        String unitName = "qemu-nbd-" + transferId.hashCode();
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult == null) {
+            return new StartNBDServerAnswer(cmd, false, "A qemu-nbd service is already running on the port.");
+        }
+
+        File dir = new File("/tmp/imagetransfer");
+        if (!dir.exists()) {
+            dir.mkdirs();
+        }
+
+        String systemdRunCmd = "";
+        try {
+            systemdRunCmd = createSystemdRunCmd(cmd, unitName, volumePath, exportName, socket);
+        } catch (IOException e) {
+            logger.error("Failed to create the KeyFile for qemu-nbd service", e);
+            return new StartNBDServerAnswer(cmd, false, "Failed to create systemd run command for qemu-nbd service: " + e.getMessage());
+        }
+
+        Script startScript = new Script("/bin/bash", logger);
+        startScript.add("-c");
+        startScript.add(systemdRunCmd);
+        String startResult = startScript.execute();
+
+        if (startResult != null) {
+            logger.error(String.format("Failed to start qemu-nbd service: %s", startResult));
+            return new StartNBDServerAnswer(cmd, false, "Failed to start qemu-nbd service: " + startResult);
+        }
+
+        // Wait with timeout until the service is up
+        int maxWaitSeconds = 20;
+        int pollIntervalMs = 5000;
+        int maxAttempts = (maxWaitSeconds * 1000) / pollIntervalMs;
+        boolean serviceActive = false;
+
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            try {
+                Thread.sleep(pollIntervalMs);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                return new StartNBDServerAnswer(cmd, false, "Interrupted while waiting for qemu-nbd service to start");
+            }
+            Script verifyScript = new Script("/bin/bash", logger);
+            verifyScript.add("-c");
+            verifyScript.add(String.format("systemctl is-active --quiet %s", unitName));
+            String verifyResult = verifyScript.execute();
+            if (verifyResult == null) {
+                serviceActive = true;
+                logger.info(String.format("qemu-nbd service %s is now active (attempt %d)", unitName, attempt + 1));
+                break;
+            }
+        }
+
+        if (!serviceActive) {
+            logger.error(String.format("qemu-nbd service %s failed to become active within %d seconds", unitName, maxWaitSeconds));
+            return new StartNBDServerAnswer(cmd, false,
+                    String.format("qemu-nbd service failed to start within %d seconds", maxWaitSeconds));
+        }
+
+        String transferUrl = String.format("nbd+unix:///%s", cmd.getSocket());
+        return new StartNBDServerAnswer(cmd, true, "qemu-nbd service started for upload",
+                    transferId, transferUrl);
+    }
+
+    private boolean isBitmapPresentOnDisk(String volumePath, String fromCheckpointId) {
+        String qemuImgInfo = Script.runBashScriptIgnoreExitValue(
+                String.format("qemu-img info --output=json %s", volumePath), 0);
+        if (StringUtils.isBlank(qemuImgInfo)) {
+            logger.warn("Unable to read qemu-img info output for disk path [{}].", volumePath);
+            return false;
+        }
+        try {
+            JSONObject info = new JSONObject(qemuImgInfo);
+            JSONObject formatSpecific = info.optJSONObject("format-specific");
+            if (formatSpecific == null) {
+                return false;
+            }
+            JSONObject formatData = formatSpecific.optJSONObject("data");
+            if (formatData == null) {
+                return false;
+            }
+            JSONArray bitmaps = formatData.optJSONArray("bitmaps");
+            if (bitmaps == null) {
+                return false;
+            }
+            for (int i = 0; i < bitmaps.length(); i++) {
+                JSONObject bitmap = bitmaps.optJSONObject(i);
+                if (bitmap == null) {
+                    continue;
+                }
+                if (fromCheckpointId.equals(bitmap.optString("name"))) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to parse qemu-img info output for disk path [{}].", volumePath, e);
+        }
+        return false;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java
new file mode 100644
index 000000000000..1185d89bc0b3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopBackupAnswer;
+import org.apache.cloudstack.backup.StopBackupCommand;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StopBackupCommand.class)
+public class LibvirtStopBackupCommandWrapper extends CommandWrapper<StopBackupCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(StopBackupCommand cmd, LibvirtComputingResource resource) {
+        String vmName = cmd.getVmName();
+
+        try {
+            Connect conn = LibvirtConnection.getConnection();
+            Domain dm = conn.domainLookupByName(vmName);
+
+            if (dm == null) {
+                return new StopBackupAnswer(cmd, false, "Domain not found: " + vmName);
+            }
+
+            // Execute virsh domjobabort
+            String abortCmd = String.format("virsh domjobabort %s", vmName);
+
+            Script script = new Script("/bin/bash");
+            script.add("-c");
+            script.add(abortCmd);
+            String result = script.execute();
+
+            if (result != null && !result.isEmpty()) {
+                // Job abort may fail if no job is running, which is acceptable
+                logger.debug("domjobabort result: " + result);
+            }
+
+            return new StopBackupAnswer(cmd, true, "Backup stopped successfully");
+
+        } catch (Exception e) {
+            return new StopBackupAnswer(cmd, false, "Error stopping backup: " + e.getMessage());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java
new file mode 100644
index 000000000000..57c7ebb706bc
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java
@@ -0,0 +1,72 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopNBDServerCommand;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StopNBDServerCommand.class)
+public class LibvirtStopNBDServerCommandWrapper extends CommandWrapper<StopNBDServerCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    @Override
+    public Answer execute(StopNBDServerCommand cmd, LibvirtComputingResource resource) {
+        try {
+            String unitName = "qemu-nbd-" + cmd.getTransferId().hashCode();
+
+            // Check if the service is running
+            Script checkScript = new Script("/bin/bash", logger);
+            checkScript.add("-c");
+            checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+            String checkResult = checkScript.execute();
+            if (checkResult != null) {
+                // Service is not running, but still reset-failed to clear any stale state
+                logger.info(String.format("qemu-nbd service %s is not running, resetting failed state", unitName));
+                resetService(unitName);
+                return new Answer(cmd, true, "Image transfer finalized");
+            }
+
+            // Stop the systemd service
+            Script stopScript = new Script("/bin/bash", logger);
+            stopScript.add("-c");
+            stopScript.add(String.format("systemctl stop %s", unitName));
+            stopScript.execute();
+            resetService(unitName);
+
+            return new Answer(cmd, true, "Image transfer finalized");
+
+        } catch (Exception e) {
+            logger.error("Error finalizing image transfer for upload", e);
+            return new Answer(cmd, false, "Error finalizing image transfer: " + e.getMessage());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptor.java
new file mode 100644
index 000000000000..e9ec65505e40
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptor.java
@@ -0,0 +1,1071 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.storage;
+
+import static com.cloud.utils.NumbersUtil.toHumanReadableSize;
+
+import java.io.File;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.hypervisor.kvm.resource.LibvirtStoragePoolDef;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Storage.StoragePoolType;
+import com.cloud.storage.StorageLayer;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
+import org.joda.time.Duration;
+import org.libvirt.Connect;
+import org.libvirt.LibvirtException;
+import org.libvirt.StoragePool;
+import org.libvirt.StorageVol;
+
+/**
+ * Storage adaptor for CLVM and CLVM_NG pool types.
+ * Extends LibvirtStorageAdaptor and overrides methods with CLVM-specific logic,
+ * using direct LVM commands instead of libvirt for volume operations.
+ */
+public class ClvmStorageAdaptor extends LibvirtStorageAdaptor {
+
+    public ClvmStorageAdaptor(StorageLayer storage) {
+        super(storage);
+    }
+
+    @Override
+    public StoragePoolType getStoragePoolType() {
+        // Registered manually for both CLVM and CLVM_NG in KVMStoragePoolManager
+        return null;
+    }
+
+    @Override
+    public KVMStoragePool createStoragePool(String name, String host, int port, String path,
+            String userInfo, StoragePoolType type, Map<String, String> details, boolean isPrimaryStorage) {
+        logger.info("Attempting to create CLVM/CLVM_NG storage pool {} in libvirt", name);
+
+        Connect conn;
+        try {
+            conn = LibvirtConnection.getConnection();
+        } catch (LibvirtException e) {
+            throw new CloudRuntimeException(e.toString());
+        }
+
+        StoragePool sp = createCLVMStoragePool(conn, name, host, path);
+        if (sp == null) {
+            logger.info("Falling back to virtual CLVM/CLVM_NG pool without libvirt for: {}", name);
+            return createVirtualClvmPool(name, host, path, type, details);
+        }
+
+        try {
+            if (!isPrimaryStorage) {
+                incStoragePoolRefCount(name);
+            }
+            // CLVM/CLVM_NG pools are kept inactive in libvirt; we use direct LVM commands
+            return getStoragePool(name);
+        } catch (Exception e) {
+            decStoragePoolRefCount(name);
+            throw new CloudRuntimeException("Failed to create CLVM storage pool: " + name, e);
+        }
+    }
+
+    @Override
+    public KVMStoragePool getStoragePool(String uuid, boolean refreshInfo) {
+        logger.info("Fetching CLVM/CLVM_NG storage pool {} ", uuid);
+        try {
+            Connect conn = LibvirtConnection.getConnection();
+            StoragePool storage = conn.storagePoolLookupByUUIDString(uuid);
+
+            LibvirtStoragePoolDef spd = getStoragePoolDef(conn, storage);
+            if (spd == null) {
+                throw new CloudRuntimeException("Unable to parse storage pool definition for pool " + uuid);
+            }
+
+            // CLVM pools in libvirt are always LOGICAL type
+            StoragePoolType type = StoragePoolType.CLVM;
+
+            // Do NOT activate the pool — CLVM/CLVM_NG pools stay inactive in libvirt
+            LibvirtStoragePool pool = new LibvirtStoragePool(uuid, storage.getName(), type, this, storage);
+            pool.setLocalPath(spd.getTargetPath());
+
+            // Always read capacity from LVM directly
+            String vgName = storage.getName();
+            try {
+                long[] vgStats = getVgStats(vgName);
+                setPoolCapacityFromVgStats(pool, vgStats, vgName);
+            } catch (CloudRuntimeException e) {
+                logger.warn("Failed to get VG stats for CLVM/CLVM_NG pool {}: {}. Using libvirt values (may be 0)", vgName, e.getMessage());
+                pool.setCapacity(storage.getInfo().capacity);
+                pool.setUsed(storage.getInfo().allocation);
+                pool.setAvailable(storage.getInfo().available);
+            }
+
+            return pool;
+        } catch (LibvirtException e) {
+            logger.debug("CLVM/CLVM_NG pool {} not found in libvirt, creating virtual pool", uuid);
+            throw new CloudRuntimeException(e.toString(), e);
+        }
+    }
+
+    @Override
+    public KVMPhysicalDisk getPhysicalDisk(String volumeUuid, KVMStoragePool pool) {
+        LibvirtStoragePool libvirtPool = (LibvirtStoragePool) pool;
+
+        // Pool has no libvirt backing - go directly to block device
+        if (libvirtPool.getPool() == null) {
+            logger.debug("CLVM/CLVM_NG pool has no libvirt backing, using direct block device access for volume: {}", volumeUuid);
+            return getPhysicalDiskViaDirectBlockDevice(volumeUuid, pool);
+        }
+
+        try {
+            StorageVol vol = getVolume(libvirtPool.getPool(), volumeUuid);
+            if (vol == null) {
+                logger.debug("Volume {} not found in libvirt, falling back to CLVM direct access", volumeUuid);
+                return getPhysicalDiskWithClvmFallback(volumeUuid, pool, libvirtPool);
+            }
+
+            boolean isQcow2 = StoragePoolType.CLVM_NG.equals(pool.getType());
+            KVMPhysicalDisk disk = new KVMPhysicalDisk(vol.getPath(), vol.getName(), pool);
+            disk.setSize(vol.getInfo().allocation);
+            disk.setVirtualSize(isQcow2 ? getQcow2VirtualSize(vol.getPath()) : vol.getInfo().capacity);
+            disk.setFormat(isQcow2 ? PhysicalDiskFormat.QCOW2 : PhysicalDiskFormat.RAW);
+            return disk;
+        } catch (LibvirtException e) {
+            logger.warn("LibvirtException looking up volume {}: {}", volumeUuid, e.getMessage());
+            return getPhysicalDiskWithClvmFallback(volumeUuid, pool, libvirtPool);
+        }
+    }
+
+    @Override
+    public KVMPhysicalDisk createPhysicalDisk(String name, KVMStoragePool pool,
+            PhysicalDiskFormat format, Storage.ProvisioningType provisioningType, long size, byte[] passphrase) {
+        logger.info("Creating CLVM/CLVM_NG volume {} in pool {} with size {}", name, pool.getUuid(), toHumanReadableSize(size));
+
+        if (StoragePoolType.CLVM_NG.equals(pool.getType())) {
+            return createClvmNgDiskWithBacking(name, 0, size, null, pool, provisioningType);
+        } else {
+            return createClvmVolume(name, size, pool);
+        }
+    }
+
+    @Override
+    public boolean connectPhysicalDisk(String name, KVMStoragePool pool, Map<String, String> details, boolean isVMMigrate) {
+        if (isVMMigrate) {
+            logger.info("Activating CLVM/CLVM_NG volume {} in shared mode for VM migration", name);
+            Script activateVol = new Script("lvchange", 30000, logger);
+            activateVol.add("-asy");
+            activateVol.add(pool.getLocalPath() + File.separator + name);
+            String result = activateVol.execute();
+            if (result != null) {
+                logger.error("Failed to activate CLVM/CLVM_NG volume {} in shared mode. Output: {}", name, result);
+                return false;
+            }
+        }
+
+        if (StoragePoolType.CLVM_NG.equals(pool.getType())) {
+            ensureClvmNgBackingFileAccessible(name, pool);
+        }
+
+        return true;
+    }
+
+    @Override
+    public KVMPhysicalDisk createDiskFromTemplate(KVMPhysicalDisk template,
+            String name, PhysicalDiskFormat format, Storage.ProvisioningType provisioningType,
+            long size, KVMStoragePool destPool, int timeout, byte[] passphrase) {
+
+        if (StoragePoolType.CLVM_NG.equals(destPool.getType()) && format == PhysicalDiskFormat.QCOW2) {
+            logger.info("Creating CLVM_NG volume {} with backing file from template {}", name, template.getName());
+            String backingFile = getClvmBackingFile(template, destPool);
+            return createClvmNgDiskWithBacking(name, timeout, size, backingFile, destPool, provisioningType);
+        }
+
+        return super.createDiskFromTemplate(template, name, format, provisioningType, size, destPool, timeout, passphrase);
+    }
+
+    @Override
+    public void createTemplate(String templatePath, String templateUuid, int timeout, KVMStoragePool pool) {
+        String vgName = getVgName(pool.getLocalPath());
+        String lvName = "template-" + templateUuid;
+        String lvPath = "/dev/" + vgName + "/" + lvName;
+
+        if (lvExists(lvPath)) {
+            logger.info("Template LV {} already exists in VG {}. Skipping creation.", lvName, vgName);
+            return;
+        }
+
+        logger.info("Creating new template LV {} in VG {} for template {}", lvName, vgName, templateUuid);
+
+        long virtualSize = getQcow2VirtualSize(templatePath);
+        long physicalSize = getQcow2PhysicalSize(templatePath);
+        long lvSize = virtualSize;
+
+        logger.info("Template source - Physical: {} bytes, Virtual: {} bytes, LV will be: {} bytes", physicalSize, virtualSize, lvSize);
+
+        Script lvcreate = new Script("lvcreate", Duration.millis(timeout), logger);
+        lvcreate.add("-n", lvName);
+        lvcreate.add("-L", lvSize + "B");
+        lvcreate.add("--yes");
+        lvcreate.add(vgName);
+        String result = lvcreate.execute();
+        if (result != null) {
+            throw new CloudRuntimeException("Failed to create LV for CLVM_NG template: " + result);
+        }
+
+        Script qemuImgConvert = new Script("qemu-img", Duration.millis(timeout), logger);
+        qemuImgConvert.add("convert");
+        qemuImgConvert.add(templatePath);
+        qemuImgConvert.add("-O", "qcow2");
+        qemuImgConvert.add("-o", "cluster_size=64k,extended_l2=off,preallocation=off");
+        qemuImgConvert.add(lvPath);
+        result = qemuImgConvert.execute();
+
+        if (result != null) {
+            removeLvOnFailure(lvPath, timeout);
+            throw new CloudRuntimeException("Failed to convert template to CLVM_NG volume: " + result);
+        }
+
+        long actualVirtualSize = getQcow2VirtualSize(lvPath);
+
+        try {
+            ensureTemplateLvInSharedMode(lvPath, true);
+        } catch (CloudRuntimeException e) {
+            logger.error("Failed to activate template LV {} in shared mode. Cleaning up.", lvPath);
+            removeLvOnFailure(lvPath, timeout);
+            throw e;
+        }
+
+        KVMPhysicalDisk templateDisk = new KVMPhysicalDisk(lvPath, lvName, pool);
+        templateDisk.setFormat(PhysicalDiskFormat.QCOW2);
+        templateDisk.setVirtualSize(actualVirtualSize);
+        templateDisk.setSize(lvSize);
+    }
+
+    private StoragePool createCLVMStoragePool(Connect conn, String uuid, String host, String path) {
+        String volgroupPath = "/dev/" + path;
+        String volgroupName = path;
+        volgroupName = volgroupName.replaceFirst("^/", "");
+
+        Script checkVgExists = new Script("vgs", 30000, logger);
+        checkVgExists.add("--noheadings");
+        checkVgExists.add("-o", "vg_name");
+        checkVgExists.add(volgroupName);
+        String vgCheckResult = checkVgExists.execute();
+
+        if (vgCheckResult != null) {
+            logger.error("Volume group {} does not exist or is not accessible", volgroupName);
+            return null;
+        }
+
+        logger.info("Volume group {} verified, creating libvirt pool definition for CLVM/CLVM_NG", volgroupName);
+        LibvirtStoragePoolDef poolDef = new LibvirtStoragePoolDef(
+            LibvirtStoragePoolDef.PoolType.LOGICAL,
+            volgroupName,
+            uuid,
+            null,
+            volgroupName,
+            volgroupPath
+        );
+
+        try {
+            StoragePool pool = conn.storagePoolDefineXML(poolDef.toString(), 0);
+            logger.info("Created libvirt pool definition for CLVM/CLVM_NG VG: {} (pool will remain inactive)", volgroupName);
+            pool.setAutostart(1);
+            return pool;
+        } catch (LibvirtException e) {
+            logger.warn("Failed to define CLVM/CLVM_NG pool in libvirt: {}", e.getMessage());
+            return null;
+        }
+    }
+
+    private void setPoolCapacityFromVgStats(LibvirtStoragePool pool, long[] vgStats, String vgName) {
+        long capacity = vgStats[0];
+        long available = vgStats[1];
+        long used = capacity - available;
+
+        pool.setCapacity(capacity);
+        pool.setAvailable(available);
+        pool.setUsed(used);
+
+        logger.debug("CLVM/CLVM_NG pool {} - Capacity: {}, Used: {}, Available: {}",
+                vgName, toHumanReadableSize(capacity), toHumanReadableSize(used), toHumanReadableSize(available));
+    }
+
+    private long[] getVgStats(String vgName) {
+        Script getVgStats = new Script("vgs", 30000, logger);
+        getVgStats.add("--noheadings");
+        getVgStats.add("--units", "b");
+        getVgStats.add("--nosuffix");
+        getVgStats.add("-o", "vg_size,vg_free");
+        getVgStats.add(vgName);
+
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        String result = getVgStats.execute(parser);
+
+        if (result != null) {
+            String errorMsg = "Failed to get statistics for volume group " + vgName + ": " + result;
+            logger.error(errorMsg);
+            throw new CloudRuntimeException(errorMsg);
+        }
+
+        String output = parser.getLines().trim();
+        String[] lines = output.split("\\n");
+        String dataLine = null;
+
+        for (String line : lines) {
+            line = line.trim();
+            if (!line.isEmpty() && Character.isDigit(line.charAt(0))) {
+                dataLine = line;
+                break;
+            }
+        }
+
+        if (dataLine == null) {
+            String errorMsg = "No valid data line found in vgs output for " + vgName + ": " + output;
+            logger.error(errorMsg);
+            throw new CloudRuntimeException(errorMsg);
+        }
+
+        String[] stats = dataLine.split("\\s+");
+
+        if (stats.length < 2) {
+            String errorMsg = "Unexpected output from vgs command for " + vgName + ": " + dataLine;
+            logger.error(errorMsg);
+            throw new CloudRuntimeException(errorMsg);
+        }
+
+        try {
+            long capacity = Long.parseLong(stats[0].trim());
+            long available = Long.parseLong(stats[1].trim());
+            return new long[]{capacity, available};
+        } catch (NumberFormatException e) {
+            String errorMsg = "Failed to parse VG statistics for " + vgName + ": " + e.getMessage();
+            logger.error(errorMsg);
+            throw new CloudRuntimeException(errorMsg, e);
+        }
+    }
+
+    private KVMStoragePool createVirtualClvmPool(String uuid, String host, String path, StoragePoolType type, Map<String, String> details) {
+        String volgroupName = path.replaceFirst("^/", "");
+        String volgroupPath = "/dev/" + volgroupName;
+
+        logger.info("Creating virtual CLVM/CLVM_NG pool {} without libvirt using direct LVM access", volgroupName);
+
+        long[] vgStats = getVgStats(volgroupName);
+
+        LibvirtStoragePool pool = new LibvirtStoragePool(uuid, volgroupName, type, this, null);
+        pool.setLocalPath(volgroupPath);
+        setPoolCapacityFromVgStats(pool, vgStats, volgroupName);
+
+        if (details != null) {
+            pool.setDetails(details);
+        }
+
+        return pool;
+    }
+
+    /**
+     * CLVM fallback: First tries to refresh libvirt pool to make volume visible,
+     * if that fails, accesses volume directly via block device path.
+     */
+    private KVMPhysicalDisk getPhysicalDiskWithClvmFallback(String volumeUuid, KVMStoragePool pool, LibvirtStoragePool libvirtPool) {
+        logger.info("CLVM volume not visible to libvirt, attempting pool refresh for volume: {}", volumeUuid);
+
+        try {
+            logger.debug("Refreshing libvirt storage pool: {}", pool.getUuid());
+            libvirtPool.getPool().refresh(0);
+
+            StorageVol vol = getVolume(libvirtPool.getPool(), volumeUuid);
+            if (vol != null) {
+                logger.info("Volume found after pool refresh: {}", volumeUuid);
+                boolean isQcow2 = StoragePoolType.CLVM_NG.equals(pool.getType());
+                KVMPhysicalDisk disk = new KVMPhysicalDisk(vol.getPath(), vol.getName(), pool);
+                disk.setSize(vol.getInfo().allocation);
+                disk.setVirtualSize(isQcow2 ? getQcow2VirtualSize(vol.getPath()) : vol.getInfo().capacity);
+                disk.setFormat(isQcow2 ? PhysicalDiskFormat.QCOW2 : PhysicalDiskFormat.RAW);
+                return disk;
+            }
+        } catch (LibvirtException refreshEx) {
+            logger.debug("Pool refresh failed or volume still not found: {}", refreshEx.getMessage());
+        }
+
+        logger.info("Falling back to direct block device access for volume: {}", volumeUuid);
+        return getPhysicalDiskViaDirectBlockDevice(volumeUuid, pool);
+    }
+
+    private String getVgName(String sourceDir) {
+        String vgName = sourceDir;
+        if (vgName.startsWith("/")) {
+            String[] parts = vgName.split("/");
+            List<String> tokens = Arrays.stream(parts)
+                    .filter(s -> !s.isEmpty()).collect(Collectors.toList());
+
+            vgName = tokens.size() > 1 ? tokens.get(1)
+                    : tokens.size() == 1 ? tokens.get(0)
+                      : "";
+        }
+        return vgName;
+    }
+
+    private String extractVgNameFromPool(KVMStoragePool pool) {
+        String sourceDir = pool.getLocalPath();
+        if (sourceDir == null || sourceDir.isEmpty()) {
+            throw new CloudRuntimeException("CLVM pool sourceDir is not set, cannot determine VG name");
+        }
+        String vgName = getVgName(sourceDir);
+        logger.debug("Using VG name: {} (from sourceDir: {})", vgName, sourceDir);
+        return vgName;
+    }
+
+    /**
+     * For CLVM volumes that exist in LVM but are not visible to libvirt,
+     * access them directly via block device path.
+     */
+    private KVMPhysicalDisk getPhysicalDiskViaDirectBlockDevice(String volumeUuid, KVMStoragePool pool) {
+        try {
+            String vgName = extractVgNameFromPool(pool);
+
+            verifyLvExistsInVg(volumeUuid, vgName);
+
+            logger.info("Volume {} exists in LVM but not visible to libvirt, accessing directly", volumeUuid);
+
+            String lvPath = findAccessibleDeviceNode(volumeUuid, vgName, pool);
+            long size = getClvmVolumeSize(lvPath);
+
+            KVMPhysicalDisk disk = createPhysicalDiskFromClvmLv(lvPath, volumeUuid, pool, size);
+            ensureTemplateAccessibility(volumeUuid, lvPath, pool);
+
+            return disk;
+        } catch (CloudRuntimeException ex) {
+            throw ex;
+        } catch (Exception ex) {
+            logger.error("Failed to access CLVM volume via direct block device: {}", volumeUuid, ex);
+            throw new CloudRuntimeException(String.format("Could not find volume %s: %s", volumeUuid, ex.getMessage()));
+        }
+    }
+
+    private void verifyLvExistsInVg(String volumeUuid, String vgName) {
+        logger.debug("Checking if volume {} exists in VG {}", volumeUuid, vgName);
+        Script checkLvCmd = new Script("/usr/sbin/lvs", 30000, logger);
+        checkLvCmd.add("--noheadings");
+        checkLvCmd.add("--unbuffered");
+        checkLvCmd.add(vgName + "/" + volumeUuid);
+        String checkResult = checkLvCmd.execute();
+        if (checkResult != null) {
+            throw new CloudRuntimeException(String.format("Storage volume not found: no storage vol with matching name '%s'", volumeUuid));
+        }
+    }
+
+    private String findAccessibleDeviceNode(String volumeUuid, String vgName, KVMStoragePool pool) {
+        String lvPath = "/dev/" + vgName + "/" + volumeUuid;
+        File lvDevice = new File(lvPath);
+
+        if (!lvDevice.exists()) {
+            lvPath = tryDeviceMapperPath(volumeUuid, vgName);
+            if (!new File(lvPath).exists()) {
+                lvPath = handleMissingDeviceNode(volumeUuid, vgName, pool);
+            }
+        }
+
+        return lvPath;
+    }
+
+    private String tryDeviceMapperPath(String volumeUuid, String vgName) {
+        String vgNameEscaped = vgName.replace("-", "--");
+        String volumeUuidEscaped = volumeUuid.replace("-", "--");
+        return "/dev/mapper/" + vgNameEscaped + "-" + volumeUuidEscaped;
+    }
+
+    private String handleMissingDeviceNode(String volumeUuid, String vgName, KVMStoragePool pool) {
+        if (StoragePoolType.CLVM_NG.equals(pool.getType()) && volumeUuid.startsWith("template-")) {
+            return activateTemplateAndGetPath(volumeUuid, vgName);
+        }
+        throw new CloudRuntimeException(String.format("Could not find volume %s in VG %s - volume exists in LVM but device node not accessible", volumeUuid, vgName));
+    }
+
+    private String activateTemplateAndGetPath(String volumeUuid, String vgName) {
+        logger.info("Template volume {} device node not found. Attempting to activate in shared mode.", volumeUuid);
+        String templateLvPath = "/dev/" + vgName + "/" + volumeUuid;
+
+        try {
+            ensureTemplateLvInSharedMode(templateLvPath, false);
+
+            String lvPath = findDeviceNodeAfterActivation(templateLvPath, volumeUuid, vgName);
+
+            logger.info("Successfully activated template volume {} at {}", volumeUuid, lvPath);
+            return lvPath;
+        } catch (CloudRuntimeException e) {
+            throw new CloudRuntimeException(String.format("Failed to activate template volume %s in VG %s: %s", volumeUuid, vgName, e.getMessage()), e);
+        }
+    }
+
+    private String findDeviceNodeAfterActivation(String templateLvPath, String volumeUuid, String vgName) {
+        File lvDevice = new File(templateLvPath);
+        String lvPath = templateLvPath;
+
+        if (!lvDevice.exists()) {
+            String vgNameEscaped = vgName.replace("-", "--");
+            String volumeUuidEscaped = volumeUuid.replace("-", "--");
+            lvPath = "/dev/mapper/" + vgNameEscaped + "-" + volumeUuidEscaped;
+            lvDevice = new File(lvPath);
+        }
+
+        if (!lvDevice.exists()) {
+            logger.error("Template volume {} still not accessible after activation attempt", volumeUuid);
+            throw new CloudRuntimeException(String.format("Could not activate template volume %s in VG %s - device node not accessible after activation", volumeUuid, vgName));
+        }
+
+        return lvPath;
+    }
+
+    private void ensureTemplateAccessibility(String volumeUuid, String lvPath, KVMStoragePool pool) {
+        if (StoragePoolType.CLVM_NG.equals(pool.getType()) && volumeUuid.startsWith("template-")) {
+            logger.info("Detected template volume {}. Ensuring it's activated in shared mode.", volumeUuid);
+            ensureTemplateLvInSharedMode(lvPath, false);
+        }
+    }
+
+    private long getClvmVolumeSize(String lvPath) {
+        try {
+            Script lvsCmd = new Script("/usr/sbin/lvs", 30000, logger);
+            lvsCmd.add("--noheadings");
+            lvsCmd.add("--units");
+            lvsCmd.add("b");
+            lvsCmd.add("-o");
+            lvsCmd.add("lv_size");
+            lvsCmd.add(lvPath);
+
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            String result = lvsCmd.execute(parser);
+
+            String output = (result == null) ? parser.getLines() : result;
+
+            if (output != null && !output.isEmpty()) {
+                String sizeStr = output.trim().replaceAll("[^0-9]", "");
+                if (!sizeStr.isEmpty()) {
+                    return Long.parseLong(sizeStr);
+                }
+            }
+        } catch (Exception sizeEx) {
+            logger.warn("Failed to get size for CLVM volume via lvs: {}", sizeEx.getMessage());
+            File lvDevice = new File(lvPath);
+            if (lvDevice.isFile()) {
+                return lvDevice.length();
+            }
+        }
+        return 0;
+    }
+
+    private KVMPhysicalDisk createPhysicalDiskFromClvmLv(String lvPath, String volumeUuid, KVMStoragePool pool, long size) {
+        PhysicalDiskFormat diskFormat = StoragePoolType.CLVM_NG.equals(pool.getType())
+                ? PhysicalDiskFormat.QCOW2 : PhysicalDiskFormat.RAW;
+
+        logger.debug("{} pool detected, setting disk format to {} for volume {}", pool.getType(), diskFormat, volumeUuid);
+
+        KVMPhysicalDisk disk = new KVMPhysicalDisk(lvPath, volumeUuid, pool);
+        disk.setFormat(diskFormat);
+        disk.setSize(size);
+        disk.setVirtualSize(diskFormat == PhysicalDiskFormat.QCOW2 ? getQcow2VirtualSize(lvPath) : size);
+
+        logger.info("Successfully accessed CLVM/CLVM_NG volume via direct block device: {} with format: {} and size: {} bytes",
+                lvPath, diskFormat, size);
+        return disk;
+    }
+
+    /**
+     * Checks if a CLVM_NG QCOW2 volume has a backing file (template) and ensures it's activated in shared mode.
+     */
+    private void ensureClvmNgBackingFileAccessible(String volumeName, KVMStoragePool pool) {
+        try {
+            String vgName = getVgName(pool.getLocalPath());
+            String volumePath = "/dev/" + vgName + "/" + volumeName;
+
+            logger.debug("Checking if CLVM_NG volume {} has a backing file that needs activation", volumePath);
+
+            Script qemuImgInfo = new Script("qemu-img", Duration.millis(10000), logger);
+            qemuImgInfo.add("info");
+            qemuImgInfo.add("--output=json");
+            qemuImgInfo.add(volumePath);
+
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            String result = qemuImgInfo.execute(parser);
+
+            if (result == null && parser.getLines() != null && !parser.getLines().isEmpty()) {
+                String jsonOutput = parser.getLines();
+
+                if (jsonOutput.contains("\"backing-filename\"")) {
+                    int backingStart = jsonOutput.indexOf("\"backing-filename\"");
+                    if (backingStart > 0) {
+                        int valueStart = jsonOutput.indexOf(":", backingStart);
+                        if (valueStart > 0) {
+                            valueStart = jsonOutput.indexOf("\"", valueStart) + 1;
+                            int valueEnd = jsonOutput.indexOf("\"", valueStart);
+
+                            if (valueEnd > valueStart) {
+                                String backingFile = jsonOutput.substring(valueStart, valueEnd).trim();
+                                if (!backingFile.isEmpty() && backingFile.startsWith("/dev/")) {
+                                    logger.info("Volume {} has backing file: {}. Ensuring backing file is in shared mode.", volumePath, backingFile);
+                                    ensureTemplateLvInSharedMode(backingFile, false);
+                                }
+                            }
+                        }
+                    }
+                } else {
+                    logger.debug("Volume {} does not have a backing file (full clone)", volumePath);
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to check/activate backing file for volume {}: {}. VM deployment may fail if template is not accessible.",
+                    volumeName, e.getMessage());
+        }
+    }
+
+    private String getClvmBackingFile(KVMPhysicalDisk template, KVMStoragePool destPool) {
+        String templateLvName = template.getName();
+        KVMPhysicalDisk templateOnPrimary = null;
+
+        try {
+            templateOnPrimary = destPool.getPhysicalDisk(templateLvName);
+        } catch (CloudRuntimeException e) {
+            logger.warn("Template {} not found on CLVM_NG pool {}.", templateLvName, destPool.getUuid());
+        }
+
+        if (templateOnPrimary != null) {
+            String backingFile = templateOnPrimary.getPath();
+            logger.info("Using template on primary storage as backing file: {}", backingFile);
+            ensureTemplateLvInSharedMode(backingFile);
+            return backingFile;
+        }
+
+        logger.error("Template {} should be on primary storage before creating volumes from it", templateLvName);
+        throw new CloudRuntimeException(String.format("Template not found on CLVM_NG primary storage: %s. Template must be copied to primary storage first.", templateLvName));
+    }
+
+    /**
+     * Ensures a template LV is activated in shared mode so multiple VMs can use it as a backing file.
+     */
+    private void ensureTemplateLvInSharedMode(String templatePath, boolean throwOnFailure) {
+        try {
+            Script checkLvs = new Script("lvs", Duration.millis(30000), logger);
+            checkLvs.add("--noheadings");
+            checkLvs.add("-o", "lv_attr");
+            checkLvs.add(templatePath);
+
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            String result = checkLvs.execute(parser);
+
+            if (result == null && parser.getLines() != null && !parser.getLines().isEmpty()) {
+                String lvAttr = parser.getLines().trim();
+                if (lvAttr.length() >= 6) {
+                    boolean isActive = (lvAttr.indexOf('a') >= 0);
+                    boolean isShared = (lvAttr.indexOf('s') >= 0);
+
+                    if (!isShared || !isActive) {
+                        logger.info("Template LV {} is not in shared mode (attr: {}). Activating in shared mode.", templatePath, lvAttr);
+                        LibvirtComputingResource.setClvmVolumeToSharedMode(templatePath);
+                    } else {
+                        logger.debug("Template LV {} is already in shared mode (attr: {})", templatePath, lvAttr);
+                    }
+                }
+            }
+        } catch (CloudRuntimeException e) {
+            throw e;
+        } catch (Exception e) {
+            String errorMsg = "Failed to check/ensure template LV shared mode for " + templatePath + ": " + e.getMessage();
+            if (throwOnFailure) {
+                throw new CloudRuntimeException(errorMsg, e);
+            } else {
+                logger.warn(errorMsg, e);
+            }
+        }
+    }
+
+    private void ensureTemplateLvInSharedMode(String templatePath) {
+        ensureTemplateLvInSharedMode(templatePath, false);
+    }
+
+    private long getVgPhysicalExtentSize(String vgName) {
+        final long DEFAULT_PE_SIZE = 4 * 1024 * 1024L;
+        String warningMessage = String.format("Failed to get PE size for VG %s, defaulting to 4MiB", vgName);
+
+        try {
+            Script vgDisplay = new Script("vgdisplay", 300000, logger);
+            vgDisplay.add("--units", "b");
+            vgDisplay.add("-C");
+            vgDisplay.add("--noheadings");
+            vgDisplay.add("-o", "vg_extent_size");
+            vgDisplay.add(vgName);
+
+            OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+            String result = vgDisplay.execute(parser);
+
+            if (result != null) {
+                logger.warn("{}: {}", warningMessage, result);
+                return DEFAULT_PE_SIZE;
+            }
+
+            String output = parser.getLines();
+            if (output == null || output.trim().isEmpty()) {
+                logger.warn("{}: empty output", warningMessage);
+                return DEFAULT_PE_SIZE;
+            }
+
+            output = output.trim();
+            if (output.endsWith("B")) {
+                output = output.substring(0, output.length() - 1).trim();
+            }
+
+            long peSize = Long.parseLong(output);
+            logger.debug("Physical Extent size for VG {} is {} bytes", vgName, peSize);
+            return peSize;
+        } catch (NumberFormatException e) {
+            logger.warn("{}: failed to parse PE size", warningMessage, e);
+        } catch (Exception e) {
+            logger.warn("{}: {}", warningMessage, e.getMessage());
+        }
+
+        logger.info("Using default PE size for VG {}: {} bytes (4 MiB)", vgName, DEFAULT_PE_SIZE);
+        return DEFAULT_PE_SIZE;
+    }
+
+    /**
+     * Calculate LVM LV size for CLVM_NG volume allocation.
+     * {@code peSize} must be the Physical Extent size of the VG (from {@link #getVgPhysicalExtentSize}).
+     */
+    private long calculateClvmNgLvSize(long virtualSize, long peSize) {
+        long clusterSize = 64 * 1024L;
+        long l2Multiplier = 4096L;
+
+        long numDataClusters = (virtualSize + clusterSize - 1) / clusterSize;
+        long numL2Clusters = (numDataClusters + l2Multiplier - 1) / l2Multiplier;
+        long l2TableSize = numL2Clusters * clusterSize;
+        long refcountTableSize = l2TableSize;
+
+        long headerOverhead = 2 * 1024 * 1024L;
+        long metadataOverhead = l2TableSize + refcountTableSize + headerOverhead;
+        long targetSize = virtualSize + metadataOverhead;
+        long roundedSize = ((targetSize + peSize - 1) / peSize) * peSize;
+        long virtualSizeGiB = virtualSize / (1024 * 1024 * 1024L);
+        long overheadMiB = metadataOverhead / (1024 * 1024L);
+
+        logger.info("Calculated volume LV size: {} bytes (virtual: {} GiB, QCOW2 metadata overhead: {} MiB, rounded to {} PEs, PE size = {} bytes)",
+                roundedSize, virtualSizeGiB, overheadMiB, roundedSize / peSize, peSize);
+
+        return roundedSize;
+    }
+
+    private long getQcow2VirtualSize(String imagePath) {
+        Script qemuImg = new Script("qemu-img", 300000, logger);
+        qemuImg.add("info");
+        qemuImg.add("--output=json");
+        qemuImg.add("-U");
+        qemuImg.add(imagePath);
+
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        String result = qemuImg.execute(parser);
+
+        if (result != null) {
+            throw new CloudRuntimeException("Failed to get QCOW2 virtual size for " + imagePath + ": " + result);
+        }
+
+        String output = parser.getLines();
+        if (output == null || output.trim().isEmpty()) {
+            throw new CloudRuntimeException("qemu-img info returned empty output for " + imagePath);
+        }
+
+        JsonObject info = JsonParser.parseString(output).getAsJsonObject();
+        return info.get("virtual-size").getAsLong();
+    }
+
+    private long getQcow2PhysicalSize(String imagePath) {
+        Script qemuImg = new Script("qemu-img", Duration.millis(300000), logger);
+        qemuImg.add("info");
+        qemuImg.add("--output=json");
+        qemuImg.add(imagePath);
+
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        String result = qemuImg.execute(parser);
+
+        if (result != null) {
+            throw new CloudRuntimeException("Failed to get QCOW2 physical size for " + imagePath + ": " + result);
+        }
+
+        String output = parser.getLines();
+        if (output == null || output.trim().isEmpty()) {
+            throw new CloudRuntimeException("qemu-img info returned empty output for " + imagePath);
+        }
+
+        JsonObject info = JsonParser.parseString(output).getAsJsonObject();
+        return info.get("actual-size").getAsLong();
+    }
+
+    private KVMPhysicalDisk createClvmNgDiskWithBacking(String volumeUuid, int timeout, long virtualSize, String backingFile,
+                                                         KVMStoragePool pool, Storage.ProvisioningType provisioningType) {
+        String vgName = getVgName(pool.getLocalPath());
+        // Query PE size once and reuse for both the QCOW2 virtual-size alignment and the
+        long peSize = getVgPhysicalExtentSize(vgName);
+        long peAlignedVirtualSize = ((virtualSize + peSize - 1) / peSize) * peSize;
+        long lvSize = calculateClvmNgLvSize(peAlignedVirtualSize, peSize);
+        String volumePath = "/dev/" + vgName + "/" + volumeUuid;
+
+        logger.debug("Creating CLVM_NG volume {} with LV size {} bytes (requested virtual: {} bytes, PE-aligned virtual: {} bytes, provisioning: {})",
+                volumeUuid, lvSize, virtualSize, peAlignedVirtualSize, provisioningType);
+
+        Script lvcreate = new Script("lvcreate", Duration.millis(timeout), logger);
+        lvcreate.add("-n", volumeUuid);
+        lvcreate.add("-L", lvSize + "B");
+        lvcreate.add("--yes");
+        lvcreate.add(vgName);
+
+        String result = lvcreate.execute();
+        if (result != null) {
+            throw new CloudRuntimeException("Failed to create LV for CLVM_NG volume: " + result);
+        }
+
+        Script qemuImg = new Script("qemu-img", Duration.millis(timeout), logger);
+        qemuImg.add("create");
+        qemuImg.add("-f", "qcow2");
+
+        StringBuilder qcow2Options = new StringBuilder();
+        String preallocation = (provisioningType == Storage.ProvisioningType.THIN) ? "off" : "metadata";
+        qcow2Options.append("preallocation=").append(preallocation);
+        qcow2Options.append(",extended_l2=on");
+        qcow2Options.append(",cluster_size=64k");
+
+        if (backingFile != null && !backingFile.isEmpty()) {
+            qcow2Options.append(",backing_file=").append(backingFile);
+            qcow2Options.append(",backing_fmt=qcow2");
+            logger.debug("Creating CLVM_NG volume with backing file: {}", backingFile);
+        }
+
+        qemuImg.add("-o", qcow2Options.toString());
+        qemuImg.add(volumePath);
+        qemuImg.add(peAlignedVirtualSize + "");
+
+        result = qemuImg.execute();
+        if (result != null) {
+            removeLvOnFailure(volumePath, timeout);
+            throw new CloudRuntimeException("Failed to create QCOW2 on CLVM_NG volume: " + result);
+        }
+
+        long actualSize = getClvmVolumeSize(volumePath);
+        KVMPhysicalDisk disk = new KVMPhysicalDisk(volumePath, volumeUuid, pool);
+        disk.setFormat(PhysicalDiskFormat.QCOW2);
+        disk.setSize(actualSize);
+        disk.setVirtualSize(peAlignedVirtualSize);
+
+        logger.info("Successfully created CLVM_NG volume {} (LV size: {}, PE-aligned virtual size: {}, provisioning: {}, preallocation: {})",
+                volumeUuid, lvSize, peAlignedVirtualSize, provisioningType, preallocation);
+
+        return disk;
+    }
+
+    private boolean lvExists(String lvPath) {
+        Script checkLv = new Script("lvs", Duration.millis(30000), logger);
+        checkLv.add("--noheadings");
+        checkLv.add("--unbuffered");
+        checkLv.add(lvPath);
+        return checkLv.execute() == null;
+    }
+
+    private void removeLvOnFailure(String lvPath, int timeout) {
+        Script lvremove = new Script("lvremove", Duration.millis(timeout), logger);
+        lvremove.add("-f");
+        lvremove.add(lvPath);
+        lvremove.execute();
+    }
+
+    private KVMPhysicalDisk createClvmVolume(String volumeName, long size, KVMStoragePool pool) {
+        String vgName = getVgName(pool.getLocalPath());
+        String volumePath = "/dev/" + vgName + "/" + volumeName;
+        int timeout = 30000;
+
+        logger.info("Creating CLVM volume {} in VG {} with size {} bytes", volumeName, vgName, size);
+
+        Script lvcreate = new Script("lvcreate", Duration.millis(timeout), logger);
+        lvcreate.add("-n", volumeName);
+        lvcreate.add("-L", size + "B");
+        lvcreate.add("--yes");
+        lvcreate.add(vgName);
+
+        String result = lvcreate.execute();
+        if (result != null) {
+            throw new CloudRuntimeException("Failed to create CLVM volume: " + result);
+        }
+
+        logger.info("Successfully created CLVM volume {} at {} with size {}", volumeName, volumePath, toHumanReadableSize(size));
+
+        long actualSize = getClvmVolumeSize(volumePath);
+        KVMPhysicalDisk disk = new KVMPhysicalDisk(volumePath, volumeName, pool);
+        disk.setFormat(PhysicalDiskFormat.RAW);
+        disk.setSize(actualSize);
+        disk.setVirtualSize(actualSize);
+
+        return disk;
+    }
+
+    @Override
+    public boolean deletePhysicalDisk(String uuid, KVMStoragePool pool, Storage.ImageFormat format) {
+        logger.info("CLVM/CLVM_NG pool detected - using direct LVM cleanup with secure zero-fill for volume {}", uuid);
+        return cleanupCLVMVolume(uuid, pool);
+    }
+
+    /**
+     * Clean up CLVM volume and its snapshots directly using LVM commands.
+     */
+    private boolean cleanupCLVMVolume(String uuid, KVMStoragePool pool) {
+        logger.info("Starting direct LVM cleanup for CLVM volume: {} in pool: {}", uuid, pool.getUuid());
+
+        try {
+            String sourceDir = pool.getLocalPath();
+            if (sourceDir == null || sourceDir.isEmpty()) {
+                logger.debug("Source directory is null or empty, cannot determine VG name for CLVM pool {}, skipping direct cleanup", pool.getUuid());
+                return true;
+            }
+            String vgName = getVgName(sourceDir);
+            logger.info("Determined VG name: {} for pool: {}", vgName, pool.getUuid());
+
+            if (vgName == null || vgName.isEmpty()) {
+                logger.warn("Cannot determine VG name for CLVM pool {}, skipping direct cleanup", pool.getUuid());
+                return true;
+            }
+
+            String lvPath = "/dev/" + vgName + "/" + uuid;
+            logger.debug("Volume path: {}", lvPath);
+
+            Script checkLvs = new Script("lvs", 30000, logger);
+            checkLvs.add("--noheadings");
+            checkLvs.add("--unbuffered");
+            checkLvs.add(lvPath);
+
+            logger.info("Checking if volume exists: lvs --noheadings --unbuffered {}", lvPath);
+            String checkResult = checkLvs.execute();
+
+            if (checkResult != null) {
+                logger.info("CLVM volume {} does not exist in LVM (check returned: {}), considering it as already deleted", uuid, checkResult);
+                return true;
+            }
+
+            logger.info("Volume {} exists, proceeding with cleanup", uuid);
+
+            boolean secureZeroFillEnabled = shouldSecureZeroFill(pool);
+
+            if (secureZeroFillEnabled) {
+                logger.info("Step 1: Zero-filling volume {} for security", uuid);
+                secureZeroFillVolume(lvPath, uuid);
+            } else {
+                logger.info("Secure zero-fill is disabled, skipping zero-filling for volume {}", uuid);
+            }
+
+            logger.info("Step 2: Removing volume {}", uuid);
+            Script removeLv = new Script("lvremove", 30000, logger);
+            removeLv.add("-f");
+            removeLv.add(lvPath);
+
+            logger.info("Executing command: lvremove -f {}", lvPath);
+            String removeResult = removeLv.execute();
+
+            if (removeResult == null) {
+                logger.info("Successfully removed CLVM volume {} using direct LVM cleanup", uuid);
+                return true;
+            } else {
+                logger.warn("Command 'lvremove -f {}' returned error: {}", lvPath, removeResult);
+                if (removeResult.contains("not found") || removeResult.contains("Failed to find")) {
+                    logger.info("CLVM volume {} not found during cleanup, considering it as already deleted", uuid);
+                    return true;
+                }
+                return false;
+            }
+        } catch (Exception ex) {
+            logger.error("Exception during CLVM volume cleanup for {}: {}", uuid, ex.getMessage(), ex);
+            return true;
+        }
+    }
+
+    private boolean shouldSecureZeroFill(KVMStoragePool pool) {
+        Map<String, String> details = pool.getDetails();
+        String secureZeroFillStr = (details != null) ? details.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL) : null;
+        return Boolean.parseBoolean(secureZeroFillStr);
+    }
+
+    /**
+     * Securely zero-fill a volume before deletion to prevent data leakage.
+     * Uses blkdiscard (fast TRIM) as primary method, with dd zero-fill as fallback.
+     */
+    private void secureZeroFillVolume(String lvPath, String volumeUuid) {
+        logger.info("Starting secure zero-fill for CLVM volume: {} at path: {}", volumeUuid, lvPath);
+
+        boolean blkdiscardSuccess = false;
+
+        try {
+            Script blkdiscard = new Script("blkdiscard", 300000, logger);
+            blkdiscard.add("-f");
+            blkdiscard.add(lvPath);
+
+            String result = blkdiscard.execute();
+            if (result == null) {
+                logger.info("Successfully zero-filled CLVM volume {} using blkdiscard (TRIM)", volumeUuid);
+                blkdiscardSuccess = true;
+            } else {
+                if (result.contains("Operation not supported") || result.contains("BLKDISCARD ioctl failed")) {
+                    logger.info("blkdiscard not supported for volume {} (device doesn't support TRIM/DISCARD), using dd fallback", volumeUuid);
+                } else {
+                    logger.warn("blkdiscard failed for volume {}: {}, will try dd fallback", volumeUuid, result);
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Exception during blkdiscard for volume {}: {}, will try dd fallback", volumeUuid, e.getMessage());
+        }
+
+        if (!blkdiscardSuccess) {
+            logger.info("Attempting zero-fill using dd for CLVM volume: {}", volumeUuid);
+            try {
+                String command = String.format(
+                    "nice -n 19 ionice -c 2 -n 7 dd if=/dev/zero of=%s bs=1M oflag=direct 2>&1 || true",
+                    lvPath
+                );
+
+                Script ddZeroFill = new Script("/bin/bash", 3600000, logger);
+                ddZeroFill.add("-c");
+                ddZeroFill.add(command);
+
+                OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+                String ddResult = ddZeroFill.execute(parser);
+                String output = parser.getLines();
+
+                if (output != null && (output.contains("copied") || output.contains("records in") ||
+                    output.contains("No space left on device"))) {
+                    logger.info("Successfully zero-filled CLVM volume {} using dd", volumeUuid);
+                } else if (ddResult == null) {
+                    logger.info("Zero-fill completed for CLVM volume {}", volumeUuid);
+                } else {
+                    logger.warn("dd zero-fill for volume {} completed with output: {}", volumeUuid,
+                        output != null ? output : ddResult);
+                }
+            } catch (Exception e) {
+                logger.warn("Failed to zero-fill CLVM volume {} before deletion: {}. Proceeding with deletion anyway.",
+                        volumeUuid, e.getMessage());
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
index 3e35ed9476b1..a8207cec3fa6 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
@@ -33,6 +33,7 @@
 
 public interface KVMStoragePool {
 
+    public static final String CLVM_SECURE_ZERO_FILL = "clvmsecurezerofill";
     long HeartBeatUpdateTimeoutInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HEARTBEAT_UPDATE_TIMEOUT);
     long HeartBeatUpdateFreqInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_FREQUENCY);
     long HeartBeatCheckerTimeoutInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_CHECKER_TIMEOUT);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
index 35cc864268c3..996398a286ff 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
@@ -72,7 +72,9 @@ private StorageAdaptor getStorageAdaptor(StoragePoolType type) {
 
     private void addStoragePool(String uuid, StoragePoolInformation pool) {
         synchronized (_storagePools) {
-            if (!_storagePools.containsKey(uuid)) {
+            // Insert on first registration; on subsequent calls (e.g. ModifyStoragePoolCommand)
+            // overwrite when new details are present so config changes are reflected
+            if (!_storagePools.containsKey(uuid) || MapUtils.isNotEmpty(pool.getDetails())) {
                 _storagePools.put(uuid, pool);
             }
         }
@@ -81,6 +83,10 @@ private void addStoragePool(String uuid, StoragePoolInformation pool) {
     public KVMStoragePoolManager(StorageLayer storagelayer, KVMHAMonitor monitor) {
         this._haMonitor = monitor;
         this._storageMapper.put("libvirt", new LibvirtStorageAdaptor(storagelayer));
+        // Register CLVM/CLVM_NG adaptor explicitly for both types (one shared instance)
+        ClvmStorageAdaptor clvmAdaptor = new ClvmStorageAdaptor(storagelayer);
+        this._storageMapper.put(StoragePoolType.CLVM.toString(), clvmAdaptor);
+        this._storageMapper.put(StoragePoolType.CLVM_NG.toString(), clvmAdaptor);
         // add other storage adaptors manually here
 
         // add any adaptors that wish to register themselves via call to adaptor.getStoragePoolType()
@@ -92,8 +98,8 @@ public KVMStoragePoolManager(StorageLayer storagelayer, KVMHAMonitor monitor) {
                 logger.debug("Skipping registration of abstract class / interface " + storageAdaptorClass.getName());
                 continue;
             }
-            if (storageAdaptorClass.isAssignableFrom(LibvirtStorageAdaptor.class)) {
-                logger.debug("Skipping re-registration of LibvirtStorageAdaptor");
+            if (storageAdaptorClass == LibvirtStorageAdaptor.class || storageAdaptorClass == ClvmStorageAdaptor.class) {
+                logger.debug("Skipping re-registration of explicitly registered adaptor: {}", storageAdaptorClass.getSimpleName());
                 continue;
             }
             try {
@@ -288,19 +294,45 @@ public KVMStoragePool getStoragePool(StoragePoolType type, String uuid, boolean
         }
 
         if (pool instanceof LibvirtStoragePool) {
-            addPoolDetails(uuid, (LibvirtStoragePool) pool);
+            LibvirtStoragePool libvirtPool = (LibvirtStoragePool) pool;
+            addPoolDetails(uuid, libvirtPool);
+
             ((LibvirtStoragePool) pool).setType(type);
+            updatePoolTypeIfApplicable(libvirtPool, pool, type, uuid);
         }
 
         return pool;
     }
 
+    private void updatePoolTypeIfApplicable(LibvirtStoragePool libvirtPool, KVMStoragePool pool,
+                                            StoragePoolType type, String uuid) {
+        StoragePoolType correctType = type;
+        if (correctType == null || correctType == StoragePoolType.CLVM) {
+            StoragePoolInformation info = _storagePools.get(uuid);
+            if (info != null && info.getPoolType() != null) {
+                correctType = info.getPoolType();
+            }
+        }
+
+        if (correctType != null && correctType != pool.getType() &&
+                (correctType == StoragePoolType.CLVM || correctType == StoragePoolType.CLVM_NG) &&
+                (pool.getType() == StoragePoolType.CLVM || pool.getType() == StoragePoolType.CLVM_NG)) {
+            logger.debug("Correcting pool type from {} to {} for pool {} based on caller/cached information",
+                    pool.getType(), correctType, uuid);
+            libvirtPool.setType(correctType);
+        }
+    }
+
     /**
      * As the class {@link LibvirtStoragePool} is constrained to the {@link org.libvirt.StoragePool} class, there is no way of saving a generic parameter such as the details, hence,
      * this method was created to always make available the details of libvirt primary storages for when they are needed.
      */
     private void addPoolDetails(String uuid, LibvirtStoragePool pool) {
         StoragePoolInformation storagePoolInformation = _storagePools.get(uuid);
+        if (storagePoolInformation == null) {
+            logger.warn("No cached StoragePoolInformation found for pool UUID {}, pool details will not be set.", uuid);
+            return;
+        }
         Map<String, String> details = storagePoolInformation.getDetails();
 
         if (MapUtils.isNotEmpty(details)) {
@@ -454,6 +486,10 @@ public KVMPhysicalDisk createDiskFromTemplate(KVMPhysicalDisk template, String n
             return adaptor.createDiskFromTemplate(template, name,
                     PhysicalDiskFormat.RAW, provisioningType,
                     size, destPool, timeout, passphrase);
+        } else if (destPool.getType() == StoragePoolType.CLVM_NG) {
+            return adaptor.createDiskFromTemplate(template, name,
+                    PhysicalDiskFormat.QCOW2, provisioningType,
+                    size, destPool, timeout, passphrase);
         } else if (template.getFormat() == PhysicalDiskFormat.DIR) {
             return adaptor.createDiskFromTemplate(template, name,
                     PhysicalDiskFormat.DIR, provisioningType,
@@ -495,6 +531,11 @@ public KVMPhysicalDisk createPhysicalDiskFromDirectDownloadTemplate(String templ
         return adaptor.createTemplateFromDirectDownloadFile(templateFilePath, destTemplatePath, destPool, format, timeout);
     }
 
+    public void createTemplateOnClvmNg(String templatePath, String templateUuid, int timeout, KVMStoragePool pool) {
+        StorageAdaptor adaptor = getStorageAdaptor(pool.getType());
+        adaptor.createTemplate(templatePath, templateUuid, timeout, pool);
+    }
+
     public Ternary<Boolean, Map<String, String>, String> prepareStorageClient(StoragePoolType type, String uuid, Map<String, String> details) {
         StorageAdaptor adaptor = getStorageAdaptor(type);
         return adaptor.prepareStorageClient(uuid, details);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
index f95ebff5326f..4a77f7e9e19c 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
@@ -55,6 +55,7 @@
 
 import com.cloud.agent.api.Command;
 import com.cloud.hypervisor.kvm.resource.LibvirtXMLParser;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -225,6 +226,26 @@ public class KVMStorageProcessor implements StorageProcessor {
             "  </devices>\n" +
             "</domain>";
 
+    private static final String DUMMY_VM_XML_BLOCK = "<domain type='qemu'>\n" +
+            "  <name>%s</name>\n" +
+            "  <memory unit='MiB'>256</memory>\n" +
+            "  <currentMemory unit='MiB'>256</currentMemory>\n" +
+            "  <vcpu>1</vcpu>\n" +
+            "  <os>\n" +
+            "    <type arch='%s' machine='%s'>hvm</type>\n" +
+            "    <boot dev='hd'/>\n" +
+            "  </os>\n" +
+            "  <devices>\n" +
+            "    <emulator>%s</emulator>\n" +
+            "    <disk type='block' device='disk'>\n" +
+            "      <driver name='qemu' type='qcow2' cache='none'/>\n"+
+            "      <source dev='%s'/>\n" +
+            "      <target dev='sda'/>\n" +
+            "    </disk>\n" +
+            "    <graphics type='vnc' port='-1'/>\n" +
+            "  </devices>\n" +
+            "</domain>";
+
 
     public KVMStorageProcessor(final KVMStoragePoolManager storagePoolMgr, final LibvirtComputingResource resource) {
         this.storagePoolMgr = storagePoolMgr;
@@ -347,15 +368,28 @@ public Answer copyTemplateToPrimaryStorage(final CopyCommand cmd) {
                     path = destTempl.getUuid();
                 }
 
-                if (path != null && !storagePoolMgr.connectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path, details)) {
-                    logger.warn("Failed to connect physical disk at path: {}, in storage pool [id: {}, name: {}]", path, primaryStore.getUuid(), primaryStore.getName());
-                    return new PrimaryStorageDownloadAnswer("Failed to spool template disk at path: " + path + ", in storage pool id: " + primaryStore.getUuid());
-                }
+                if (primaryPool.getType() == StoragePoolType.CLVM_NG) {
+                    logger.info("Copying template {} to CLVM_NG pool {}",
+                                destTempl.getUuid(), primaryPool.getUuid());
 
-                primaryVol = storagePoolMgr.copyPhysicalDisk(tmplVol, path != null ? path : destTempl.getUuid(), primaryPool, cmd.getWaitInMillSeconds());
+                    try {
+                        storagePoolMgr.createTemplateOnClvmNg(tmplVol.getPath(), path, cmd.getWaitInMillSeconds(), primaryPool);
+                        primaryVol = primaryPool.getPhysicalDisk("template-" + path);
+                    } catch (Exception e) {
+                        logger.error("Failed to create CLVM_NG template: {}", e.getMessage(), e);
+                        return new PrimaryStorageDownloadAnswer("Failed to create CLVM_NG template: " + e.getMessage());
+                    }
+                } else {
+                    if (path != null && !storagePoolMgr.connectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path, details)) {
+                        logger.warn("Failed to connect physical disk at path: {}, in storage pool [id: {}, name: {}]", path, primaryStore.getUuid(), primaryStore.getName());
+                        return new PrimaryStorageDownloadAnswer("Failed to spool template disk at path: " + path + ", in storage pool id: " + primaryStore.getUuid());
+                    }
+
+                    primaryVol = storagePoolMgr.copyPhysicalDisk(tmplVol, path != null ? path : destTempl.getUuid(), primaryPool, cmd.getWaitInMillSeconds());
 
-                if (!storagePoolMgr.disconnectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path)) {
-                    logger.warn("Failed to disconnect physical disk at path: {}, in storage pool [id: {}, name: {}]", path, primaryStore.getUuid(), primaryStore.getName());
+                    if (!storagePoolMgr.disconnectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path)) {
+                        logger.warn("Failed to disconnect physical disk at path: {}, in storage pool [id: {}, name: {}]", path, primaryStore.getUuid(), primaryStore.getName());
+                    }
                 }
             } else {
                 primaryVol = storagePoolMgr.copyPhysicalDisk(tmplVol, UUID.randomUUID().toString(), primaryPool, cmd.getWaitInMillSeconds());
@@ -376,7 +410,8 @@ public Answer copyTemplateToPrimaryStorage(final CopyCommand cmd) {
                     StoragePoolType.RBD,
                     StoragePoolType.PowerFlex,
                     StoragePoolType.Linstor,
-                    StoragePoolType.FiberChannel).contains(primaryPool.getType())) {
+                    StoragePoolType.FiberChannel,
+                    StoragePoolType.CLVM).contains(primaryPool.getType())) {
                     newTemplate.setFormat(ImageFormat.RAW);
                 } else {
                     newTemplate.setFormat(ImageFormat.QCOW2);
@@ -589,7 +624,9 @@ public Answer copyVolumeFromImageCacheToPrimary(final CopyCommand cmd) {
 
             String path = details != null ? details.get(DiskTO.IQN) : null;
 
-            storagePoolMgr.connectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path, details);
+            if (!ClvmPoolManager.isClvmPoolType(primaryStore.getPoolType())) {
+                storagePoolMgr.connectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path, details);
+            }
 
             final String volumeName = UUID.randomUUID().toString();
 
@@ -618,7 +655,9 @@ public Answer copyVolumeFromImageCacheToPrimary(final CopyCommand cmd) {
             final KVMPhysicalDisk newDisk = storagePoolMgr.copyPhysicalDisk(volume, path != null ? path : volumeName, primaryPool, cmd.getWaitInMillSeconds());
             resource.createOrUpdateLogFileForCommand(cmd, Command.State.COMPLETED);
 
-            storagePoolMgr.disconnectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path);
+            if (!ClvmPoolManager.isClvmPoolType(primaryStore.getPoolType())) {
+                storagePoolMgr.disconnectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), path);
+            }
 
             final VolumeObjectTO newVol = new VolumeObjectTO();
 
@@ -1118,7 +1157,14 @@ public Answer backupSnapshot(final CopyCommand cmd) {
                 }
             } else {
                 final Script command = new Script(_manageSnapshotPath, cmd.getWaitInMillSeconds(), logger);
-                command.add("-b", isCreatedFromVmSnapshot ? snapshotDisk.getPath() : snapshot.getPath());
+                String backupPath;
+                if (primaryPool.getType() == StoragePoolType.CLVM || primaryPool.getType() == StoragePoolType.CLVM_NG) {
+                    backupPath = snapshotDisk.getPath();
+                    logger.debug("Using snapshotDisk path for CLVM/CLVM_NG backup: " + backupPath);
+                } else {
+                    backupPath = isCreatedFromVmSnapshot ? snapshotDisk.getPath() : snapshot.getPath();
+                }
+                command.add("-b", backupPath);
                 command.add(NAME_OPTION, snapshotName);
                 command.add("-p", snapshotDestPath);
 
@@ -1163,6 +1209,90 @@ public Answer backupSnapshot(final CopyCommand cmd) {
         }
     }
 
+    /**
+     * Parse CLVM/CLVM_NG snapshot path and compute MD5 hash.
+     * Snapshot path format: /dev/vgname/volumeuuid/snapshotuuid
+     *
+     * @param snapshotPath The snapshot path from database
+     * @param poolType Storage pool type (for logging)
+     * @return Array of [vgName, volumeUuid, snapshotUuid, md5Hash] or null if invalid
+     */
+    private String[] parseClvmSnapshotPath(String snapshotPath, StoragePoolType poolType) {
+        String[] pathParts = snapshotPath.split("/");
+        if (pathParts.length < 5) {
+            logger.warn("Invalid {} snapshot path format: {}, expected format: /dev/vgname/volume-uuid/snapshot-uuid",
+                        poolType, snapshotPath);
+            return null;
+        }
+
+        String vgName = pathParts[2];
+        String volumeUuid = pathParts[3];
+        String snapshotUuid = pathParts[4];
+
+        logger.info("Parsed {} snapshot path - VG: {}, Volume: {}, Snapshot: {}",
+                    poolType, vgName, volumeUuid, snapshotUuid);
+
+        String md5Hash = computeMd5Hash(snapshotUuid);
+        logger.debug("Computed MD5 hash for snapshot UUID {}: {}", snapshotUuid, md5Hash);
+
+        return new String[]{vgName, volumeUuid, snapshotUuid, md5Hash};
+    }
+
+    /**
+     * Delete a CLVM or CLVM_NG snapshot using managesnapshot.sh script.
+     * For both CLVM and CLVM_NG, the snapshot path stored in DB is: /dev/vgname/volumeuuid/snapshotuuid
+     * The script handles MD5 transformation and pool-specific deletion commands internally:
+     * - CLVM: Uses lvremove to delete LVM snapshot
+     * - CLVM_NG: Uses qemu-img snapshot -d to delete QCOW2 internal snapshot
+     * This approach is consistent with snapshot creation and backup which also use the script.
+     *
+     * @param snapshotPath The snapshot path from database
+     * @param poolType Storage pool type (CLVM or CLVM_NG)
+     * @param checkExistence If true, checks if snapshot exists before cleanup (for explicit deletion)
+     *                       If false, always performs cleanup (for post-backup cleanup)
+     * @return true if cleanup was performed, false if snapshot didn't exist (when checkExistence=true)
+     */
+    private boolean deleteClvmSnapshot(String snapshotPath, StoragePoolType poolType, boolean checkExistence) {
+        logger.info("Starting {} snapshot deletion for path: {}, checkExistence: {}", poolType, snapshotPath, checkExistence);
+
+        try {
+            String[] parsed = parseClvmSnapshotPath(snapshotPath, poolType);
+            if (parsed == null) {
+                return false;
+            }
+
+            String vgName = parsed[0];
+            String volumeUuid = parsed[1];
+            String snapshotUuid = parsed[2];
+            String volumePath = "/dev/" + vgName + "/" + volumeUuid;
+
+            // Use managesnapshot.sh script for deletion (consistent with create/backup)
+            // Script handles MD5 transformation and pool-specific commands internally
+            Script deleteCommand = new Script(_manageSnapshotPath, 30000, logger);
+            deleteCommand.add("-d", volumePath);
+            deleteCommand.add("-n", snapshotUuid);
+
+            logger.info("Executing: managesnapshot.sh -d {} -n {}", volumePath, snapshotUuid);
+            String result = deleteCommand.execute();
+
+            if (result == null) {
+                logger.info("Successfully deleted {} snapshot: {}", poolType, snapshotPath);
+                return true;
+            } else {
+                if (checkExistence && result.contains("does not exist")) {
+                    logger.info("{} snapshot {} already deleted, no cleanup needed", poolType, snapshotPath);
+                    return true;
+                }
+                logger.warn("Failed to delete {} snapshot {}: {}", poolType, snapshotPath, result);
+                return false;
+            }
+
+        } catch (Exception ex) {
+            logger.error("Exception while deleting {} snapshot {}", poolType, snapshotPath, ex);
+            return false;
+        }
+    }
+
     private void deleteSnapshotOnPrimary(final CopyCommand cmd, final SnapshotObjectTO snapshot,
             KVMStoragePool primaryPool) {
         String snapshotPath = snapshot.getPath();
@@ -1175,7 +1305,19 @@ private void deleteSnapshotOnPrimary(final CopyCommand cmd, final SnapshotObject
 
         if ((backupSnapshotAfterTakingSnapshot == null || BooleanUtils.toBoolean(backupSnapshotAfterTakingSnapshot)) && deleteSnapshotOnPrimary) {
             try {
-                Files.deleteIfExists(Paths.get(snapshotPath));
+                if (primaryPool.getType() == StoragePoolType.CLVM || primaryPool.getType() == StoragePoolType.CLVM_NG) {
+                    // Both CLVM and CLVM_NG use the same deletion method via managesnapshot.sh script
+                    boolean cleanedUp = deleteClvmSnapshot(snapshotPath, primaryPool.getType(), false);
+                    if (!cleanedUp) {
+                        String[] parsedPath = parseClvmSnapshotPath(snapshotPath, primaryPool.getType());
+                        String snapMd5 = (parsedPath != null) ? computeMd5Hash(parsedPath[2]) : computeMd5Hash(snapshotPath);
+                        logger.warn("Deletion of Snapshot: {} on primary store may have failed as it doesn't exist: {} " +
+                                "(MD5 of snapshot UUID: {} - admins can use this to manually locate and delete the LV via managesnapshot.sh or lvremove)",
+                                primaryPool.getType(), snapshotPath, snapMd5);
+                    }
+                } else {
+                    Files.deleteIfExists(Paths.get(snapshotPath));
+                }
             } catch (IOException ex) {
                 logger.error("Failed to delete snapshot [{}] on primary storage [{}].", snapshot.getId(), snapshot.getName(), ex);
             }
@@ -1184,6 +1326,26 @@ private void deleteSnapshotOnPrimary(final CopyCommand cmd, final SnapshotObject
         }
     }
 
+
+    /**
+     * Compute MD5 hash of a string, matching what managesnapshot.sh does:
+     * echo "${snapshot}" | md5sum -t | awk '{ print $1 }'
+     */
+    private String computeMd5Hash(String input) {
+        try {
+            java.security.MessageDigest md = java.security.MessageDigest.getInstance("MD5");
+            byte[] array = md.digest((input + "\n").getBytes("UTF-8"));
+            StringBuilder sb = new StringBuilder();
+            for (byte b : array) {
+                sb.append(String.format("%02x", b));
+            }
+            return sb.toString();
+        } catch (Exception e) {
+            logger.error("Failed to compute MD5 hash for: {}", input, e);
+            return input;
+        }
+    }
+
     protected synchronized void attachOrDetachISO(final Connect conn, final String vmName, String isoPath, final boolean isAttach, Map<String, String> params, DataStoreTO store) throws
             LibvirtException, InternalErrorException {
         DiskDef iso = new DiskDef();
@@ -1523,6 +1685,10 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                     if (attachingDisk.getFormat() == PhysicalDiskFormat.QCOW2) {
                         diskdef.setDiskFormatType(DiskDef.DiskFmtType.QCOW2);
                     }
+                } else if (attachingPool.getType() == StoragePoolType.CLVM_NG) {
+                    // CLVM_NG uses QCOW2 format on block devices
+                    diskdef.defBlockBasedDisk(attachingDisk.getPath(), devId, busT);
+                    diskdef.setDiskFormatType(DiskDef.DiskFmtType.QCOW2);
                 } else if (attachingDisk.getFormat() == PhysicalDiskFormat.QCOW2) {
                     diskdef.defFileBasedDisk(attachingDisk.getPath(), devId, busT, DiskDef.DiskFmtType.QCOW2);
                 } else if (attachingDisk.getFormat() == PhysicalDiskFormat.RAW) {
@@ -1738,13 +1904,22 @@ public Answer createVolume(final CreateObjectCommand cmd) {
             primaryPool = storagePoolMgr.getStoragePool(primaryStore.getPoolType(), primaryStore.getUuid());
             disksize = volume.getSize();
             PhysicalDiskFormat format;
-            if (volume.getFormat() == null || StoragePoolType.RBD.equals(primaryStore.getPoolType())) {
+
+            MigrationOptions migrationOptions = volume.getMigrationOptions();
+            boolean useDstPoolFormat = useDestPoolFormat(migrationOptions, primaryStore);
+
+            if (volume.getFormat() == null || StoragePoolType.RBD.equals(primaryStore.getPoolType()) || useDstPoolFormat) {
                 format = primaryPool.getDefaultFormat();
+                if (useDstPoolFormat) {
+                    logger.debug("Using destination pool default format {} for volume {} due to CLVM migration (src: {}, dst: {})",
+                               format, volume.getUuid(),
+                               migrationOptions != null ? migrationOptions.getSrcPoolType() : "unknown",
+                               primaryStore.getPoolType());
+                }
             } else {
                 format = PhysicalDiskFormat.valueOf(volume.getFormat().toString().toUpperCase());
             }
 
-            MigrationOptions migrationOptions = volume.getMigrationOptions();
             if (migrationOptions != null) {
                 int timeout = migrationOptions.getTimeout();
 
@@ -1769,7 +1944,11 @@ public Answer createVolume(final CreateObjectCommand cmd) {
                     format = vol.getFormat();
                 }
             }
-            newVol.setSize(volume.getSize());
+            if (StoragePoolType.CLVM_NG.equals(primaryStore.getPoolType()) && vol != null && vol.getVirtualSize() > 0) {
+                newVol.setSize(vol.getVirtualSize());
+            } else {
+                newVol.setSize(volume.getSize());
+            }
             newVol.setFormat(ImageFormat.valueOf(format.toString().toUpperCase()));
 
             return new CreateObjectAnswer(newVol);
@@ -1781,6 +1960,29 @@ public Answer createVolume(final CreateObjectCommand cmd) {
         }
     }
 
+    /**
+     * For migration involving CLVM (RAW format), use destination pool's default format
+     * CLVM uses RAW format which may not match destination pool's format (e.g., NFS uses QCOW2)
+     * This specifically handles:
+     *   - CLVM (RAW) -> NFS/Local/CLVM_NG (QCOW2)
+     *   - NFS/Local/CLVM_NG (QCOW2) -> CLVM (RAW)
+     * @param migrationOptions
+     * @param primaryStore
+     * @return
+     */
+    private boolean useDestPoolFormat(MigrationOptions migrationOptions, PrimaryDataStoreTO primaryStore) {
+        boolean useDstPoolFormat = false;
+        if (migrationOptions != null && migrationOptions.getSrcPoolType() != null) {
+            StoragePoolType srcPoolType = migrationOptions.getSrcPoolType();
+            StoragePoolType dstPoolType = primaryStore.getPoolType();
+
+            if (srcPoolType != dstPoolType) {
+                useDstPoolFormat = (srcPoolType == StoragePoolType.CLVM || dstPoolType == StoragePoolType.CLVM);
+            }
+        }
+        return useDstPoolFormat;
+    }
+
     /**
      * XML to take disk-only snapshot of the VM.<br><br>
      * 1st parameter: snapshot's name;<br>
@@ -1870,10 +2072,22 @@ public Answer createSnapshot(final CreateObjectCommand cmd) {
                     if (snapshotSize != null) {
                         newSnapshot.setPhysicalSize(snapshotSize);
                     }
-                } else if (primaryPool.getType() == StoragePoolType.CLVM) {
-                    CreateObjectAnswer result = takeClvmVolumeSnapshotOfStoppedVm(disk, snapshotName);
-                    if (result != null) return result;
-                    newSnapshot.setPath(snapshotPath);
+                } else if (primaryPool.getType() == StoragePoolType.CLVM || primaryPool.getType() == StoragePoolType.CLVM_NG) {
+                    if (primaryPool.getType() == StoragePoolType.CLVM_NG && snapshotTO.isKvmIncrementalSnapshot()) {
+                        if (secondaryPool == null) {
+                            String errorMsg = String.format("Incremental snapshots for CLVM_NG require secondary storage. " +
+                                    "Please configure secondary storage or disable incremental snapshots for volume [%s].", volume.getName());
+                            logger.error(errorMsg);
+                            return new CreateObjectAnswer(errorMsg);
+                        }
+                        logger.info("Taking incremental snapshot of CLVM_NG volume [{}] using QCOW2 backup to secondary storage.", volume.getName());
+                        newSnapshot = takeIncrementalVolumeSnapshotOfStoppedVm(snapshotTO, primaryPool, secondaryPool,
+                                imageStoreTo.getUrl(), snapshotName, volume, conn, cmd.getWait());
+                    } else {
+                        CreateObjectAnswer result = takeClvmVolumeSnapshotOfStoppedVm(disk, snapshotName);
+                        if (result != null) return result;
+                        newSnapshot.setPath(snapshotPath);
+                    }
                 } else {
                     if (snapshotTO.isKvmIncrementalSnapshot()) {
                         newSnapshot = takeIncrementalVolumeSnapshotOfStoppedVm(snapshotTO, primaryPool, secondaryPool, imageStoreTo != null ? imageStoreTo.getUrl() : null, snapshotName, volume, conn, cmd.getWait());
@@ -1946,7 +2160,11 @@ private String getVmXml(KVMStoragePool primaryPool, VolumeObjectTO volumeObjectT
         String machine = resource.isGuestAarch64() ? LibvirtComputingResource.VIRT : LibvirtComputingResource.PC;
         String cpuArch = resource.getGuestCpuArch() != null ? resource.getGuestCpuArch() : "x86_64";
 
-        return String.format(DUMMY_VM_XML, vmName, cpuArch, machine, resource.getHypervisorPath(), primaryPool.getLocalPathFor(volumeObjectTo.getPath()));
+        String volumePath = primaryPool.getLocalPathFor(volumeObjectTo.getPath());
+        boolean isClvmNg = StoragePoolType.CLVM_NG == primaryPool.getType();
+
+        String xmlTemplate = isClvmNg ? DUMMY_VM_XML_BLOCK : DUMMY_VM_XML;
+        return String.format(xmlTemplate, vmName, cpuArch, machine, resource.getHypervisorPath(), volumePath);
     }
 
     private SnapshotObjectTO takeIncrementalVolumeSnapshotOfRunningVm(SnapshotObjectTO snapshotObjectTO, KVMStoragePool primaryPool, KVMStoragePool secondaryPool,
@@ -2667,11 +2885,13 @@ public Answer deleteVolume(final DeleteCommand cmd) {
         final PrimaryDataStoreTO primaryStore = (PrimaryDataStoreTO)vol.getDataStore();
         try {
             final KVMStoragePool pool = storagePoolMgr.getStoragePool(primaryStore.getPoolType(), primaryStore.getUuid());
-            try {
-                pool.getPhysicalDisk(vol.getPath());
-            } catch (final Exception e) {
-                logger.debug(String.format("can't find volume: %s, return true", vol));
-                return new Answer(null);
+            if (pool.getType() != StoragePoolType.CLVM && pool.getType() != StoragePoolType.CLVM_NG) {
+                try {
+                    pool.getPhysicalDisk(vol.getPath());
+                } catch (final Exception e) {
+                    logger.debug(String.format("can't find volume: %s, return true", vol));
+                    return new Answer(null);
+                }
             }
             pool.deletePhysicalDisk(vol.getPath(), vol.getFormat());
             return new Answer(null);
@@ -2900,6 +3120,25 @@ public Answer deleteSnapshot(final DeleteCommand cmd) {
                 if (snapshotTO.isKvmIncrementalSnapshot()) {
                     deleteCheckpoint(snapshotTO);
                 }
+            } else if (primaryPool.getType() == StoragePoolType.CLVM || primaryPool.getType() == StoragePoolType.CLVM_NG) {
+                // For CLVM/CLVM_NG, snapshots are typically already deleted from primary storage during backup
+                // via deleteSnapshotOnPrimary in the backupSnapshot finally block.
+                // This is called when the user explicitly deletes the snapshot via UI/API.
+                // We check if the snapshot still exists and clean it up if needed.
+                logger.info("Processing CLVM/CLVM_NG snapshot deletion (id={}, name={}, path={}) on primary storage",
+                        snapshotTO.getId(), snapshotTO.getName(), snapshotTO.getPath());
+
+                String snapshotPath = snapshotTO.getPath();
+                if (snapshotPath != null && !snapshotPath.isEmpty()) {
+                    boolean wasDeleted = deleteClvmSnapshot(snapshotPath, primaryPool.getType(), true);
+                    if (wasDeleted) {
+                        logger.info("Successfully cleaned up {} snapshot {} from primary storage", primaryPool.getType(), snapshotName);
+                    } else {
+                        logger.info("{} snapshot {} was already deleted from primary storage during backup, no cleanup needed", primaryPool.getType(), snapshotName);
+                    }
+                } else {
+                    logger.debug("{} snapshot path is null or empty, assuming already cleaned up", primaryPool.getType());
+                }
             } else {
                 logger.warn("Operation not implemented for storage pool type of " + primaryPool.getType().toString());
                 throw new InternalErrorException("Operation not implemented for storage pool type of " + primaryPool.getType().toString());
@@ -3175,7 +3414,8 @@ private Storage.ImageFormat getFormat(StoragePoolType poolType) {
                 StoragePoolType.RBD,
                 StoragePoolType.PowerFlex,
                 StoragePoolType.Linstor,
-                StoragePoolType.FiberChannel).contains(poolType)) {
+                StoragePoolType.FiberChannel,
+                StoragePoolType.CLVM).contains(poolType)) {
             return ImageFormat.RAW;
         } else {
             return ImageFormat.QCOW2;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
index a03daeb197bf..ed159c92790d 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
@@ -231,6 +231,11 @@ private void createTemplateOnRBDFromDirectDownloadFile(String srcTemplateFilePat
     }
 
     public StorageVol getVolume(StoragePool pool, String volName) {
+        if (pool == null) {
+            logger.debug("LibVirt StoragePool is null (likely CLVM/CLVM_NG virtual pool), cannot lookup volume {} via libvirt", volName);
+            return null;
+        }
+
         StorageVol vol = null;
 
         try {
@@ -254,9 +259,12 @@ public StorageVol getVolume(StoragePool pool, String volName) {
 
             try {
                 vol = pool.storageVolLookupByName(volName);
-                logger.debug("Found volume " + volName + " in storage pool " + pool.getName() + " after refreshing the pool");
+                if (vol != null) {
+                    logger.debug("Found volume " + volName + " in storage pool " + pool.getName() + " after refreshing the pool");
+                }
             } catch (LibvirtException e) {
-                throw new CloudRuntimeException("Could not find volume " + volName + ": " + e.getMessage());
+                logger.debug("Volume " + volName + " still not found after pool refresh: " + e.getMessage());
+                return null;
             }
         }
 
@@ -349,38 +357,6 @@ private StoragePool createSharedStoragePool(Connect conn, String uuid, String ho
         }
     }
 
-    private StoragePool createCLVMStoragePool(Connect conn, String uuid, String host, String path) {
-
-        String volgroupPath = "/dev/" + path;
-        String volgroupName = path;
-        volgroupName = volgroupName.replaceFirst("/", "");
-
-        LibvirtStoragePoolDef spd = new LibvirtStoragePoolDef(PoolType.LOGICAL, volgroupName, uuid, host, volgroupPath, volgroupPath);
-        StoragePool sp = null;
-        try {
-            logger.debug(spd.toString());
-            sp = conn.storagePoolCreateXML(spd.toString(), 0);
-            return sp;
-        } catch (LibvirtException e) {
-            logger.error(e.toString());
-            if (sp != null) {
-                try {
-                    if (sp.isPersistent() == 1) {
-                        sp.destroy();
-                        sp.undefine();
-                    } else {
-                        sp.destroy();
-                    }
-                    sp.free();
-                } catch (LibvirtException l) {
-                    logger.debug("Failed to define clvm storage pool with: " + l.toString());
-                }
-            }
-            return null;
-        }
-
-    }
-
     private List<String> getNFSMountOptsFromDetails(StoragePoolType type, Map<String, String> details) {
         List<String> nfsMountOpts = null;
         if (!type.equals(StoragePoolType.NetworkFilesystem) || details == null) {
@@ -580,14 +556,11 @@ public KVMStoragePool getStoragePool(String uuid, boolean refreshInfo) {
             Connect conn = LibvirtConnection.getConnection();
             storage = conn.storagePoolLookupByUUIDString(uuid);
 
-            if (storage.getInfo().state != StoragePoolState.VIR_STORAGE_POOL_RUNNING) {
-                logger.warn("Storage pool " + uuid + " is not in running state. Attempting to start it.");
-                storage.create(0);
-            }
             LibvirtStoragePoolDef spd = getStoragePoolDef(conn, storage);
             if (spd == null) {
                 throw new CloudRuntimeException("Unable to parse the storage pool definition for storage pool " + uuid);
             }
+
             StoragePoolType type = null;
             if (spd.getPoolType() == LibvirtStoragePoolDef.PoolType.NETFS) {
                 type = StoragePoolType.NetworkFilesystem;
@@ -603,6 +576,12 @@ public KVMStoragePool getStoragePool(String uuid, boolean refreshInfo) {
                 type = StoragePoolType.PowerFlex;
             }
 
+            // Activate pool if not running
+            if (storage.getInfo().state != StoragePoolState.VIR_STORAGE_POOL_RUNNING) {
+                logger.warn("Storage pool " + uuid + " is not in running state. Attempting to start it.");
+                storage.create(0);
+            }
+
             LibvirtStoragePool pool = new LibvirtStoragePool(uuid, storage.getName(), type, this, storage);
 
             if (pool.getType() != StoragePoolType.RBD && pool.getType() != StoragePoolType.PowerFlex)
@@ -640,15 +619,17 @@ public KVMStoragePool getStoragePool(String uuid, boolean refreshInfo) {
                 logger.info("Asking libvirt to refresh storage pool " + uuid);
                 pool.refresh();
             }
+
             pool.setCapacity(storage.getInfo().capacity);
             pool.setUsed(storage.getInfo().allocation);
-            updateLocalPoolIops(pool);
             pool.setAvailable(storage.getInfo().available);
 
-            logger.debug("Successfully refreshed pool " + uuid +
-                           " Capacity: " + toHumanReadableSize(storage.getInfo().capacity) +
-                           " Used: " + toHumanReadableSize(storage.getInfo().allocation) +
-                           " Available: " + toHumanReadableSize(storage.getInfo().available));
+            logger.debug("Successfully refreshed pool {} Capacity: {} Used: {} Available: {}",
+                    uuid, toHumanReadableSize(storage.getInfo().capacity),
+                    toHumanReadableSize(storage.getInfo().allocation),
+                    toHumanReadableSize(storage.getInfo().available));
+
+            updateLocalPoolIops(pool);
 
             return pool;
         } catch (LibvirtException e) {
@@ -663,6 +644,10 @@ public KVMPhysicalDisk getPhysicalDisk(String volumeUuid, KVMStoragePool pool) {
 
         try {
             StorageVol vol = getVolume(libvirtPool.getPool(), volumeUuid);
+            if (vol == null) {
+                throw new CloudRuntimeException("Volume " + volumeUuid + " not found in libvirt pool");
+            }
+
             KVMPhysicalDisk disk;
             LibvirtStorageVolumeDef voldef = getStorageVolumeDef(libvirtPool.getPool().getConnect(), vol);
             disk = new KVMPhysicalDisk(vol.getPath(), vol.getName(), pool);
@@ -693,7 +678,7 @@ public KVMPhysicalDisk getPhysicalDisk(String volumeUuid, KVMStoragePool pool) {
             }
             return disk;
         } catch (LibvirtException e) {
-            logger.debug("Failed to get physical disk:", e);
+            logger.debug("Failed to get volume from libvirt: " + e.getMessage());
             throw new CloudRuntimeException(e.toString());
         }
     }
@@ -722,7 +707,7 @@ private int adjustStoragePoolRefCount(String uuid, int adjustment) {
      * Thread-safe increment storage pool usage refcount
      * @param uuid UUID of the storage pool to increment the count
      */
-    private void incStoragePoolRefCount(String uuid) {
+    protected void incStoragePoolRefCount(String uuid) {
         adjustStoragePoolRefCount(uuid, 1);
     }
     /**
@@ -730,7 +715,7 @@ private void incStoragePoolRefCount(String uuid) {
      * @param uuid UUID of the storage pool to decrement the count
      * @return true if the storage pool is still used, else false.
      */
-    private boolean decStoragePoolRefCount(String uuid) {
+    protected boolean decStoragePoolRefCount(String uuid) {
         return adjustStoragePoolRefCount(uuid, -1) > 0;
     }
 
@@ -814,7 +799,7 @@ public KVMStoragePool createStoragePool(String name, String host, int port, Stri
                 try {
                     sp = createNetfsStoragePool(PoolType.NETFS, conn, name, host, path, nfsMountOpts);
                 } catch (LibvirtException e) {
-                    logger.error("Failed to create netfs mount: " + host + ":" + path , e);
+                    logger.error("Failed to create netfs mount: " + host + ":" + path, e);
                     logger.error(e.getStackTrace());
                     throw new CloudRuntimeException(e.toString());
                 }
@@ -822,7 +807,7 @@ public KVMStoragePool createStoragePool(String name, String host, int port, Stri
                 try {
                     sp = createNetfsStoragePool(PoolType.GLUSTERFS, conn, name, host, path, null);
                 } catch (LibvirtException e) {
-                    logger.error("Failed to create glusterfs mount: " + host + ":" + path , e);
+                    logger.error("Failed to create glusterlvm_fs mount: " + host + ":" + path, e);
                     logger.error(e.getStackTrace());
                     throw new CloudRuntimeException(e.toString());
                 }
@@ -830,8 +815,6 @@ public KVMStoragePool createStoragePool(String name, String host, int port, Stri
                 sp = createSharedStoragePool(conn, name, host, path);
             } else if (type == StoragePoolType.RBD) {
                 sp = createRBDStoragePool(conn, name, host, port, userInfo, path);
-            } else if (type == StoragePoolType.CLVM) {
-                sp = createCLVMStoragePool(conn, name, host, path);
             }
         }
 
@@ -845,7 +828,6 @@ public KVMStoragePool createStoragePool(String name, String host, int port, Stri
                 // to be always mounted, as long the primary storage isn't fully deleted.
                 incStoragePoolRefCount(name);
             }
-
             if (sp.isActive() == 0) {
                 logger.debug("Attempting to activate pool " + name);
                 sp.create(0);
@@ -1116,6 +1098,7 @@ private KVMPhysicalDisk createPhysicalDiskByQemuImg(String name, KVMStoragePool
     @Override
     public boolean connectPhysicalDisk(String name, KVMStoragePool pool, Map<String, String> details, boolean isVMMigrate) {
         // this is for managed storage that needs to prep disks prior to use
+
         return true;
     }
 
@@ -1227,7 +1210,11 @@ public boolean deletePhysicalDisk(String uuid, KVMStoragePool pool, Storage.Imag
         LibvirtStoragePool libvirtPool = (LibvirtStoragePool)pool;
         try {
             StorageVol vol = getVolume(libvirtPool.getPool(), uuid);
-            logger.debug("Instructing libvirt to remove volume " + uuid + " from pool " + pool.getUuid());
+            if (vol == null) {
+                logger.warn("Volume {} not found in libvirt pool {}, it may have been already deleted", uuid, pool.getUuid());
+                return true;
+            }
+            logger.debug("Instructing libvirt to remove volume {} from pool {}", uuid, pool.getUuid());
             if(Storage.ImageFormat.DIR.equals(format)){
                 deleteDirVol(libvirtPool, vol);
             } else {
@@ -1420,9 +1407,7 @@ private KVMPhysicalDisk createDiskFromTemplateOnRBD(KVMPhysicalDisk template,
                         rbd.close(destImage);
                     } else {
                         logger.debug("The source image " + srcPool.getSourceDir() + "/" + template.getName()
-                                + " is RBD format 2. We will perform a RBD clone using snapshot "
-                                + rbdTemplateSnapName);
-                        /* The source image is format 2, we can do a RBD snapshot+clone (layering) */
+                                + " is RBD format 2. We will perform a RBD snapshot+clone (layering)");
 
 
                         logger.debug("Checking if RBD snapshot " + srcPool.getSourceDir() + "/" + template.getName()
@@ -1618,9 +1603,12 @@ to support snapshots(backuped) as qcow2 files. */
                     } else {
                         destFile = new QemuImgFile(destPath, destFormat);
                         try {
-                            boolean isQCOW2 = PhysicalDiskFormat.QCOW2.equals(sourceFormat);
+                            boolean keepBitmaps = PhysicalDiskFormat.QCOW2.equals(sourceFormat);
+                            if (destPool.getType() == StoragePoolType.CLVM) {
+                                keepBitmaps = false;
+                            }
                             qemu.convert(srcFile, destFile, null, null, new QemuImageOptions(srcFile.getFormat(), srcFile.getFileName(), null),
-                                    null, false, isQCOW2);
+                                    null, false, keepBitmaps);
                             Map<String, String> destInfo = qemu.info(destFile);
                             Long virtualSize = Long.parseLong(destInfo.get(QemuImg.VIRTUAL_SIZE));
                             newDisk.setVirtualSize(virtualSize);
@@ -1684,8 +1672,8 @@ to support snapshots(backuped) as qcow2 files. */
             }
         } else {
             /**
-                We let Qemu-Img do the work here. Although we could work with librbd and have that do the cloning
-                it doesn't benefit us. It's better to keep the current code in place which works
+             We let Qemu-Img do the work here. Although we could work with librbd and have that do the cloning
+             it doesn't benefit us. It's better to keep the current code in place which works
              */
             srcFile = new QemuImgFile(KVMPhysicalDisk.RBDStringBuilder(srcPool, sourcePath));
             srcFile.setFormat(sourceFormat);
@@ -1737,6 +1725,7 @@ private void deleteVol(LibvirtStoragePool pool, StorageVol vol) throws LibvirtEx
         vol.delete(0);
     }
 
+
     private void deleteDirVol(LibvirtStoragePool pool, StorageVol vol) throws LibvirtException {
         Script.runSimpleBashScript("rm -r --interactive=never " + vol.getPath());
     }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
index 910f0eb15e0b..a8c32baa6ef3 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
@@ -213,7 +213,7 @@ public boolean refresh() {
 
     @Override
     public boolean isExternalSnapshot() {
-        if (this.type == StoragePoolType.CLVM || type == StoragePoolType.RBD) {
+        if (this.type == StoragePoolType.CLVM || this.type == StoragePoolType.CLVM_NG || type == StoragePoolType.RBD) {
             return true;
         }
         return false;
@@ -278,6 +278,10 @@ public StoragePoolType getType() {
         return this.type;
     }
 
+    public void setType(StoragePoolType type) {
+        this.type = type;
+    }
+
     public StoragePool getPool() {
         return this._pool;
     }
@@ -420,8 +424,4 @@ public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityS
             return true;
         }
     }
-
-    public void setType(StoragePoolType type) {
-        this.type = type;
-    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/StorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/StorageAdaptor.java
index 76b5a413e70f..fb474a6bc7d3 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/StorageAdaptor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/StorageAdaptor.java
@@ -148,4 +148,8 @@ default Ternary<Boolean, Map<String, String>, String> prepareStorageClient(Strin
     default Pair<Boolean, String> unprepareStorageClient(String uuid, Map<String, String> details) {
         return new Pair<>(true, "");
     }
+
+    default void createTemplate(String templatePath, String templateUuid, int timeout, KVMStoragePool pool) {
+        // no-op
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index b3bdafb73751..ce431d9bab26 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -2728,8 +2728,11 @@ public void testCreateStoragePoolCommand() {
 
     @Test
     public void testModifyStoragePoolCommand() {
-        final StoragePool pool = Mockito.mock(StoragePool.class);;
+        final StoragePool pool = Mockito.mock(StoragePool.class);
         final ModifyStoragePoolCommand command = new ModifyStoragePoolCommand(true, pool);
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+        command.setDetails(details);
 
         final KVMStoragePoolManager storagePoolMgr = Mockito.mock(KVMStoragePoolManager.class);
         final KVMStoragePool kvmStoragePool = Mockito.mock(KVMStoragePool.class);
@@ -2753,8 +2756,11 @@ public void testModifyStoragePoolCommand() {
 
     @Test
     public void testModifyStoragePoolCommandFailure() {
-        final StoragePool pool = Mockito.mock(StoragePool.class);;
+        final StoragePool pool = Mockito.mock(StoragePool.class);
         final ModifyStoragePoolCommand command = new ModifyStoragePoolCommand(true, pool);
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+        command.setDetails(details);
 
         final KVMStoragePoolManager storagePoolMgr = Mockito.mock(KVMStoragePoolManager.class);
 
@@ -7245,6 +7251,307 @@ public void getInterfaceTestInvalidMacAddressThrowCloudRuntimeException() {
         libvirtComputingResourceSpy.getInterface(connMock, vmName, invalidMacAddress);
     }
 
+    @Test
+    public void testExtractVolumeGroupFromPath_ValidPath() {
+        String devicePath = "/dev/vg1/volume-123";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg1", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_ComplexVGName() {
+        String devicePath = "/dev/cloudstack-vg-primary/volume-456";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("cloudstack-vg-primary", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_MultiLevelPath() {
+        String devicePath = "/dev/vg-cluster-01/lv-data-001";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg-cluster-01", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_NullPath() {
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(null);
+        assertNull(vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_EmptyPath() {
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath("");
+        assertNull(vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_NonDevPath() {
+        String devicePath = "/var/lib/libvirt/images/disk.qcow2";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertNull(vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_InvalidFormat() {
+        String devicePath = "/dev/";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertNull(vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_OnlyVG() {
+        String devicePath = "/dev/vg1";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        // Implementation extracts parts[2] regardless of whether there's an LV name
+        assertEquals("vg1", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_MapperPath() {
+        String devicePath = "/dev/mapper/vg1-volume";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("mapper", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_WithDashes() {
+        String devicePath = "/dev/vg-name-with-dashes/lv-name";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg-name-with-dashes", vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_WithUnderscores() {
+        String devicePath = "/dev/vg_name_with_underscores/lv_name";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg_name_with_underscores", vgName);
+    }
+
+    @Test
+    public void testCheckIfVolumeGroupIsClustered_NullVGName() {
+        boolean result = LibvirtComputingResource.checkIfVolumeGroupIsClustered(null);
+        assertFalse(result);
+    }
+
+    @Test
+    public void testCheckIfVolumeGroupIsClustered_EmptyVGName() {
+        boolean result = LibvirtComputingResource.checkIfVolumeGroupIsClustered("");
+        assertFalse(result);
+    }
+
+    @Test
+    public void testActivateClvmVolumeExclusive_ValidPath() {
+        try {
+            String volumePath = "/dev/test-vg/test-lv";
+            LibvirtComputingResource.activateClvmVolumeExclusive(volumePath);
+        } catch (Exception e) {
+            String message = e.getMessage().toLowerCase();
+            assertTrue("Should be LVM-related error",
+                message.contains("lvm") ||
+                message.contains("lvchange") ||
+                message.contains("volume") ||
+                message.contains("not found") ||
+                message.contains("failed"));
+        }
+    }
+
+    @Test
+    public void testDeactivateClvmVolume_ValidPath() {
+        String volumePath = "/dev/test-vg/test-lv";
+
+        LibvirtComputingResource.deactivateClvmVolume(volumePath);
+
+        assertTrue(true);
+    }
+
+    @Test
+    public void testSetClvmVolumeToSharedMode_ValidPath() {
+        String volumePath = "/dev/test-vg/test-lv";
+
+        LibvirtComputingResource.setClvmVolumeToSharedMode(volumePath);
+
+        assertTrue(true);
+    }
+
+    @Test
+    public void testDeactivateClvmVolume_NullPath() {
+        LibvirtComputingResource.deactivateClvmVolume(null);
+        assertTrue(true);
+    }
+
+    @Test
+    public void testSetClvmVolumeToSharedMode_NullPath() {
+        LibvirtComputingResource.setClvmVolumeToSharedMode(null);
+        assertTrue(true); // Passes if no exception
+    }
+
+    @Test
+    public void testDeactivateClvmVolume_EmptyPath() {
+        LibvirtComputingResource.deactivateClvmVolume("");
+        assertTrue(true);
+    }
+
+    @Test
+    public void testSetClvmVolumeToSharedMode_EmptyPath() {
+        LibvirtComputingResource.setClvmVolumeToSharedMode("");
+        assertTrue(true);
+    }
+
+    @Test
+    public void testDeactivateClvmVolume_InvalidPath() {
+        String invalidPath = "/invalid/path/that/does/not/exist";
+        LibvirtComputingResource.deactivateClvmVolume(invalidPath);
+        assertTrue(true);
+    }
+
+    @Test
+    public void testSetClvmVolumeToSharedMode_InvalidPath() {
+        // Should handle invalid path gracefully without throwing
+        String invalidPath = "/invalid/path/that/does/not/exist";
+        LibvirtComputingResource.setClvmVolumeToSharedMode(invalidPath);
+        assertTrue(true); // Passes if no exception
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_RealWorldPaths() {
+        assertEquals("acsvg", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/acsvg/volume-123"));
+        assertEquals("cloudstack-primary", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/cloudstack-primary/vm-disk-1"));
+        assertEquals("ceph-vg", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/ceph-vg/snapshot-456"));
+        assertEquals("vg01", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/vg01/data"));
+    }
+
+    @Test
+    public void testCheckIfVolumeGroupIsClustered_NonExistentVG() {
+        String nonExistentVG = "non-existent-vg-" + System.currentTimeMillis();
+        boolean result = LibvirtComputingResource.checkIfVolumeGroupIsClustered(nonExistentVG);
+        assertFalse(result);
+    }
+
+    @Test
+    public void testActivateClvmVolumeExclusive_ComplexPath() {
+        try {
+            String complexPath = "/dev/cloudstack-vg-primary-cluster-01/volume-123-456-789-abc";
+            LibvirtComputingResource.activateClvmVolumeExclusive(complexPath);
+        } catch (Exception e) {
+            String message = e.getMessage().toLowerCase();
+            assertTrue("Should be LVM-related error",
+                message.contains("lvm") ||
+                message.contains("lvchange") ||
+                message.contains("volume") ||
+                message.contains("not found") ||
+                message.contains("failed"));
+        }
+    }
+
+    @Test
+    public void testDeactivateClvmVolume_ComplexPath() {
+        String complexPath = "/dev/cloudstack-vg-primary-cluster-01/volume-123-456-789-abc";
+        LibvirtComputingResource.deactivateClvmVolume(complexPath);
+        assertTrue(true);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_SpecialCharacters() {
+        assertEquals("vg.name", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/vg.name/lv"));
+        assertEquals("vg_name", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/vg_name/lv"));
+        assertEquals("vg-name", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/vg-name/lv"));
+        assertEquals("vg123", LibvirtComputingResource.extractVolumeGroupFromPath("/dev/vg123/lv456"));
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_TrailingSlash() {
+        String devicePath = "/dev/vg1/volume-123/";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg1", vgName);
+    }
+
+    @Test
+    public void testCheckIfVolumeGroupIsClustered_WhitespaceVGName() {
+        boolean result = LibvirtComputingResource.checkIfVolumeGroupIsClustered("   ");
+        assertFalse(result);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_DevMapperExcluded() {
+        String mapperPath1 = "/dev/mapper/vg1-lv1";
+        String mapperPath2 = "/dev/mapper/cloudstack--vg-volume--1";
+
+        assertEquals("mapper", LibvirtComputingResource.extractVolumeGroupFromPath(mapperPath1));
+        assertEquals("mapper", LibvirtComputingResource.extractVolumeGroupFromPath(mapperPath2));
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_EdgeCases() {
+        assertNull(LibvirtComputingResource.extractVolumeGroupFromPath("/dev"));
+        assertNull(LibvirtComputingResource.extractVolumeGroupFromPath("/dev/"));
+        assertNull(LibvirtComputingResource.extractVolumeGroupFromPath("dev/vg/lv"));
+        assertNull(LibvirtComputingResource.extractVolumeGroupFromPath("//dev//vg//lv"));
+    }
+
+    @Test
+    public void testClvmVolumeActivationSequence() {
+        // Test a typical sequence: deactivate -> activate exclusive -> deactivate -> shared
+        String volumePath = "/dev/test-vg/test-volume";
+
+        LibvirtComputingResource.deactivateClvmVolume(volumePath);
+
+        try {
+            LibvirtComputingResource.activateClvmVolumeExclusive(volumePath);
+        } catch (Exception e) {
+            // Expected in test environment
+        }
+
+        LibvirtComputingResource.deactivateClvmVolume(volumePath);
+        LibvirtComputingResource.setClvmVolumeToSharedMode(volumePath);
+
+        assertTrue(true); // Test passes if sequence completes
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_LongVGName() {
+        String longVGName = "a".repeat(100);
+        String devicePath = "/dev/" + longVGName + "/volume";
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals(longVGName, vgName);
+    }
+
+    @Test
+    public void testExtractVolumeGroupFromPath_LongLVName() {
+        String longLVName = "volume-" + "b".repeat(100);
+        String devicePath = "/dev/vg1/" + longLVName;
+        String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(devicePath);
+        assertEquals("vg1", vgName);
+    }
+
+    @Test
+    public void testCheckIfVolumeGroupIsClustered_SpecialCharactersInName() {
+        assertFalse(LibvirtComputingResource.checkIfVolumeGroupIsClustered("vg.test.name"));
+        assertFalse(LibvirtComputingResource.checkIfVolumeGroupIsClustered("vg_test_name"));
+        assertFalse(LibvirtComputingResource.checkIfVolumeGroupIsClustered("vg-test-name"));
+    }
+
+    @Test
+    public void testClvmMethodsWithMultiplePaths() {
+        String[] paths = {
+                "/dev/vg1/vol1",
+                "/dev/vg2/vol2",
+                "/dev/cloudstack-primary/vol3",
+                "/dev/test-vg/test-vol"
+        };
+
+        for (String path : paths) {
+            LibvirtComputingResource.deactivateClvmVolume(path);
+            LibvirtComputingResource.setClvmVolumeToSharedMode(path);
+
+            String vgName = LibvirtComputingResource.extractVolumeGroupFromPath(path);
+            assertNotNull("Should extract VG from: " + path, vgName);
+
+            boolean clustered = LibvirtComputingResource.checkIfVolumeGroupIsClustered(vgName);
+        }
+
+        assertTrue(true); // Passes if all paths processed
+    }
+
     @Test
     public void updateCpuQuotaAndPeriodTestAssertPeriodAndQuotaAreNotUpdatedWhenLibvirtVersionIsLessThanTheMinimum() throws LibvirtException {
         libvirtComputingResourceSpy.hypervisorLibvirtVersion = 8999;
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapperTest.java
new file mode 100644
index 000000000000..5d11cf209a45
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtClvmLockTransferCommandWrapperTest.java
@@ -0,0 +1,462 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+/**
+ * Tests for LibvirtClvmLockTransferCommandWrapper
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtClvmLockTransferCommandWrapperTest {
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+
+    private LibvirtClvmLockTransferCommandWrapper wrapper;
+
+    private static final String TEST_LV_PATH = "/dev/vg1/volume-123";
+    private static final String TEST_VOLUME_UUID = "test-volume-uuid-456";
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtClvmLockTransferCommandWrapper();
+    }
+
+    @Test
+    public void testExecute_DeactivateSuccess() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null); // Success
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertTrue(answer.getResult());
+            assertTrue(answer.getDetails().contains("deactivated"));
+            assertTrue(answer.getDetails().contains(TEST_VOLUME_UUID));
+
+            // Verify script was constructed with correct parameters
+            assertEquals(1, scriptMock.constructed().size());
+            Script script = scriptMock.constructed().get(0);
+            verify(script).add("-an");
+            verify(script).add(TEST_LV_PATH);
+        }
+    }
+
+    @Test
+    public void testExecute_ActivateExclusiveSuccess() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null); // Success
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertTrue(answer.getResult());
+            assertTrue(answer.getDetails().contains("activated exclusively"));
+            assertTrue(answer.getDetails().contains(TEST_VOLUME_UUID));
+
+            // Verify script was constructed with correct parameters
+            assertEquals(1, scriptMock.constructed().size());
+            Script script = scriptMock.constructed().get(0);
+            verify(script).add("-aey");
+            verify(script).add(TEST_LV_PATH);
+        }
+    }
+
+    @Test
+    public void testExecute_ActivateSharedSuccess() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_SHARED,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null); // Success
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertTrue(answer.getResult());
+            assertTrue(answer.getDetails().contains("activated in shared mode"));
+            assertTrue(answer.getDetails().contains(TEST_VOLUME_UUID));
+
+            // Verify script was constructed with correct parameters
+            assertEquals(1, scriptMock.constructed().size());
+            Script script = scriptMock.constructed().get(0);
+            verify(script).add("-asy");
+            verify(script).add(TEST_LV_PATH);
+        }
+    }
+
+    @Test
+    public void testExecute_LvchangeFailure() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        String errorMessage = "lvchange: Volume is in use";
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(errorMessage);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains("lvchange -an"));
+            assertTrue(answer.getDetails().contains(TEST_LV_PATH));
+            assertTrue(answer.getDetails().contains(errorMessage));
+        }
+    }
+
+    @Test
+    public void testExecute_ScriptTimeout() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        String timeoutMessage = "Script timed out after 30000ms";
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(timeoutMessage);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains("failed"));
+            assertTrue(answer.getDetails().contains(timeoutMessage));
+        }
+    }
+
+    @Test
+    public void testExecute_NullLvPath() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                null,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            // Should still execute, but may fail or succeed depending on lvchange behavior
+            // At minimum, it should handle null gracefully
+            assertEquals(1, scriptMock.constructed().size());
+        }
+    }
+
+    @Test
+    public void testExecute_EmptyLvPath() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                "",
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn("lvchange: Please specify a logical volume path");
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains("failed"));
+        }
+    }
+
+    @Test
+    public void testExecute_InvalidLvPath() {
+        String invalidPath = "/invalid/path/that/does/not/exist";
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                invalidPath,
+                TEST_VOLUME_UUID
+        );
+
+        String errorMessage = "Failed to find logical volume \"" + invalidPath + "\"";
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(errorMessage);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains("failed"));
+            assertTrue(answer.getDetails().contains(errorMessage));
+        }
+    }
+
+    @Test
+    public void testExecute_ExceptionDuringExecution() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        RuntimeException testException = new RuntimeException("Test exception");
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenThrow(testException);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains("Exception"));
+            assertTrue(answer.getDetails().contains("Test exception"));
+        }
+    }
+
+    @Test
+    public void testExecute_VerifyScriptConstruction() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    // Just set up the mock behavior - don't assert here as it can interfere
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            // Verify the answer is successful
+            assertNotNull("Answer should not be null", answer);
+            assertTrue("Answer should indicate success. Details: " + answer.getDetails(),
+                      answer.getResult());
+
+            // Verify that Script was constructed exactly once
+            assertEquals("Script should be constructed once", 1, scriptMock.constructed().size());
+        }
+    }
+
+    @Test
+    public void testExecute_AllOperationsUseDifferentFlags() {
+        // Test that each operation uses the correct lvchange flag
+
+        // DEACTIVATE -> -an
+        ClvmLockTransferCommand deactivateCmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            wrapper.execute(deactivateCmd, libvirtComputingResource);
+            verify(scriptMock.constructed().get(0)).add("-an");
+        }
+
+        // ACTIVATE_EXCLUSIVE -> -aey
+        ClvmLockTransferCommand exclusiveCmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            wrapper.execute(exclusiveCmd, libvirtComputingResource);
+            verify(scriptMock.constructed().get(0)).add("-aey");
+        }
+
+        // ACTIVATE_SHARED -> -asy
+        ClvmLockTransferCommand sharedCmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_SHARED,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            wrapper.execute(sharedCmd, libvirtComputingResource);
+            verify(scriptMock.constructed().get(0)).add("-asy");
+        }
+    }
+
+    @Test
+    public void testExecute_LvchangeVolumeInUseError() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.DEACTIVATE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        String errorMessage = "Can't deactivate volume group with active logical volumes";
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(errorMessage);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains(errorMessage));
+        }
+    }
+
+    @Test
+    public void testExecute_LvchangePermissionDenied() {
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                TEST_LV_PATH,
+                TEST_VOLUME_UUID
+        );
+
+        String errorMessage = "Permission denied";
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(errorMessage);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertFalse(answer.getResult());
+            assertTrue(answer.getDetails().contains(errorMessage));
+        }
+    }
+
+    @Test
+    public void testExecute_ComplexLvPath() {
+        String complexPath = "/dev/cloudstack-vg-primary/volume-123-456-789-abc-def";
+        ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                complexPath,
+                TEST_VOLUME_UUID
+        );
+
+        try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                (mock, context) -> {
+                    when(mock.execute()).thenReturn(null);
+                })) {
+
+            Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+            assertNotNull(answer);
+            assertTrue(answer.getResult());
+
+            // Verify the complex path was passed correctly
+            Script script = scriptMock.constructed().get(0);
+            verify(script).add(complexPath);
+        }
+    }
+
+    @Test
+    public void testExecute_SequentialOperations() {
+        // Test that multiple operations can be executed sequentially
+        String[] paths = {
+            "/dev/vg1/vol1",
+            "/dev/vg1/vol2",
+            "/dev/vg2/vol3"
+        };
+
+        for (String path : paths) {
+            ClvmLockTransferCommand cmd = new ClvmLockTransferCommand(
+                    ClvmLockTransferCommand.Operation.DEACTIVATE,
+                    path,
+                    "uuid-" + path.hashCode()
+            );
+
+            try (MockedConstruction<Script> scriptMock = Mockito.mockConstruction(Script.class,
+                    (mock, context) -> {
+                        when(mock.execute()).thenReturn(null);
+                    })) {
+
+                Answer answer = wrapper.execute(cmd, libvirtComputingResource);
+
+                assertNotNull(answer);
+                assertTrue(answer.getResult());
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java
new file mode 100644
index 000000000000..8782f592aed3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.mockito.ArgumentMatchers.anyMap;
+import static org.mockito.ArgumentMatchers.eq;
+
+import org.apache.cloudstack.backup.CreateImageTransferAnswer;
+import org.apache.cloudstack.backup.CreateImageTransferCommand;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtCreateImageTransferCommandWrapperTest {
+
+    private LibvirtCreateImageTransferCommandWrapper wrapper;
+    private CreateImageTransferCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtCreateImageTransferCommandWrapper();
+        command = Mockito.mock(CreateImageTransferCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteBlankTransferIdReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("transferId is empty.", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteNbdBackendSuccessReturnsUrl() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-1");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+        Mockito.when(command.getIdleTimeoutSeconds()).thenReturn(120);
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+        Mockito.when(command.getExportName()).thenReturn("vol-1");
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-1");
+
+        Mockito.when(resource.getImageServerPath()).thenReturn("/opt/cloudstack/image/server.py");
+        Mockito.when(resource.getImageServerListenAddress()).thenReturn("");
+        Mockito.when(resource.getPrivateIp()).thenReturn("10.0.0.10");
+        Mockito.when(resource.isImageServerTlsEnabled()).thenReturn(false);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(ImageServerControlSocket::isReady).thenReturn(true);
+            imageServerControlMock.when(() -> ImageServerControlSocket.registerTransfer(eq("tr-1"), anyMap())).thenReturn(true);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof CreateImageTransferAnswer);
+            CreateImageTransferAnswer transferAnswer = (CreateImageTransferAnswer) answer;
+            Assert.assertEquals("tr-1", transferAnswer.getImageTransferId());
+            Assert.assertEquals(
+                    "http://10.0.0.10:" + LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT + "/images/tr-1",
+                    transferAnswer.getTransferUrl());
+        }
+    }
+
+    @Test
+    public void testExecuteRegisterTransferFailureReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-2");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+        Mockito.when(command.getIdleTimeoutSeconds()).thenReturn(120);
+        Mockito.when(command.getSocket()).thenReturn("sock-2");
+        Mockito.when(command.getExportName()).thenReturn("vol-2");
+        Mockito.when(command.getCheckpointId()).thenReturn(null);
+
+        Mockito.when(resource.getImageServerPath()).thenReturn("/opt/cloudstack/image/server.py");
+        Mockito.when(resource.getImageServerListenAddress()).thenReturn("192.168.10.10");
+        Mockito.when(resource.isImageServerTlsEnabled()).thenReturn(true);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(ImageServerControlSocket::isReady).thenReturn(true);
+            imageServerControlMock.when(() -> ImageServerControlSocket.registerTransfer(eq("tr-2"), anyMap())).thenReturn(false);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertEquals("Failed to register transfer with image server.", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java
new file mode 100644
index 000000000000..769fdc9aa7b6
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Collections;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.DeleteVmCheckpointCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtDeleteVmCheckpointCommandWrapperTest {
+
+    private LibvirtDeleteVmCheckpointCommandWrapper wrapper;
+    private DeleteVmCheckpointCommand command;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtDeleteVmCheckpointCommandWrapper();
+        command = Mockito.mock(DeleteVmCheckpointCommand.class);
+    }
+
+    @Test
+    public void testExecuteStoppedVmWithoutDisksReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-1");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Collections.emptyMap());
+
+        Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("No disks provided for bitmap removal", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapRemovalFailureReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("bitmap remove error"))) {
+            Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to remove bitmap cp-2"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmDeleteCheckpointSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-3");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Checkpoint deleted", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java
new file mode 100644
index 000000000000..df6e21bdd6e1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.FinalizeImageTransferCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtFinalizeImageTransferCommandWrapperTest {
+
+    private LibvirtFinalizeImageTransferCommandWrapper wrapper;
+    private FinalizeImageTransferCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtFinalizeImageTransferCommandWrapper();
+        command = Mockito.mock(FinalizeImageTransferCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteBlankTransferIdReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("transferId is empty.", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteWithActiveTransfersReturnsSuccessWithoutStoppingServer() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-1");
+
+        try (MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(() -> ImageServerControlSocket.unregisterTransfer("tr-1")).thenReturn(2);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Image transfer finalized.", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteServerUnreachableReturnsSuccessAndForcesStop() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-2");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("inactive"));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(() -> ImageServerControlSocket.unregisterTransfer("tr-2")).thenReturn(-1);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Image transfer finalized (server unreachable, forced stop).", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapperTest.java
new file mode 100644
index 000000000000..8acc8cf20dd7
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtModifyStoragePoolCommandWrapperTest.java
@@ -0,0 +1,341 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyMap;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.ModifyStoragePoolAnswer;
+import com.cloud.agent.api.ModifyStoragePoolCommand;
+import com.cloud.agent.api.to.StorageFilerTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage.StoragePoolType;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtModifyStoragePoolCommandWrapperTest {
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+
+    @Mock
+    private ModifyStoragePoolCommand command;
+
+    @Mock
+    private StorageFilerTO storageFilerTO;
+
+    @Mock
+    private KVMStoragePool storagePool;
+
+    private LibvirtModifyStoragePoolCommandWrapper wrapper;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtModifyStoragePoolCommandWrapper();
+        when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+    }
+
+    @Test
+    public void testAddClvmStoragePoolWithoutDetails() {
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("192.168.1.100");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/vg0");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM);
+
+        when(storagePool.getCapacity()).thenReturn(1000000L);
+        when(storagePool.getAvailable()).thenReturn(500000L);
+        when(storagePool.getDetails()).thenReturn(new HashMap<>());
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM), anyMap()))
+            .thenReturn(storagePool);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success. Details: " + answer.getDetails(), answer.getResult());
+        assertTrue("Answer should be ModifyStoragePoolAnswer", answer instanceof ModifyStoragePoolAnswer);
+
+        // Verify the details were passed correctly
+        ArgumentCaptor<Map<String, String>> detailsCaptor = ArgumentCaptor.forClass(Map.class);
+        verify(storagePoolManager).createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM), detailsCaptor.capture());
+
+        Map<String, String> capturedDetails = detailsCaptor.getValue();
+        assertNotNull("Details should not be null", capturedDetails);
+        assertEquals("CLVM_SECURE_ZERO_FILL should default to false",
+                "false", capturedDetails.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL));
+    }
+
+    @Test
+    public void testAddClvmNgStoragePoolWithEmptyDetails() {
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(new HashMap<>());
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("192.168.1.100");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/vg0");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM_NG);
+
+        when(storagePool.getCapacity()).thenReturn(2000000L);
+        when(storagePool.getAvailable()).thenReturn(1000000L);
+        when(storagePool.getDetails()).thenReturn(new HashMap<>());
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM_NG), anyMap()))
+            .thenReturn(storagePool);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+
+        ArgumentCaptor<Map<String, String>> detailsCaptor = ArgumentCaptor.forClass(Map.class);
+        verify(storagePoolManager).createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM_NG), detailsCaptor.capture());
+
+        Map<String, String> capturedDetails = detailsCaptor.getValue();
+        assertNotNull("Details should not be null", capturedDetails);
+        assertEquals("CLVM_SECURE_ZERO_FILL should default to false",
+                "false", capturedDetails.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL));
+    }
+
+    @Test
+    public void testAddClvmStoragePoolWithExistingSecureZeroFillSetting() {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "true");
+        details.put("someOtherKey", "someValue");
+
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(details);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("192.168.1.100");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/vg0");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM);
+
+        when(storagePool.getCapacity()).thenReturn(1000000L);
+        when(storagePool.getAvailable()).thenReturn(500000L);
+        when(storagePool.getDetails()).thenReturn(new HashMap<>());
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM), anyMap()))
+            .thenReturn(storagePool);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+
+        ArgumentCaptor<Map<String, String>> detailsCaptor = ArgumentCaptor.forClass(Map.class);
+        verify(storagePoolManager).createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM), detailsCaptor.capture());
+
+        Map<String, String> capturedDetails = detailsCaptor.getValue();
+        assertNotNull("Details should not be null", capturedDetails);
+        assertEquals("CLVM_SECURE_ZERO_FILL should preserve existing value",
+                "true", capturedDetails.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL));
+        assertEquals("Other details should be preserved",
+                "someValue", capturedDetails.get("someOtherKey"));
+    }
+
+    @Test
+    public void testAddClvmStoragePoolPreservesOtherDetailsWhenAddingDefault() {
+        Map<String, String> details = new HashMap<>();
+        details.put("customKey1", "value1");
+        details.put("customKey2", "value2");
+
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(details);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("192.168.1.100");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/vg0");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM_NG);
+
+        when(storagePool.getCapacity()).thenReturn(1000000L);
+        when(storagePool.getAvailable()).thenReturn(500000L);
+        when(storagePool.getDetails()).thenReturn(new HashMap<>());
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM_NG), anyMap()))
+            .thenReturn(storagePool);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+
+        ArgumentCaptor<Map<String, String>> detailsCaptor = ArgumentCaptor.forClass(Map.class);
+        verify(storagePoolManager).createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM_NG), detailsCaptor.capture());
+
+        Map<String, String> capturedDetails = detailsCaptor.getValue();
+        assertNotNull("Details should not be null", capturedDetails);
+        assertEquals("CLVM_SECURE_ZERO_FILL should default to false",
+                "false", capturedDetails.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL));
+        assertEquals("Custom details should be preserved",
+                "value1", capturedDetails.get("customKey1"));
+        assertEquals("Custom details should be preserved",
+                "value2", capturedDetails.get("customKey2"));
+    }
+
+    @Test
+    public void testDeleteClvmStoragePoolSuccess() {
+        when(command.getAdd()).thenReturn(false);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM);
+
+        when(storagePoolManager.deleteStoragePool(StoragePoolType.CLVM, "pool-uuid", null))
+            .thenReturn(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+        verify(storagePoolManager).deleteStoragePool(StoragePoolType.CLVM, "pool-uuid", null);
+    }
+
+    @Test
+    public void testDeleteClvmNgStoragePoolSuccess() {
+        when(command.getAdd()).thenReturn(false);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM_NG);
+
+        when(storagePoolManager.deleteStoragePool(StoragePoolType.CLVM_NG, "pool-uuid", null))
+            .thenReturn(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+        verify(storagePoolManager).deleteStoragePool(StoragePoolType.CLVM_NG, "pool-uuid", null);
+    }
+
+    @Test
+    public void testDeleteClvmStoragePoolFailure() {
+        when(command.getAdd()).thenReturn(false);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM);
+
+        when(storagePoolManager.deleteStoragePool(StoragePoolType.CLVM, "pool-uuid", null))
+            .thenReturn(false);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse("Answer should indicate failure", answer.getResult());
+        assertEquals("Failed to delete storage pool", answer.getDetails());
+    }
+
+    @Test
+    public void testAddClvmStoragePoolCreationFailure() {
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("192.168.1.100");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/vg0");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.CLVM);
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("192.168.1.100"), eq(0),
+                eq("/vg0"), eq(null), eq(StoragePoolType.CLVM), anyMap()))
+            .thenReturn(null);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse("Answer should indicate failure", answer.getResult());
+        assertEquals(" Failed to create storage pool", answer.getDetails());
+    }
+
+    @Test
+    public void testAddNfsStoragePoolDoesNotSetClvmSecureZeroFill() {
+        when(command.getAdd()).thenReturn(true);
+        when(command.getPool()).thenReturn(storageFilerTO);
+        when(command.getDetails()).thenReturn(null);
+
+        when(storageFilerTO.getUuid()).thenReturn("pool-uuid");
+        when(storageFilerTO.getHost()).thenReturn("nfs.server.com");
+        when(storageFilerTO.getPort()).thenReturn(0);
+        when(storageFilerTO.getPath()).thenReturn("/export/nfs");
+        when(storageFilerTO.getUserInfo()).thenReturn(null);
+        when(storageFilerTO.getType()).thenReturn(StoragePoolType.NetworkFilesystem);
+
+        when(storagePool.getCapacity()).thenReturn(1000000L);
+        when(storagePool.getAvailable()).thenReturn(500000L);
+        when(storagePool.getDetails()).thenReturn(new HashMap<>());
+
+        when(storagePoolManager.createStoragePool(eq("pool-uuid"), eq("nfs.server.com"), eq(0),
+                eq("/export/nfs"), eq(null), eq(StoragePoolType.NetworkFilesystem), anyMap()))
+            .thenReturn(storagePool);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue("Answer should indicate success", answer.getResult());
+
+        ArgumentCaptor<Map<String, String>> detailsCaptor = ArgumentCaptor.forClass(Map.class);
+        verify(storagePoolManager).createStoragePool(eq("pool-uuid"), eq("nfs.server.com"), eq(0),
+                eq("/export/nfs"), eq(null), eq(StoragePoolType.NetworkFilesystem), detailsCaptor.capture());
+
+        Map<String, String> capturedDetails = detailsCaptor.getValue();
+        assertNotNull("Details should not be null", capturedDetails);
+        assertEquals("CLVM_SECURE_ZERO_FILL gets added for all pools",
+                "false", capturedDetails.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL));
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapperTest.java
new file mode 100644
index 000000000000..f844711399fe
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPostMigrationCommandWrapperTest.java
@@ -0,0 +1,363 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.PostMigrationAnswer;
+import com.cloud.agent.api.PostMigrationCommand;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.DiskDef;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.LibvirtException;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.when;
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtPostMigrationCommandWrapperTest {
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+
+    @Mock
+    private PostMigrationCommand postMigrationCommand;
+
+    @Mock
+    private VirtualMachineTO virtualMachineTO;
+
+    @Mock
+    private Connect connect;
+
+    private LibvirtPostMigrationCommandWrapper wrapper;
+
+    private static final String VM_NAME = "test-vm";
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtPostMigrationCommandWrapper();
+        when(postMigrationCommand.getVmName()).thenReturn(VM_NAME);
+        when(postMigrationCommand.getVirtualMachine()).thenReturn(virtualMachineTO);
+    }
+
+    @Test
+    public void testExecute_NoClvmVolumes_Success() throws LibvirtException {
+        List<DiskDef> disks = createNonClvmDisks();
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class)) {
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof PostMigrationAnswer);
+        }
+    }
+
+    @Test
+    public void testExecute_ClvmVolumes_ConvertedToExclusiveMode() throws LibvirtException {
+        List<DiskDef> disks = createClvmDisks();
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class);
+             MockedStatic<LibvirtComputingResource> mockedResource = Mockito.mockStatic(LibvirtComputingResource.class)) {
+
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            mockedResource.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedResource.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_ClvmNgVolumes_ConvertedToExclusiveMode() throws LibvirtException {
+        List<DiskDef> disks = createClvmNgDisks();
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class);
+             MockedStatic<LibvirtComputingResource> mockedResource = Mockito.mockStatic(LibvirtComputingResource.class)) {
+
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            mockedResource.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedResource.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_MixedVolumes_OnlyClvmConverted() throws LibvirtException {
+        List<DiskDef> disks = createMixedDisks();
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class);
+             MockedStatic<LibvirtComputingResource> mockedResource = Mockito.mockStatic(LibvirtComputingResource.class)) {
+
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            mockedResource.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedResource.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_LibvirtException_ReturnsFailure() throws LibvirtException {
+        LibvirtException libvirtException = Mockito.mock(LibvirtException.class);
+        when(libvirtException.getMessage()).thenReturn("Connection failed");
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class)) {
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME))
+                    .thenThrow(libvirtException);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Connection failed"));
+        }
+    }
+
+    @Test
+    public void testExecute_RuntimeException_ReturnsFailure() throws LibvirtException {
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class)) {
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME))
+                    .thenThrow(new RuntimeException("Unexpected error"));
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Unexpected error"));
+        }
+    }
+
+    @Test
+    public void testExecute_NullVmName_ReturnsFailure() {
+        when(postMigrationCommand.getVmName()).thenReturn(null);
+
+        Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("VM or VM name is null"));
+    }
+
+    @Test
+    public void testExecute_NullVirtualMachine_ReturnsFailure() {
+        when(postMigrationCommand.getVirtualMachine()).thenReturn(null);
+
+        Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("VM or VM name is null"));
+    }
+
+    @Test
+    public void testExecute_EmptyDiskList_Success() throws LibvirtException {
+        List<DiskDef> disks = new ArrayList<>();
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class)) {
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+        }
+    }
+
+    @Test
+    public void testExecute_MultipleClvmVolumes_AllConverted() throws LibvirtException {
+        List<DiskDef> disks = new ArrayList<>();
+        for (int i = 0; i < 5; i++) {
+            DiskDef disk = Mockito.mock(DiskDef.class);
+            Mockito.lenient().when(disk.getDiskPath()).thenReturn("/dev/clvm-vg/volume" + i);
+            disks.add(disk);
+        }
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class);
+             MockedStatic<LibvirtComputingResource> mockedResource = Mockito.mockStatic(LibvirtComputingResource.class)) {
+
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            mockedResource.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedResource.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_ClvmAndClvmNgMixed_BothConverted() throws LibvirtException {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef clvmDisk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmDisk1.getDiskPath()).thenReturn("/dev/clvm-vg/volume1");
+        disks.add(clvmDisk1);
+
+        DiskDef clvmNgDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmNgDisk.getDiskPath()).thenReturn("/dev/clvmng-vg/volume2");
+        disks.add(clvmNgDisk);
+
+        DiskDef clvmDisk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmDisk2.getDiskPath()).thenReturn("/dev/clvm-vg/volume3");
+        disks.add(clvmDisk2);
+
+        try (MockedStatic<LibvirtConnection> mockedConnection = Mockito.mockStatic(LibvirtConnection.class);
+             MockedStatic<LibvirtComputingResource> mockedResource = Mockito.mockStatic(LibvirtComputingResource.class)) {
+
+            mockedConnection.when(() -> LibvirtConnection.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+            when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+            mockedResource.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(postMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedResource.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.EXCLUSIVE)
+            ), times(1));
+        }
+    }
+
+    private List<DiskDef> createNonClvmDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/mnt/nfs/volume1.qcow2");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/mnt/nfs/volume2.qcow2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createClvmDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/dev/clvm-vg/volume1");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/dev/clvm-vg/volume2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createClvmNgDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/dev/clvmng-vg/volume1");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/dev/clvmng-vg/volume2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createMixedDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef clvmDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmDisk.getDiskPath()).thenReturn("/dev/clvm-vg/volume1");
+        disks.add(clvmDisk);
+
+        DiskDef nfsDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(nfsDisk.getDiskPath()).thenReturn("/mnt/nfs/volume2.qcow2");
+        disks.add(nfsDisk);
+
+        DiskDef clvmNgDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmNgDisk.getDiskPath()).thenReturn("/dev/clvmng-vg/volume3");
+        disks.add(clvmNgDisk);
+
+        return disks;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapperTest.java
new file mode 100644
index 000000000000..39eaeb71a6cb
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPreMigrationCommandWrapperTest.java
@@ -0,0 +1,282 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.PreMigrationCommand;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.DiskDef;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtPreMigrationCommandWrapperTest {
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+
+    @Mock
+    private PreMigrationCommand preMigrationCommand;
+
+    @Mock
+    private VirtualMachineTO virtualMachineTO;
+
+    @Mock
+    private Connect connect;
+
+    @Mock
+    private Domain domain;
+
+    @Mock
+    private LibvirtUtilitiesHelper libvirtUtilitiesHelper;
+
+    private LibvirtPreMigrationCommandWrapper wrapper;
+
+    private static final String VM_NAME = "test-vm";
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtPreMigrationCommandWrapper();
+        when(preMigrationCommand.getVmName()).thenReturn(VM_NAME);
+        when(preMigrationCommand.getVirtualMachine()).thenReturn(virtualMachineTO);
+        when(libvirtComputingResource.getLibvirtUtilitiesHelper()).thenReturn(libvirtUtilitiesHelper);
+    }
+
+    @Test
+    public void testExecute_NoClvmVolumes_Success() throws LibvirtException {
+        List<DiskDef> disks = createNonClvmDisks();
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+        Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertEquals("Source host prepared for migration", answer.getDetails());
+        verify(domain, times(1)).free();
+    }
+
+    @Test
+    public void testExecute_ClvmVolumes_ConvertedToSharedMode() throws LibvirtException {
+        List<DiskDef> disks = createClvmDisks();
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+        try (MockedStatic<LibvirtComputingResource> mockedStatic = Mockito.mockStatic(LibvirtComputingResource.class)) {
+            mockedStatic.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.SHARED)
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedStatic.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.SHARED)
+            ), times(1));
+            verify(domain, times(1)).free();
+        }
+    }
+
+    @Test
+    public void testExecute_ClvmNgVolumes_ConvertedToSharedMode() throws LibvirtException {
+        List<DiskDef> disks = createClvmNgDisks();
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+        try (MockedStatic<LibvirtComputingResource> mockedStatic = Mockito.mockStatic(LibvirtComputingResource.class)) {
+            mockedStatic.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedStatic.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.SHARED)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_MixedVolumes_OnlyClvmConverted() throws LibvirtException {
+        List<DiskDef> disks = createMixedDisks();
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+        try (MockedStatic<LibvirtComputingResource> mockedStatic = Mockito.mockStatic(LibvirtComputingResource.class)) {
+            mockedStatic.when(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    any(),
+                    any(),
+                    any()
+            )).then(invocation -> null);
+
+            Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+            Assert.assertTrue(answer.getResult());
+            mockedStatic.verify(() -> LibvirtComputingResource.modifyClvmVolumesStateForMigration(
+                    eq(disks),
+                    eq(virtualMachineTO),
+                    eq(LibvirtComputingResource.ClvmVolumeState.SHARED)
+            ), times(1));
+        }
+    }
+
+    @Test
+    public void testExecute_LibvirtException_ReturnsFailure() throws LibvirtException {
+        LibvirtException libvirtException = Mockito.mock(LibvirtException.class);
+        when(libvirtException.getMessage()).thenReturn("Connection failed");
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenThrow(libvirtException);
+
+        Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Failed to prepare source host"));
+        Assert.assertTrue(answer.getDetails().contains("Connection failed"));
+    }
+
+    @Test
+    public void testExecute_DomainFreeFails_StillReturnsSuccess() throws LibvirtException {
+        List<DiskDef> disks = createNonClvmDisks();
+        LibvirtException libvirtException = Mockito.mock(LibvirtException.class);
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+        Mockito.doThrow(libvirtException).when(domain).free();
+
+        Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void testExecute_NullVmName_ReturnsFailure() throws LibvirtException {
+        LibvirtException libvirtException = Mockito.mock(LibvirtException.class);
+        when(preMigrationCommand.getVmName()).thenReturn(null);
+        when(libvirtUtilitiesHelper.getConnectionByVmName(null)).thenThrow(libvirtException);
+
+        Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void testExecute_EmptyDiskList_Success() throws LibvirtException {
+        List<DiskDef> disks = new ArrayList<>();
+        when(libvirtUtilitiesHelper.getConnectionByVmName(VM_NAME)).thenReturn(connect);
+        when(connect.domainLookupByName(VM_NAME)).thenReturn(domain);
+        when(libvirtComputingResource.getDisks(connect, VM_NAME)).thenReturn(disks);
+
+        Answer answer = wrapper.execute(preMigrationCommand, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        verify(domain, times(1)).free();
+    }
+
+    private List<DiskDef> createNonClvmDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/mnt/nfs/volume1.qcow2");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/mnt/nfs/volume2.qcow2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createClvmDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/dev/clvm-vg/volume1");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/dev/clvm-vg/volume2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createClvmNgDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef disk1 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk1.getDiskPath()).thenReturn("/dev/clvmng-vg/volume1");
+        disks.add(disk1);
+
+        DiskDef disk2 = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(disk2.getDiskPath()).thenReturn("/dev/clvmng-vg/volume2");
+        disks.add(disk2);
+
+        return disks;
+    }
+
+    private List<DiskDef> createMixedDisks() {
+        List<DiskDef> disks = new ArrayList<>();
+
+        DiskDef clvmDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmDisk.getDiskPath()).thenReturn("/dev/clvm-vg/volume1");
+        disks.add(clvmDisk);
+
+        DiskDef nfsDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(nfsDisk.getDiskPath()).thenReturn("/mnt/nfs/volume2.qcow2");
+        disks.add(nfsDisk);
+
+        DiskDef clvmNgDisk = Mockito.mock(DiskDef.class);
+        Mockito.lenient().when(clvmNgDisk.getDiskPath()).thenReturn("/dev/clvmng-vg/volume3");
+        disks.add(clvmNgDisk);
+
+        return disks;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..7932e90f47a0
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java
@@ -0,0 +1,182 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Map;
+
+import org.apache.cloudstack.backup.StartBackupAnswer;
+import org.apache.cloudstack.backup.StartBackupCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStartBackupCommandWrapperTest {
+
+    private LibvirtStartBackupCommandWrapper wrapper;
+    private StartBackupCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStartBackupCommandWrapper();
+        command = Mockito.mock(StartBackupCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapAddSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-stopped-1");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof StartBackupAnswer);
+            Assert.assertTrue(answer.getDetails().contains("checkpoint bitmap added successfully"));
+        }
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapAddFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-stopped-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("bitmap add error"))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to add bitmap cp-stopped-2"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmMissingFromCheckpointCreateTimeReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-1");
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-running-0");
+        Mockito.when(command.getFromCheckpointCreateTime()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("not found"))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("From checkpoint create time is null"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmBackupBeginSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-2");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenReturn(Map.of("/path/disk1.qcow2", "vda"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Backup started successfully"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmCheckpointRedefineFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-3");
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-running-missing");
+        Mockito.when(command.getFromCheckpointCreateTime()).thenReturn(12345L);
+        Mockito.when(command.getSocket()).thenReturn("sock-3");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            int constructionIndex = context.getCount();
+            if (constructionIndex == 1) {
+                Mockito.when(mock.execute()).thenReturn("checkpoint missing");
+            } else if (constructionIndex == 2) {
+                Mockito.when(mock.execute()).thenReturn("checkpoint redefine failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to redefine from-checkpoint cp-running-missing"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmBackupBeginFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-4");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-4");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenReturn(Map.of("/path/disk1.qcow2", "vda"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("backup begin failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Backup begin failed: backup begin failed"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmCreateBackupXmlExceptionReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-5");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-5");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenThrow(new RuntimeException("disk labels unavailable"));
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Error starting backup: disk labels unavailable"));
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java
new file mode 100644
index 000000000000..7853a0d3efa6
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java
@@ -0,0 +1,179 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StartNBDServerAnswer;
+import org.apache.cloudstack.backup.StartNBDServerCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStartNBDServerCommandWrapperTest {
+
+    private LibvirtStartNBDServerCommandWrapper wrapper;
+    private StartNBDServerCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStartNBDServerCommandWrapper();
+        command = Mockito.mock(StartNBDServerCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+        Mockito.when(command.getVolumePath()).thenReturn("/path/disk.qcow2");
+        Mockito.when(command.getExportName()).thenReturn("vol-1");
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+        Mockito.when(command.getTransferId()).thenReturn("transfer-1");
+        Mockito.when(command.getDirection()).thenReturn("upload");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+    }
+
+    @Test
+    public void testExecuteMissingVolumePathReturnsFailure() {
+        Mockito.when(command.getVolumePath()).thenReturn(null);
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Volume path is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteMissingExportNameReturnsFailure() {
+        Mockito.when(command.getExportName()).thenReturn(" ");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Export name is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteMissingSocketReturnsFailure() {
+        Mockito.when(command.getSocket()).thenReturn("");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Socket is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteAlreadyActiveServiceReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) ->
+                Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("already running"));
+        }
+    }
+
+    @Test
+    public void testExecuteStartScriptFailureReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            } else if (context.getCount() == 2) {
+                Mockito.when(mock.execute()).thenReturn("start failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to start qemu-nbd service: start failed"));
+        }
+    }
+
+    @Test
+    public void testExecuteInterruptedWhileWaitingReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() <= 2) {
+                Mockito.when(mock.execute()).thenReturn(context.getCount() == 1 ? "inactive" : null);
+            } else {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            }
+        })) {
+            Thread.currentThread().interrupt();
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Interrupted while waiting"));
+            Assert.assertTrue(Thread.currentThread().isInterrupted());
+            Thread.interrupted();
+        }
+    }
+
+    @Test
+    public void testExecuteSuccessReturnsTransferDetails() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof StartNBDServerAnswer);
+            StartNBDServerAnswer startNBDServerAnswer = (StartNBDServerAnswer) answer;
+            Assert.assertEquals("transfer-1", startNBDServerAnswer.getImageTransferId());
+            Assert.assertEquals("nbd+unix:///sock-1", startNBDServerAnswer.getTransferUrl());
+        }
+    }
+
+    @Test
+    public void testExecuteAddsBitmapOptionWhenBitmapExists() {
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-1");
+
+        try (MockedStatic<Script> scriptStaticMock = Mockito.mockStatic(Script.class);
+                MockedConstruction<Script> scriptConstruction = Mockito.mockConstruction(Script.class, (mock, context) -> {
+                    if (context.getCount() == 1) {
+                        Mockito.when(mock.execute()).thenReturn("inactive");
+                    } else {
+                        Mockito.when(mock.execute()).thenReturn(null);
+                    }
+                })) {
+            scriptStaticMock.when(() -> Script.runBashScriptIgnoreExitValue(
+                    Mockito.anyString(), Mockito.anyInt())).thenReturn(
+                    "{\"format-specific\":{\"data\":{\"bitmaps\":[{\"name\":\"cp-1\"}]}}}");
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Script startScript = scriptConstruction.constructed().get(1);
+            boolean bitmapOptionAdded = Mockito.mockingDetails(startScript).getInvocations().stream().anyMatch(invocation ->
+                    invocation.getMethod().getName().equals("add")
+                            && invocation.getArguments().length > 0
+                            && invocation.getArguments()[0] instanceof String
+                            && ((String) invocation.getArguments()[0]).contains("-B cp-1"));
+            Assert.assertTrue(bitmapOptionAdded);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..33e5ccf55ba0
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopBackupCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStopBackupCommandWrapperTest {
+
+    private LibvirtStopBackupCommandWrapper wrapper;
+    private StopBackupCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStopBackupCommandWrapper();
+        command = Mockito.mock(StopBackupCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+    }
+
+    @Test
+    public void testExecuteDomainNotFoundReturnsFailure() throws Exception {
+        Connect connect = Mockito.mock(Connect.class);
+
+        try (MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenReturn(connect);
+            Mockito.when(connect.domainLookupByName("i-2-3-VM")).thenReturn(null);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertEquals("Domain not found: i-2-3-VM", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteDomainFoundReturnsSuccess() throws Exception {
+        Connect connect = Mockito.mock(Connect.class);
+        Domain domain = Mockito.mock(Domain.class);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenReturn(connect);
+            Mockito.when(connect.domainLookupByName("i-2-3-VM")).thenReturn(domain);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Backup stopped successfully", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteLibvirtConnectionFailureReturnsFailure() {
+        try (MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenThrow(new RuntimeException("libvirt unavailable"));
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Error stopping backup: libvirt unavailable"));
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptorTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptorTest.java
new file mode 100644
index 000000000000..1736c1d3f980
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/ClvmStorageAdaptorTest.java
@@ -0,0 +1,1104 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.storage;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.when;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.StoragePool;
+import org.mockito.Mock;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.storage.Storage;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
+
+@RunWith(MockitoJUnitRunner.class)
+public class ClvmStorageAdaptorTest {
+
+    private MockedStatic<LibvirtConnection> libvirtConnectionMockedStatic;
+    private AutoCloseable closeable;
+    @Mock
+    KVMStoragePool mockPool;
+    MockedStatic<Script> mockScript;
+    private MockedConstruction<Script> mockScriptConstruction;
+    @Spy
+    static ClvmStorageAdaptor clvmStorageAdaptor = new ClvmStorageAdaptor(null);
+    @Before
+    public void initMocks() {
+        closeable = MockitoAnnotations.openMocks(this);
+        libvirtConnectionMockedStatic = Mockito.mockStatic(LibvirtConnection.class);
+        Mockito.reset(mockPool);
+        mockScript = Mockito.mockStatic(Script.class);
+    }
+    @After
+    public void tearDown() throws Exception {
+        libvirtConnectionMockedStatic.close();
+        mockScript.close();
+        if (mockScriptConstruction != null) {
+            mockScriptConstruction.close();
+        }
+        closeable.close();
+    }
+    @Test
+    public void testCreateCLVMStoragePool_Success() throws Exception {
+        String uuid = UUID.randomUUID().toString();
+        String vgName = "testvg";
+        String host = "localhost";
+
+        Connect mockConn = Mockito.mock(Connect.class);
+        StoragePool mockStoragePool = Mockito.mock(StoragePool.class);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+            });
+
+        Mockito.when(mockConn.storagePoolDefineXML(anyString(), eq(0)))
+               .thenReturn(mockStoragePool);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createCLVMStoragePool", Connect.class, String.class, String.class, String.class);
+        method.setAccessible(true);
+
+        StoragePool result = (StoragePool) method.invoke(
+            clvmStorageAdaptor, mockConn, uuid, host, vgName);
+
+        assertNotNull("Storage pool should be created", result);
+        Mockito.verify(mockStoragePool).setAutostart(1);
+        Mockito.verify(mockConn).storagePoolDefineXML(anyString(), eq(0));
+    }
+
+    @Test
+    public void testCreateCLVMStoragePool_VGNotFound() throws Exception {
+        String uuid = UUID.randomUUID().toString();
+        String vgName = "nonexistentvg";
+        String host = "localhost";
+
+        Connect mockConn = Mockito.mock(Connect.class);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn("Volume group \"" + vgName + "\" not found");
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createCLVMStoragePool", Connect.class, String.class, String.class, String.class);
+        method.setAccessible(true);
+
+        StoragePool result = (StoragePool) method.invoke(
+            clvmStorageAdaptor, mockConn, uuid, host, vgName);
+
+        assert result == null : "Should return null when VG doesn't exist";
+        Mockito.verify(mockConn, never()).storagePoolDefineXML(anyString(), anyInt());
+    }
+
+    @Test
+    public void testCreateClvmVolume_Success() throws Exception {
+        String volumeName = UUID.randomUUID().toString();
+        long size = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+            });
+
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmVolume", String.class, long.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        KVMPhysicalDisk result = (KVMPhysicalDisk) method.invoke(
+            clvmStorageAdaptor, volumeName, size, mockPool);
+
+        assertNotNull("Physical disk should be created", result);
+        assertEquals("Volume name should match", volumeName, result.getName());
+        assertEquals("Format should be RAW", PhysicalDiskFormat.RAW, result.getFormat());
+        assert result.getPath().contains(vgName) : "Path should contain VG name";
+        assert result.getPath().contains(volumeName) : "Path should contain volume name";
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCreateClvmVolume_LvcreateFailure() throws Throwable {
+        String volumeName = UUID.randomUUID().toString();
+        long size = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn("lvcreate failed: insufficient space");
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmVolume", String.class, long.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeName, size, mockPool);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test
+    public void testCreateClvmNgDiskWithBacking_NoBackingFile() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        int timeout = 30000;
+        long virtualSize = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmNgDiskWithBacking",
+            String.class, int.class, long.class, String.class,
+            KVMStoragePool.class, Storage.ProvisioningType.class);
+        method.setAccessible(true);
+
+        KVMPhysicalDisk result = (KVMPhysicalDisk) method.invoke(
+            clvmStorageAdaptor, volumeUuid, timeout, virtualSize, null,
+            mockPool, Storage.ProvisioningType.THIN);
+
+        assertNotNull("Physical disk should be created", result);
+        assertEquals("Volume UUID should match", volumeUuid, result.getName());
+        assertEquals("Format should be QCOW2", PhysicalDiskFormat.QCOW2, result.getFormat());
+        assert result.getPath().contains(vgName) : "Path should contain VG name";
+        assert result.getPath().contains(volumeUuid) : "Path should contain volume UUID";
+    }
+
+    @Test
+    public void testCreateClvmNgDiskWithBacking_WithBackingFile() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        String backingFile = "/dev/testvg/parent-volume";
+        int timeout = 30000;
+        long virtualSize = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmNgDiskWithBacking",
+            String.class, int.class, long.class, String.class,
+            KVMStoragePool.class, Storage.ProvisioningType.class);
+        method.setAccessible(true);
+
+        KVMPhysicalDisk result = (KVMPhysicalDisk) method.invoke(
+            clvmStorageAdaptor, volumeUuid, timeout, virtualSize, backingFile,
+            mockPool, Storage.ProvisioningType.SPARSE);
+
+        assertNotNull("Physical disk should be created", result);
+        assertEquals("Format should be QCOW2", PhysicalDiskFormat.QCOW2, result.getFormat());
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCreateClvmNgDiskWithBacking_LvcreateFailure() throws Throwable {
+        String volumeUuid = UUID.randomUUID().toString();
+        int timeout = 30000;
+        long virtualSize = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn("Insufficient free extents");
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmNgDiskWithBacking",
+            String.class, int.class, long.class, String.class,
+            KVMStoragePool.class, Storage.ProvisioningType.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, timeout, virtualSize,
+                         null, mockPool, Storage.ProvisioningType.THIN);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCreateClvmNgDiskWithBacking_QemuImgFailure() throws Throwable {
+        String volumeUuid = UUID.randomUUID().toString();
+        int timeout = 30000;
+        long virtualSize = 10737418240L;
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        final int[] callCount = {0};
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenAnswer(invocation -> {
+                    callCount[0]++;
+                    if (callCount[0] == 1) {
+                        return null;
+                    } else {
+                        return "qemu-img: error creating QCOW2";
+                    }
+                });
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmNgDiskWithBacking",
+            String.class, int.class, long.class, String.class,
+            KVMStoragePool.class, Storage.ProvisioningType.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, timeout, virtualSize,
+                         null, mockPool, Storage.ProvisioningType.THIN);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testGetPhysicalDiskViaDirectBlockDevice_VolumeNotFound() throws Throwable {
+        String volumeUuid = UUID.randomUUID().toString();
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn("  Volume not found");
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getPhysicalDiskViaDirectBlockDevice",
+            String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testGetPhysicalDiskViaDirectBlockDevice_NullPoolPath() throws Throwable {
+        String volumeUuid = UUID.randomUUID().toString();
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(null);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getPhysicalDiskViaDirectBlockDevice",
+            String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testGetPhysicalDiskViaDirectBlockDevice_EmptyPoolPath() throws Throwable {
+        String volumeUuid = UUID.randomUUID().toString();
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn("");
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getPhysicalDiskViaDirectBlockDevice",
+            String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test
+    public void testShouldSecureZeroFill_EnabledInDetails() throws Exception {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "true");
+
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "shouldSecureZeroFill", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assert result : "Should return true when CLVM_SECURE_ZERO_FILL is 'true'";
+    }
+
+    @Test
+    public void testShouldSecureZeroFill_DisabledInDetails() throws Exception {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "shouldSecureZeroFill", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assert !result : "Should return false when CLVM_SECURE_ZERO_FILL is 'false'";
+    }
+
+    @Test
+    public void testShouldSecureZeroFill_NotSetInDetails() throws Exception {
+        Map<String, String> details = new HashMap<>();
+
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "shouldSecureZeroFill", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assert !result : "Should return false when CLVM_SECURE_ZERO_FILL is not set";
+    }
+
+    @Test
+    public void testShouldSecureZeroFill_NullDetails() throws Exception {
+        Mockito.when(mockPool.getDetails()).thenReturn(null);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "shouldSecureZeroFill", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assert !result : "Should return false when details are null";
+    }
+
+    @Test
+    public void testExtractVgNameFromPool_SimplePath() throws Exception {
+        String vgName = "testvg";
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "extractVgNameFromPool", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assertEquals("Should extract VG name correctly", vgName, result);
+    }
+
+    @Test
+    public void testExtractVgNameFromPool_PathWithSlash() throws Exception {
+        String vgName = "testvg";
+        String path = "/" + vgName;
+        Mockito.when(mockPool.getLocalPath()).thenReturn(path);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "extractVgNameFromPool", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, mockPool);
+
+        assertEquals("Should extract VG name from path with leading slash", vgName, result);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testExtractVgNameFromPool_NullPath() throws Throwable {
+        Mockito.when(mockPool.getLocalPath()).thenReturn(null);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "extractVgNameFromPool", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, mockPool);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test
+    public void testLvExists_VolumeExists() throws Exception {
+        String lvPath = "/dev/testvg/test-volume";
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "lvExists", String.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, lvPath);
+
+        assert result : "Should return true when LV exists (lvs returns null)";
+    }
+
+    @Test
+    public void testLvExists_VolumeDoesNotExist() throws Exception {
+        String lvPath = "/dev/testvg/nonexistent-volume";
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn("Volume not found");
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "lvExists", String.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, lvPath);
+
+        assert !result : "Should return false when LV does not exist";
+    }
+
+    @Test
+    public void testGetVgName_SimpleName() throws Exception {
+        String vgName = "acsvg";
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getVgName", String.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, vgName);
+
+        assertEquals("Should return VG name as-is for simple name", vgName, result);
+    }
+
+    @Test
+    public void testGetVgName_PathWithSlash() throws Exception {
+        String vgName = "acsvg";
+        String path = "/" + vgName;
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getVgName", String.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, path);
+
+        assertEquals("Should extract VG name from path with leading slash", vgName, result);
+    }
+
+    @Test
+    public void testGetVgName_DevPath() throws Exception {
+        String vgName = "acsvg";
+        String path = "/dev/" + vgName;
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getVgName", String.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, path);
+
+        assertEquals("Should extract VG name from /dev/ path", vgName, result);
+    }
+
+    @Test
+    public void testCreatePhysicalDiskFromClvmLv_CLVM() throws Exception {
+        String lvPath = "/dev/testvg/test-volume";
+        String volumeUuid = "test-volume";
+        long size = 10737418240L;
+
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createPhysicalDiskFromClvmLv",
+            String.class, String.class, KVMStoragePool.class, long.class);
+        method.setAccessible(true);
+
+        KVMPhysicalDisk result = (KVMPhysicalDisk) method.invoke(
+            clvmStorageAdaptor, lvPath, volumeUuid, mockPool, size);
+
+        assertNotNull("Physical disk should be created", result);
+        assertEquals("Format should be RAW for CLVM", PhysicalDiskFormat.RAW, result.getFormat());
+        assertEquals("Size should match", size, result.getSize());
+        assertEquals("Path should match", lvPath, result.getPath());
+    }
+
+    @Test
+    public void testCreatePhysicalDiskFromClvmLv_CLVM_NG() throws Exception {
+        String lvPath = "/dev/testvg-ng/test-volume";
+        String volumeUuid = "test-volume";
+        long size = 10737418240L;
+
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+                Mockito.doAnswer(invocation -> {
+                    OutputInterpreter.AllLinesParser parser = invocation.getArgument(0);
+                    Field allLinesField = OutputInterpreter.AllLinesParser.class.getDeclaredField("allLines");
+                    allLinesField.setAccessible(true);
+                    allLinesField.set(parser, "{\"virtual-size\": " + size + "}");
+                    return null;
+                }).when(mock).execute(Mockito.any(OutputInterpreter.AllLinesParser.class));
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createPhysicalDiskFromClvmLv",
+            String.class, String.class, KVMStoragePool.class, long.class);
+        method.setAccessible(true);
+
+        KVMPhysicalDisk result = (KVMPhysicalDisk) method.invoke(
+            clvmStorageAdaptor, lvPath, volumeUuid, mockPool, size);
+
+        assertNotNull("Physical disk should be created", result);
+        assertEquals("Format should be QCOW2 for CLVM_NG", PhysicalDiskFormat.QCOW2, result.getFormat());
+        assertEquals("Size should match", size, result.getSize());
+        assertEquals("Path should match", lvPath, result.getPath());
+    }
+
+    @Test
+    public void testCLVMPoolSecureZeroFill_TrueValue() {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "true");
+
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        String value = mockPool.getDetails().get(KVMStoragePool.CLVM_SECURE_ZERO_FILL);
+        assert "true".equals(value) : "CLVM_SECURE_ZERO_FILL should be 'true'";
+    }
+
+    @Test
+    public void testCLVMPoolSecureZeroFill_FalseValue() {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        String value = mockPool.getDetails().get(KVMStoragePool.CLVM_SECURE_ZERO_FILL);
+        assert "false".equals(value) : "CLVM_SECURE_ZERO_FILL should be 'false'";
+    }
+
+    @Test
+    public void testCLVMVolumePathConstruction() {
+        String vgName = "acsvg";
+        String volumeUuid = "550e8400-e29b-41d4-a716-446655440000";
+        String expectedPath = "/dev/" + vgName + "/" + volumeUuid;
+
+        assertEquals("/dev/acsvg/550e8400-e29b-41d4-a716-446655440000", expectedPath);
+    }
+
+    @Test
+    public void testCLVMNGPoolSupportsQCOW2Format() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        Storage.StoragePoolType type = mockPool.getType();
+        PhysicalDiskFormat expectedFormat = PhysicalDiskFormat.QCOW2;
+
+        assert type == Storage.StoragePoolType.CLVM_NG : "Pool type should be CLVM_NG";
+        assertNotNull("QCOW2 format should be available", expectedFormat);
+    }
+
+    @Test
+    public void testCLVMPoolSupportsRAWFormat() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Storage.StoragePoolType type = mockPool.getType();
+        PhysicalDiskFormat expectedFormat = PhysicalDiskFormat.RAW;
+
+        assert type == Storage.StoragePoolType.CLVM : "Pool type should be CLVM";
+        assertNotNull("RAW format should be available", expectedFormat);
+    }
+
+    @Test
+    public void testVerifyLvExistsInVg_VolumeExists() throws Exception {
+        String volumeUuid = "test-volume-uuid";
+        String vgName = "testvg";
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn(null));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "verifyLvExistsInVg", String.class, String.class);
+        method.setAccessible(true);
+
+        method.invoke(clvmStorageAdaptor, volumeUuid, vgName);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testVerifyLvExistsInVg_VolumeDoesNotExist() throws Throwable {
+        String volumeUuid = "nonexistent-volume";
+        String vgName = "testvg";
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn("  Volume not found"));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "verifyLvExistsInVg", String.class, String.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, volumeUuid, vgName);
+        } catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+    }
+
+    @Test
+    public void testGetClvmVolumeSize_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getClvmVolumeSize", String.class);
+        method.setAccessible(true);
+
+        assertNotNull("getClvmVolumeSize method should exist", method);
+    }
+
+    @Test
+    public void testCLVMPoolIsBlockBased() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        boolean isBlockBased = mockPool.getType() == Storage.StoragePoolType.CLVM ||
+                               mockPool.getType() == Storage.StoragePoolType.CLVM_NG;
+
+        assert isBlockBased : "CLVM should be recognized as block-based storage";
+    }
+
+    @Test
+    public void testCLVMNGPoolIsBlockBased() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        boolean isBlockBased = mockPool.getType() == Storage.StoragePoolType.CLVM ||
+                               mockPool.getType() == Storage.StoragePoolType.CLVM_NG;
+
+        assert isBlockBased : "CLVM_NG should be recognized as block-based storage";
+    }
+
+    @Test
+    public void testGetVgName_ComplexPath() throws Exception {
+        String vgName = "acsvg-ng";
+        String path = "/dev/mapper/" + vgName;
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "getVgName", String.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(clvmStorageAdaptor, path);
+
+        assertNotNull("VG name should not be null", result);
+    }
+
+    @Test
+    public void testExtractVgNameFromPool_EmptyPath() throws Exception {
+        Mockito.when(mockPool.getLocalPath()).thenReturn("");
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "extractVgNameFromPool", KVMStoragePool.class);
+        method.setAccessible(true);
+
+        try {
+            method.invoke(clvmStorageAdaptor, mockPool);
+            assert false : "Should throw CloudRuntimeException for empty path";
+        } catch (InvocationTargetException e) {
+            assert e.getCause() instanceof CloudRuntimeException :
+                "Should throw CloudRuntimeException";
+        }
+    }
+
+    @Test
+    public void testCleanupCLVMVolume_VolumeExists_WithSecureZeroFill() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        String vgName = "testvg";
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "true");
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+        Mockito.when(mockPool.getUuid()).thenReturn(UUID.randomUUID().toString());
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn(null));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "cleanupCLVMVolume", String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+
+        assert result : "Cleanup should succeed";
+    }
+
+    @Test
+    public void testCleanupCLVMVolume_VolumeExists_WithoutSecureZeroFill() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        String vgName = "testvg";
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "false");
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+        Mockito.when(mockPool.getUuid()).thenReturn(UUID.randomUUID().toString());
+        Mockito.when(mockPool.getDetails()).thenReturn(details);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn(null));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "cleanupCLVMVolume", String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+
+        assert result : "Cleanup should succeed without zero-fill";
+    }
+
+    @Test
+    public void testCleanupCLVMVolume_VolumeNotFound() throws Exception {
+        String volumeUuid = "nonexistent-volume";
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+        Mockito.when(mockPool.getUuid()).thenReturn(UUID.randomUUID().toString());
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn("Volume not found"));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "cleanupCLVMVolume", String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+
+        assert result : "Should return true when volume not found (already deleted)";
+    }
+
+    @Test
+    public void testCleanupCLVMVolume_NullSourceDir() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(null);
+        Mockito.when(mockPool.getUuid()).thenReturn(UUID.randomUUID().toString());
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "cleanupCLVMVolume", String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        boolean result = (boolean) method.invoke(clvmStorageAdaptor, volumeUuid, mockPool);
+
+        assert result : "Should return true when source dir is null";
+    }
+
+    @Test
+    public void testRemoveLvOnFailure_Success() throws Exception {
+        String lvPath = "/dev/testvg/test-volume";
+        int timeout = 30000;
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn(null));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "removeLvOnFailure", String.class, int.class);
+        method.setAccessible(true);
+
+        method.invoke(clvmStorageAdaptor, lvPath, timeout);
+    }
+
+    @Test
+    public void testEnsureTemplateAccessibility_CLVM_NG_TemplateVolume() throws Exception {
+        String volumeUuid = "template-550e8400-e29b-41d4-a716-446655440000";
+        String lvPath = "/dev/testvg/template-550e8400-e29b-41d4-a716-446655440000";
+
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> when(mock.execute()).thenReturn(null));
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "ensureTemplateAccessibility", String.class, String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        method.invoke(clvmStorageAdaptor, volumeUuid, lvPath, mockPool);
+    }
+
+    @Test
+    public void testEnsureTemplateAccessibility_CLVM_NonTemplate() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        String lvPath = "/dev/testvg/" + volumeUuid;
+
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "ensureTemplateAccessibility", String.class, String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        method.invoke(clvmStorageAdaptor, volumeUuid, lvPath, mockPool);
+    }
+
+    @Test
+    public void testCreateVirtualClvmPool_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createVirtualClvmPool",
+            String.class, String.class, String.class,
+            Storage.StoragePoolType.class, Map.class);
+        method.setAccessible(true);
+
+        assertNotNull("createVirtualClvmPool method should exist", method);
+    }
+
+    @Test
+    public void testFindDeviceNodeAfterActivation_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "findDeviceNodeAfterActivation",
+            String.class, String.class, String.class);
+        method.setAccessible(true);
+
+        assertNotNull("findDeviceNodeAfterActivation method should exist", method);
+    }
+
+    @Test
+    public void testHandleMissingDeviceNode_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "handleMissingDeviceNode",
+            String.class, String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        assertNotNull("handleMissingDeviceNode method should exist", method);
+    }
+
+    @Test
+    public void testHandleMissingDeviceNode_NonTemplate_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "handleMissingDeviceNode",
+            String.class, String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        assertNotNull("handleMissingDeviceNode method should exist", method);
+    }
+
+    @Test
+    public void testFindAccessibleDeviceNode_MethodExists() throws Exception {
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "findAccessibleDeviceNode",
+            String.class, String.class, KVMStoragePool.class);
+        method.setAccessible(true);
+
+        assertNotNull("findAccessibleDeviceNode method should exist", method);
+    }
+
+    @Test
+    public void testCLVMNGDiskFormat_IsQCOW2() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        PhysicalDiskFormat format = (mockPool.getType() == Storage.StoragePoolType.CLVM_NG)
+            ? PhysicalDiskFormat.QCOW2
+            : PhysicalDiskFormat.RAW;
+
+        assertEquals("CLVM_NG should use QCOW2 format", PhysicalDiskFormat.QCOW2, format);
+    }
+
+    @Test
+    public void testCLVMDiskFormat_IsRAW() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        PhysicalDiskFormat format = (mockPool.getType() == Storage.StoragePoolType.CLVM_NG)
+            ? PhysicalDiskFormat.QCOW2
+            : PhysicalDiskFormat.RAW;
+
+        assertEquals("CLVM should use RAW format", PhysicalDiskFormat.RAW, format);
+    }
+
+    @Test
+    public void testCLVMPoolDetails_DefaultSecureZeroFill() {
+        Map<String, String> details = new HashMap<>();
+
+        String value = details.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL);
+
+        assert value == null : "CLVM_SECURE_ZERO_FILL should default to null";
+    }
+
+    @Test
+    public void testCLVMPoolDetails_CustomSecureZeroFill() {
+        Map<String, String> details = new HashMap<>();
+        details.put(KVMStoragePool.CLVM_SECURE_ZERO_FILL, "true");
+
+        String value = details.get(KVMStoragePool.CLVM_SECURE_ZERO_FILL);
+
+        assertEquals("CLVM_SECURE_ZERO_FILL should be 'true'", "true", value);
+    }
+
+    @Test
+    public void testCLVMVolumeDeviceMapperPathEscaping() {
+        String vgName = "acsvg-ng";
+        String volumeUuid = "ea19580e-0882-4ab8-973b-a320637037f4";
+
+        String vgNameEscaped = vgName.replace("-", "--");
+        String volumeUuidEscaped = volumeUuid.replace("-", "--");
+        String mapperPath = "/dev/mapper/" + vgNameEscaped + "-" + volumeUuidEscaped;
+
+        String expectedPath = "/dev/mapper/acsvg--ng-ea19580e--0882--4ab8--973b--a320637037f4";
+        assertEquals("Mapper path should have escaped hyphens", expectedPath, mapperPath);
+    }
+
+    @Test
+    public void testCLVMTemplateNamePrefix() {
+        String templateUuid = UUID.randomUUID().toString();
+        String templateName = "template-" + templateUuid;
+
+        assert templateName.startsWith("template-");
+        assert templateName.length() > 9;
+    }
+
+    @Test
+    public void testCLVMPoolTypeIsNotFileSystem() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        boolean isFileSystem = mockPool.getType() == Storage.StoragePoolType.Filesystem;
+
+        assert !isFileSystem : "CLVM is not a file system pool type";
+    }
+
+    @Test
+    public void testCLVMNGPoolTypeIsNotFileSystem() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        boolean isFileSystem = mockPool.getType() == Storage.StoragePoolType.Filesystem;
+
+        assert !isFileSystem : "CLVM_NG is not a file system pool type";
+    }
+
+    @Test
+    public void testCLVMPoolTypeIsNotNFS() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        boolean isNFS = mockPool.getType() == Storage.StoragePoolType.NetworkFilesystem;
+
+        assert !isNFS : "CLVM is not an NFS pool type";
+    }
+
+    @Test
+    public void testCLVMNGPoolTypeIsNotRBD() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        boolean isRBD = mockPool.getType() == Storage.StoragePoolType.RBD;
+
+        assert !isRBD : "CLVM_NG is not an RBD pool type";
+    }
+
+    @Test
+    public void testCLVMVolumeUUIDFormat() {
+        String volumeUuid = UUID.randomUUID().toString();
+
+        assert volumeUuid.matches("[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}");
+    }
+
+    @Test
+    public void testCLVMNGBackingFileFormat() {
+        String vgName = "testvg";
+        String templateUuid = UUID.randomUUID().toString();
+        String backingFile = "/dev/" + vgName + "/template-" + templateUuid;
+
+        assert backingFile.startsWith("/dev/");
+        assert backingFile.contains("template-");
+        assert backingFile.contains(templateUuid);
+    }
+
+    @Test
+    public void testCLVMPoolLocalPathValidation() {
+        String vgName = "acsvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        String localPath = mockPool.getLocalPath();
+
+        assertNotNull("Local path should not be null", localPath);
+        assert !localPath.isEmpty() : "Local path should not be empty";
+    }
+
+    @Test
+    public void testCreateClvmNgDiskWithBacking_NonPeAlignedSizeIsRoundedUp() throws Exception {
+        String volumeUuid = UUID.randomUUID().toString();
+        int timeout = 30000;
+        // 50 MiB is not a multiple of the default 4 MiB PE, so lvcreate on a CLVM
+        // destination would round it up to 52 MiB.  The QCOW2 must be created with
+        // the same 52 MiB so libvirt does not abort migration with "different sizes".
+        long nonAlignedVirtualSize = 52428800L;   // 50 MiB
+        long peAlignedVirtualSize  = 54525952L;   // 52 MiB = 13 × 4 MiB (default PE)
+        String vgName = "testvg";
+
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        List<String> qemuImgAddArgs = new ArrayList<>();
+
+        mockScriptConstruction = Mockito.mockConstruction(Script.class,
+            (mock, context) -> {
+                when(mock.execute()).thenReturn(null);
+                if (!context.arguments().isEmpty() && "qemu-img".equals(context.arguments().get(0))) {
+                    doAnswer(inv -> { qemuImgAddArgs.add(inv.getArgument(0)); return null; })
+                        .when(mock).add(anyString());
+                }
+            });
+
+        Method method = ClvmStorageAdaptor.class.getDeclaredMethod(
+            "createClvmNgDiskWithBacking",
+            String.class, int.class, long.class, String.class,
+            KVMStoragePool.class, Storage.ProvisioningType.class);
+        method.setAccessible(true);
+
+        method.invoke(clvmStorageAdaptor, volumeUuid, timeout, nonAlignedVirtualSize, null,
+            mockPool, Storage.ProvisioningType.THIN);
+
+        assertTrue("qemu-img create must use PE-aligned virtual size to match CLVM destination LV",
+            qemuImgAddArgs.contains(String.valueOf(peAlignedVirtualSize)));
+        assertFalse("qemu-img create must not use non-PE-aligned virtual size",
+            qemuImgAddArgs.contains(String.valueOf(nonAlignedVirtualSize)));
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessorTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessorTest.java
index cc1e38a908b3..0a58dfc79b0d 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessorTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessorTest.java
@@ -22,6 +22,7 @@
 import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
 import com.cloud.hypervisor.kvm.resource.LibvirtDomainXMLParser;
 import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
+import com.cloud.storage.Storage;
 import com.cloud.storage.template.TemplateConstants;
 import com.cloud.utils.Pair;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -53,6 +54,7 @@
 import javax.naming.ConfigurationException;
 import java.io.File;
 import java.io.IOException;
+import java.lang.reflect.Method;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
@@ -499,4 +501,169 @@ public void getDiskLabelToSnapshotTestDiskMatches() throws LibvirtException {
 
         Assert.assertEquals("vda", result);
     }
+
+    @Test
+    public void testParseClvmSnapshotPath_ValidPath() {
+        String snapshotPath = "/dev/vg-storage/volume-uuid-123/snapshot-uuid-456";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM_NG;
+
+        try {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "parseClvmSnapshotPath", String.class, Storage.StoragePoolType.class);
+            method.setAccessible(true);
+            String[] result = (String[]) method.invoke(storageProcessorSpy, snapshotPath, poolType);
+
+            Assert.assertNotNull("Should return parsed array for valid path", result);
+            Assert.assertEquals("Should return 4 elements", 4, result.length);
+            Assert.assertEquals("VG name should be vg-storage", "vg-storage", result[0]);
+            Assert.assertEquals("Volume UUID should be volume-uuid-123", "volume-uuid-123", result[1]);
+            Assert.assertEquals("Snapshot UUID should be snapshot-uuid-456", "snapshot-uuid-456", result[2]);
+            Assert.assertNotNull("MD5 hash should be computed", result[3]);
+        } catch (Exception e) {
+            Assert.fail("Failed to test parseClvmSnapshotPath: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testParseClvmSnapshotPath_InvalidPathFormat() {
+        String snapshotPath = "/dev/vg-storage/invalid";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM;
+
+        try {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "parseClvmSnapshotPath", String.class, Storage.StoragePoolType.class);
+            method.setAccessible(true);
+            String[] result = (String[]) method.invoke(storageProcessorSpy, snapshotPath, poolType);
+
+            Assert.assertNull("Should return null for invalid path format", result);
+        } catch (Exception e) {
+            Assert.fail("Failed to test parseClvmSnapshotPath: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testDeleteClvmSnapshot_SuccessfulDeletion() {
+        String snapshotPath = "/dev/vg-storage/volume-uuid/snapshot-uuid";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM_NG;
+
+        try (MockedConstruction<Script> scriptConstruction = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            Mockito.when(mock.execute()).thenReturn(null);
+        })) {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "deleteClvmSnapshot", String.class, Storage.StoragePoolType.class, boolean.class);
+            method.setAccessible(true);
+            boolean result = (boolean) method.invoke(storageProcessorSpy, snapshotPath, poolType, true);
+
+            Assert.assertTrue("Should return true for successful deletion", result);
+        } catch (Exception e) {
+            Assert.fail("Failed to test deleteClvmSnapshot: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testDeleteClvmSnapshot_SnapshotAlreadyDeleted() {
+        String snapshotPath = "/dev/vg-storage/volume-uuid/snapshot-uuid";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM;
+
+        try (MockedConstruction<Script> scriptConstruction = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            Mockito.when(mock.execute()).thenReturn("Error: snapshot does not exist");
+        })) {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "deleteClvmSnapshot", String.class, Storage.StoragePoolType.class, boolean.class);
+            method.setAccessible(true);
+            boolean result = (boolean) method.invoke(storageProcessorSpy, snapshotPath, poolType, true);
+
+            Assert.assertTrue("Should return true when snapshot already deleted", result);
+        } catch (Exception e) {
+            Assert.fail("Failed to test deleteClvmSnapshot: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testDeleteClvmSnapshot_DeletionFailedWithoutCheck() {
+        String snapshotPath = "/dev/vg-storage/volume-uuid/snapshot-uuid";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM_NG;
+
+        try (MockedConstruction<Script> scriptConstruction = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            Mockito.when(mock.execute()).thenReturn("Error: some other error");
+        })) {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "deleteClvmSnapshot", String.class, Storage.StoragePoolType.class, boolean.class);
+            method.setAccessible(true);
+            boolean result = (boolean) method.invoke(storageProcessorSpy, snapshotPath, poolType, false);
+
+            Assert.assertFalse("Should return false when deletion fails", result);
+        } catch (Exception e) {
+            Assert.fail("Failed to test deleteClvmSnapshot: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testDeleteClvmSnapshot_InvalidPath() {
+        String snapshotPath = "/invalid/path";
+        Storage.StoragePoolType poolType = Storage.StoragePoolType.CLVM;
+
+        try {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "deleteClvmSnapshot", String.class, Storage.StoragePoolType.class, boolean.class);
+            method.setAccessible(true);
+            boolean result = (boolean) method.invoke(storageProcessorSpy, snapshotPath, poolType, true);
+
+            Assert.assertFalse("Should return false for invalid path", result);
+        } catch (Exception e) {
+            Assert.fail("Failed to test deleteClvmSnapshot: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testComputeMd5Hash_ValidInput() {
+        String input = "snapshot-uuid-123";
+
+        try {
+            Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "computeMd5Hash", String.class);
+            method.setAccessible(true);
+            String result = (String) method.invoke(storageProcessorSpy, input);
+
+            Assert.assertNotNull("Should return non-null hash", result);
+            Assert.assertEquals("Hash should be 32 characters long (MD5)", 32, result.length());
+            Assert.assertTrue("Hash should contain only hex characters", result.matches("[0-9a-f]+"));
+        } catch (Exception e) {
+            Assert.fail("Failed to test computeMd5Hash: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testComputeMd5Hash_EmptyInput() {
+        String input = "";
+
+        try {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "computeMd5Hash", String.class);
+            method.setAccessible(true);
+            String result = (String) method.invoke(storageProcessorSpy, input);
+
+            Assert.assertNotNull("Should return non-null hash even for empty input", result);
+            Assert.assertEquals("Hash should be 32 characters long (MD5)", 32, result.length());
+        } catch (Exception e) {
+            Assert.fail("Failed to test computeMd5Hash: " + e.getMessage());
+        }
+    }
+
+    @Test
+    public void testComputeMd5Hash_ConsistentResults() {
+        String input = "snapshot-uuid-456";
+
+        try {
+            java.lang.reflect.Method method = KVMStorageProcessor.class.getDeclaredMethod(
+                    "computeMd5Hash", String.class);
+            method.setAccessible(true);
+            String result1 = (String) method.invoke(storageProcessorSpy, input);
+            String result2 = (String) method.invoke(storageProcessorSpy, input);
+
+            Assert.assertEquals("Same input should produce same hash", result1, result2);
+        } catch (Exception e) {
+            Assert.fail("Failed to test computeMd5Hash: " + e.getMessage());
+        }
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptorTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptorTest.java
index 88346abd0176..9b8e1fd2d748 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptorTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptorTest.java
@@ -33,6 +33,7 @@
 import org.libvirt.Connect;
 import org.libvirt.StoragePool;
 import org.mockito.Mock;
+import org.mockito.MockedConstruction;
 import org.mockito.MockedStatic;
 import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
@@ -58,6 +59,9 @@ public class LibvirtStorageAdaptorTest {
 
     MockedStatic<Script> mockScript;
 
+    // For mocking Script constructor
+    private MockedConstruction<Script> mockScriptConstruction;
+
     @Spy
     static LibvirtStorageAdaptor libvirtStorageAdaptor = new LibvirtStorageAdaptor(null);
 
@@ -73,6 +77,9 @@ public void initMocks() {
     public void tearDown() throws Exception {
         libvirtConnectionMockedStatic.close();
         mockScript.close();
+        if (mockScriptConstruction != null) {
+            mockScriptConstruction.close();
+        }
         closeable.close();
     }
 
@@ -176,4 +183,168 @@ public void testUpdateLocalPoolIops_NullResultFromScript() {
 
         Mockito.verify(mockPool, never()).setUsedIops(anyLong());
     }
+
+    @Test
+    public void testGetVolumeFromCLVMPool_ReturnsNullForNonCLVMPool() {
+        Storage.StoragePoolType type = Storage.StoragePoolType.NetworkFilesystem;
+
+        assert type != Storage.StoragePoolType.CLVM;
+        assert type != Storage.StoragePoolType.CLVM_NG;
+    }
+
+    @Test
+    public void testCLVMPoolTypeDetection_CLVM() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Storage.StoragePoolType type = mockPool.getType();
+
+        assert type == Storage.StoragePoolType.CLVM;
+        assert type != Storage.StoragePoolType.CLVM_NG;
+    }
+
+    @Test
+    public void testCLVMPoolTypeDetection_CLVM_NG() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        Storage.StoragePoolType type = mockPool.getType();
+
+        assert type == Storage.StoragePoolType.CLVM_NG;
+        assert type != Storage.StoragePoolType.CLVM;
+    }
+
+    @Test
+    public void testCLVMPoolLocalPathFormat() {
+        String vgName = "acsvg";
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        String localPath = mockPool.getLocalPath();
+
+        assert localPath.equals(vgName);
+        assert !localPath.startsWith("/");
+    }
+
+    @Test
+    public void testCLVMNGPoolLocalPathFormat() {
+        String vgName = "acsvg";
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        String localPath = mockPool.getLocalPath();
+
+        assert localPath.equals(vgName);
+        assert !localPath.startsWith("/");
+    }
+
+    @Test
+    public void testCLVMVolumePathFormat() {
+        String vgName = "acsvg";
+        String volumeUuid = UUID.randomUUID().toString();
+        String expectedPath = "/dev/" + vgName + "/" + volumeUuid;
+
+        assert expectedPath.startsWith("/dev/");
+        assert expectedPath.contains(vgName);
+        assert expectedPath.endsWith(volumeUuid);
+    }
+
+    @Test
+    public void testCLVMNGVolumePathFormat() {
+        String vgName = "acsvg";
+        String volumeUuid = UUID.randomUUID().toString();
+        String expectedPath = "/dev/" + vgName + "/" + volumeUuid;
+
+        assert expectedPath.startsWith("/dev/");
+        assert expectedPath.contains(vgName);
+        assert expectedPath.endsWith(volumeUuid);
+    }
+
+    @Test
+    public void testCLVMTemplateVolumeNamingConvention() {
+        String templateUuid = "550e8400-e29b-41d4-a716-446655440000";
+        String expectedLvName = "template-" + templateUuid;
+
+        assert expectedLvName.startsWith("template-");
+        assert expectedLvName.contains(templateUuid);
+        assert expectedLvName.equals("template-550e8400-e29b-41d4-a716-446655440000");
+    }
+
+    @Test
+    public void testCLVMTemplatePathFormat() {
+        // CLVM_NG template paths: /dev/vgname/template-{uuid}
+        String vgName = "acsvg";
+        String templateUuid = "550e8400-e29b-41d4-a716-446655440000";
+        String expectedPath = "/dev/" + vgName + "/template-" + templateUuid;
+
+        assert expectedPath.equals("/dev/acsvg/template-550e8400-e29b-41d4-a716-446655440000");
+        assert expectedPath.startsWith("/dev/");
+        assert expectedPath.contains("template-");
+    }
+
+    @Test
+    public void testCLVMPoolIsBlockDeviceStorage() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Storage.StoragePoolType type = mockPool.getType();
+
+        boolean isBlockBased = (type == Storage.StoragePoolType.CLVM ||
+                               type == Storage.StoragePoolType.CLVM_NG);
+        assert isBlockBased;
+    }
+
+    @Test
+    public void testCLVMNGPoolIsBlockDeviceStorage() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+
+        Storage.StoragePoolType type = mockPool.getType();
+
+        boolean isBlockBased = (type == Storage.StoragePoolType.CLVM ||
+                               type == Storage.StoragePoolType.CLVM_NG);
+        assert isBlockBased;
+    }
+
+    @Test
+    public void testCLVMPoolSupportsSharedStorage() {
+        Mockito.when(mockPool.getType()).thenReturn(Storage.StoragePoolType.CLVM);
+
+        Storage.StoragePoolType type = mockPool.getType();
+        boolean supportsShared = (type == Storage.StoragePoolType.CLVM ||
+                                 type == Storage.StoragePoolType.CLVM_NG);
+        assert supportsShared;
+    }
+
+    @Test
+    public void testVolumeGroupNameExtraction() {
+        String vgName = "acsvg";
+        Mockito.when(mockPool.getLocalPath()).thenReturn(vgName);
+
+        String extractedVgName = mockPool.getLocalPath();
+
+        assert extractedVgName.equals("acsvg");
+        assert extractedVgName.matches("[a-zA-Z0-9_-]+");
+    }
+
+    @Test
+    public void testCLVMPoolDetailsContainSecureZeroFill() {
+        Map<String, String> details = new HashMap<>();
+        details.put("CLVM_SECURE_ZERO_FILL", "true");
+
+        boolean secureZeroEnabled = "true".equals(details.get("CLVM_SECURE_ZERO_FILL"));
+        assert secureZeroEnabled;
+    }
+
+    @Test
+    public void testCLVMPoolDetailsSecureZeroFillDisabled() {
+        Map<String, String> details = new HashMap<>();
+        details.put("CLVM_SECURE_ZERO_FILL", "false");
+
+        boolean secureZeroEnabled = "true".equals(details.get("CLVM_SECURE_ZERO_FILL"));
+        assert !secureZeroEnabled;
+    }
+
+    @Test
+    public void testCLVMPoolDetailsSecureZeroFillDefault() {
+        Map<String, String> details = new HashMap<>();
+
+        boolean secureZeroEnabled = "true".equals(details.get("CLVM_SECURE_ZERO_FILL"));
+        assert !secureZeroEnabled;
+    }
+
 }
diff --git a/plugins/integrations/veeam-control-service/pom.xml b/plugins/integrations/veeam-control-service/pom.xml
new file mode 100644
index 000000000000..ea9235c4b9a4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/pom.xml
@@ -0,0 +1,66 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>cloud-plugin-integrations-veeam-control-service</artifactId>
+    <name>Apache CloudStack Plugin - Veeam Control Service</name>
+    <parent>
+        <groupId>org.apache.cloudstack</groupId>
+        <artifactId>cloudstack-plugins</artifactId>
+        <version>4.23.0.0-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-utils</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-schema</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-servlet</artifactId>
+            <version>${cs.jetty.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-xml</artifactId>
+            <version>${cs.jackson.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-yaml</artifactId>
+            <version>${cs.jackson.version}</version>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java
new file mode 100644
index 000000000000..375222f47680
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.component.Adapter;
+
+public interface RouteHandler extends Adapter {
+    default int priority() { return 0; }
+    boolean canHandle(String method, String path) throws IOException;
+    void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io)
+            throws IOException;
+
+    default String getSanitizedPath(String path) {
+        // remove query params if exists
+        int qIdx = path.indexOf('?');
+        if (qIdx != -1) {
+            return path.substring(0, qIdx);
+        }
+        return path;
+    }
+
+    static String getRequestData(HttpServletRequest req, Logger logger) {
+        String data = RouteHandler.getRequestData(req);
+        if (VeeamControlService.DeveloperLogs.value()) {
+            logger.debug("Received method: {} request. Request-data: {}", req.getMethod(), data);
+        }
+        return data;
+    }
+
+    static String getRequestData(HttpServletRequest req) {
+        String contentType = req.getContentType();
+        if (contentType == null) {
+            return null;
+        }
+        String mime = contentType.split(";")[0].trim().toLowerCase();
+        if (!"application/json".equals(mime) && !"application/x-www-form-urlencoded".equals(mime)) {
+            return null;
+        }
+        try {
+            StringBuilder data = new StringBuilder();
+            String line;
+            try (BufferedReader reader = req.getReader()) {
+                while ((line = reader.readLine()) != null) {
+                    data.append(line);
+                }
+            }
+            return data.toString();
+        } catch (IOException ignored) {
+            return null;
+        }
+    }
+
+    static boolean isRequestAsync(HttpServletRequest req) {
+        String asyncStr = req.getParameter("async");
+        return Boolean.TRUE.toString().equals(asyncStr);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java
new file mode 100644
index 000000000000..a3bf87dbaf99
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java
@@ -0,0 +1,221 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.EnumSet;
+import java.util.Enumeration;
+import java.util.List;
+
+import javax.servlet.DispatcherType;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.utils.server.ServerPropertiesUtil;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.filter.AllowedClientCidrsFilter;
+import org.apache.cloudstack.veeam.filter.BearerOrBasicAuthFilter;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.eclipse.jetty.server.Handler;
+import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConnectionFactory;
+import org.eclipse.jetty.server.RequestLog;
+import org.eclipse.jetty.server.SecureRequestCustomizer;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
+import org.eclipse.jetty.server.handler.HandlerList;
+import org.eclipse.jetty.server.handler.RequestLogHandler;
+import org.eclipse.jetty.servlet.FilterHolder;
+import org.eclipse.jetty.servlet.ServletContextHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.jetbrains.annotations.NotNull;
+
+public class VeeamControlServer {
+    private static final Logger LOGGER = LogManager.getLogger(VeeamControlServer.class);
+
+    private final VeeamControlService veeamControlService;
+    private Server server;
+    private List<RouteHandler> routeHandlers;
+
+    public VeeamControlServer(List<RouteHandler> routeHandlers, VeeamControlService veeamControlService) {
+        this.routeHandlers = new ArrayList<>(routeHandlers);
+        this.routeHandlers.sort((a, b) -> Integer.compare(b.priority(), a.priority()));
+        this.veeamControlService = veeamControlService;
+    }
+
+    public void startIfEnabled() throws Exception {
+        final boolean enabled = VeeamControlService.Enabled.value();
+        if (!enabled) {
+            LOGGER.info("Veeam Control API server is disabled");
+            return;
+        }
+
+        final String keystorePath = ServerPropertiesUtil.getKeystoreFile();
+        final String keystorePassword = ServerPropertiesUtil.getKeystorePassword();
+        final String keyManagerPassword = ServerPropertiesUtil.getKeystorePassword();
+        final boolean sslConfigured = StringUtils.isNotEmpty(keystorePath) &&
+                StringUtils.isNotEmpty(keystorePassword) &&
+                StringUtils.isNotEmpty(keyManagerPassword) &&
+                Files.exists(Paths.get(keystorePath));
+        long managementServerHostId = veeamControlService.getCurrentManagementServerHostId();
+        final String bindAddress = VeeamControlService.BindAddress.valueIn(managementServerHostId);
+        final String bindHost = StringUtils.trimToNull(bindAddress);
+        final int port = VeeamControlService.Port.value();
+        final String bindDisplay = bindHost == null ?
+                String.format("all interfaces, port: %d", port) :
+                String.format("host: %s, port: %d", bindHost, port);
+        String ctxPath = VeeamControlService.ContextPath.value();
+        LOGGER.info("Veeam Control server - {}, context: {} with {} handlers",
+                bindDisplay,
+                ctxPath,
+                routeHandlers != null ? routeHandlers.size() : 0);
+
+
+        server = new Server();
+
+        if (sslConfigured) {
+            final SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
+            sslContextFactory.setKeyStorePath(keystorePath);
+            sslContextFactory.setKeyStorePassword(keystorePassword);
+            sslContextFactory.setKeyManagerPassword(keyManagerPassword);
+
+            final HttpConfiguration https = new HttpConfiguration();
+            https.setSecureScheme("https");
+            https.setSecurePort(port);
+            https.addCustomizer(new SecureRequestCustomizer());
+
+            final ServerConnector httpsConnector = new ServerConnector(
+                    server,
+                    new SslConnectionFactory(sslContextFactory, "http/1.1"),
+                    new HttpConnectionFactory(https)
+            );
+            httpsConnector.setHost(bindHost);
+            httpsConnector.setPort(port);
+            server.addConnector(httpsConnector);
+
+            LOGGER.info("Veeam Control API server HTTPS enabled on {}", bindDisplay);
+        } else {
+            final HttpConfiguration http = new HttpConfiguration();
+            final ServerConnector httpConnector = new ServerConnector(server, new HttpConnectionFactory(http));
+            httpConnector.setHost(bindHost);
+            httpConnector.setPort(port);
+            server.addConnector(httpConnector);
+
+            LOGGER.warn("Veeam Control API server HTTPS is NOT configured (missing keystore path/passwords). " +
+                    "Starting HTTP on {} instead.", bindDisplay);
+        }
+
+        final ServletContextHandler ctx =
+                new ServletContextHandler(ServletContextHandler.NO_SESSIONS);
+        ctx.setContextPath(ctxPath);
+
+        // CIDR filter for all routes
+        AllowedClientCidrsFilter cidrFilter = new AllowedClientCidrsFilter(veeamControlService);
+        FilterHolder cidrHolder = new FilterHolder(cidrFilter);
+        ctx.addFilter(cidrHolder, ApiRouteHandler.BASE_ROUTE + "/*", EnumSet.of(DispatcherType.REQUEST));
+
+        // Bearer or Basic Auth for all routes
+        BearerOrBasicAuthFilter authFilter = new BearerOrBasicAuthFilter(veeamControlService);
+        FilterHolder authHolder = new FilterHolder(authFilter);
+        ctx.addFilter(authHolder, ApiRouteHandler.BASE_ROUTE + "/*", EnumSet.of(DispatcherType.REQUEST));
+
+        // Front controller servlet
+        ctx.addServlet(new ServletHolder(new VeeamControlServlet(routeHandlers)), "/*");
+
+        // Create a RequestLog that logs every request handled by the server (all contexts/paths)
+        server.setHandler(buildContextHandler(ctx));
+
+        server.start();
+
+        LOGGER.info("Started Veeam Control API server on {}:{} with context {}", bindDisplay, port, ctxPath);
+    }
+
+    @NotNull
+    private static Handler buildContextHandler(ServletContextHandler ctx) {
+        // Handler for root ('/') path
+        final ServletContextHandler root = new ServletContextHandler(ServletContextHandler.NO_SESSIONS);
+        root.setContextPath("/");
+        root.addServlet(new ServletHolder(new HttpServlet() {
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+                    throws java.io.IOException {
+                resp.setContentType("text/plain");
+                resp.setStatus(HttpServletResponse.SC_OK);
+                resp.getWriter().println("Veeam Control API");
+            }
+
+            @Override
+            protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+                    throws java.io.IOException {
+                doGet(req, resp);
+            }
+        }), "/*");
+
+        final RequestLog requestLog = (request, response) -> {
+            LOGGER.debug("Handled request - {}",
+                    () -> getRequestResponseMetadata(request, response));
+        };
+
+        final RequestLogHandler requestLogHandler = new RequestLogHandler();
+        requestLogHandler.setRequestLog(requestLog);
+
+        // Attach both the configured context and the root handler; keep ctx first so contextPath has priority
+        final HandlerList handlers = new HandlerList();
+        handlers.setHandlers(new Handler[] { ctx, root });
+        requestLogHandler.setHandler(handlers);
+        return requestLogHandler;
+    }
+
+    public void stop() throws Exception {
+    if (server != null) {
+            server.stop();
+            server = null;
+        }
+    }
+
+    private static String getRequestResponseMetadata(HttpServletRequest request, HttpServletResponse response) {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("remote address: ").append(request.getRemoteAddr()).append(", ");
+        sb.append("method: ").append(request.getMethod()).append(", ");
+        sb.append("uri: ").append(request.getRequestURI())
+                .append(request.getQueryString() != null ? "?" + request.getQueryString() : "").append(", ");
+        if (VeeamControlService.DeveloperLogs.value()) {
+            sb.append("headers: [");
+            final Enumeration<String> headerNames = request.getHeaderNames();
+            while (headerNames.hasMoreElements()) {
+                final String name = headerNames.nextElement();
+                final Enumeration<String> values = request.getHeaders(name);
+                while (values.hasMoreElements()) {
+                    sb.append(name).append("=").append(values.nextElement()).append("; ");
+                }
+            }
+            sb.append("], ");
+        }
+        sb.append("status: ").append(response.getStatus());
+        return sb.toString();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java
new file mode 100644
index 000000000000..9255ab34aed2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java
@@ -0,0 +1,89 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.util.List;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.utils.CloudStackVersion;
+
+import com.cloud.utils.component.PluggableService;
+
+public interface VeeamControlService extends PluggableService, Configurable {
+    String PLUGIN_NAME = "CloudStack Veeam Control Service";
+
+    ConfigKey<Boolean> Enabled = new ConfigKey<>("Advanced", Boolean.class, "integration.veeam.control.enabled",
+            "false", "Enable the Veeam Integration REST API server", false);
+    ConfigKey<String> BindAddress = new ConfigKey<>("Advanced", String.class, "integration.veeam.control.bind.address",
+            "", "Bind address for Veeam Integration REST API server", false,
+            ConfigKey.Scope.ManagementServer);
+    ConfigKey<Integer> Port = new ConfigKey<>("Advanced", Integer.class, "integration.veeam.control.port",
+            "8090", "Port for Veeam Integration REST API server", false);
+    ConfigKey<String> ContextPath = new ConfigKey<>("Advanced", String.class, "integration.veeam.control.context.path",
+            "/ovirt-engine", "Context path for Veeam Integration REST API server", false);
+    ConfigKey<String> Username = new ConfigKey<>("Secure", String.class, "integration.veeam.control.api.username",
+            "veeam", "Username for Basic Auth on Veeam Integration REST API server", true);
+    ConfigKey<String> Password = new ConfigKey<>("Secure", String.class, "integration.veeam.control.api.password",
+            "change-me", "Password for Basic Auth on Veeam Integration REST API server", true);
+    ConfigKey<String> ServiceAccountId = new ConfigKey<>("Advanced", String.class,
+            "integration.veeam.control.service.account", "",
+            "ID of the service account that the Veeam Control Service uses to perform operations on " +
+                    "resources.This account should be a Root-Admin.",
+            true);
+    ConfigKey<Boolean> InstanceRestoreAssignOwner = new ConfigKey<>("Advanced", Boolean.class,
+            "integration.veeam.control.instance.restore.assign.owner",
+            "false", "Attempt to assign restored Instance to the owner based on OVF and network " +
+            "details. If the assignment fails or set to false then the Instance will remain owned by the service " +
+            "account", true);
+    ConfigKey<Boolean> InstanceEncryptVolumes = new ConfigKey<>("Advanced", Boolean.class,
+            "integration.veeam.control.instance.encrypt.volumes",
+            "false", "Whether to always use offerings with encryption enabled when creating volumes " +
+            "and Instances. If false, offerings will be selected without explicitly considering encryption based on " +
+            "backup metadata, availability and order.", true, ConfigKey.Scope.Zone);
+    ConfigKey<String> AllowedClientCidrs = new ConfigKey<>("Advanced", String.class,
+            "integration.veeam.control.allowed.client.cidrs",
+            "", "Comma-separated list of CIDR blocks representing clients allowed to access the API. " +
+                    "If empty, all clients will be allowed. Example: '192.168.1.1/24,192.168.2.100/32", true);
+
+    ConfigKey<Boolean> DeveloperLogs = new ConfigKey<>("Developer", Boolean.class, "integration.veeam.control.developer.logs",
+            "false", "Enable verbose logging for development and troubleshooting purposes. " +
+            "Logs will include detailed information about API requests, responses, and internal operations.", false);
+
+    long getCurrentManagementServerHostId();
+
+    List<String> getAllowedClientCidrs();
+
+    String getInstanceId();
+
+    boolean validateCredentials(String username, String password);
+
+    String getHmacSecret();
+
+    static String getPackageVersion() {
+        return VeeamControlService.class.getPackage().getImplementationVersion();
+    }
+
+    static CloudStackVersion getCSVersion() {
+        try {
+            return CloudStackVersion.parse(getPackageVersion());
+        } catch (Exception e) {
+            return null;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java
new file mode 100644
index 000000000000..3ad5d2390978
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java
@@ -0,0 +1,157 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.utils.cache.SingleCache;
+import org.apache.cloudstack.utils.identity.ManagementServerNode;
+import org.apache.cloudstack.veeam.utils.DataUtil;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
+import com.cloud.user.AccountService;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.net.NetUtils;
+
+public class VeeamControlServiceImpl extends ManagerBase implements VeeamControlService {
+
+    @Inject
+    ManagementServerHostDao managementServerHostDao;
+
+    @Inject
+    AccountService accountService;
+
+    private List<RouteHandler> routeHandlers;
+    private VeeamControlServer veeamControlServer;
+    private SingleCache<List<String>> allowedClientCidrsCache;
+
+    protected List<String> getAllowedClientCidrsInternal() {
+        String allowedClientCidrsStr = AllowedClientCidrs.value();
+        if (StringUtils.isBlank(allowedClientCidrsStr)) {
+            return Collections.emptyList();
+        }
+        List<String> allowedClientCidrs = List.of(allowedClientCidrsStr.split(","));
+        // Sanitize and remove any incorrect CIDR entries
+        allowedClientCidrs = allowedClientCidrs.stream()
+                .map(String::trim)
+                .filter(StringUtils::isNotBlank)
+                .filter(cidr -> {
+                    boolean valid = NetUtils.isValidIp4Cidr(cidr);
+                    if (!valid) {
+                        logger.warn("Invalid CIDR entry '{}' in allowed client CIDRs, ignoring", cidr);
+                    }
+                    return valid;
+                }).collect(Collectors.toList());
+        return allowedClientCidrs;
+    }
+
+    public List<RouteHandler> getRouteHandlers() {
+        return routeHandlers;
+    }
+
+    public void setRouteHandlers(final List<RouteHandler> routeHandlers) {
+        this.routeHandlers = routeHandlers;
+    }
+
+    @Override
+    public long getCurrentManagementServerHostId() {
+        ManagementServerHostVO hostVO =
+                managementServerHostDao.findByMsid(ManagementServerNode.getManagementServerId());
+        return hostVO.getId();
+    }
+
+    @Override
+    public List<String> getAllowedClientCidrs() {
+        return allowedClientCidrsCache.get();
+    }
+
+    @Override
+    public String getInstanceId() {
+        return accountService.getSystemAccount().getUuid();
+    }
+
+    @Override
+    public boolean validateCredentials(String username, String password) {
+        return DataUtil.constantTimeEquals(Username.value(), username) &&
+                DataUtil.constantTimeEquals(Password.value(), password);
+    }
+
+    @Override
+    public String getHmacSecret() {
+        String base = getInstanceId() + ":" + Port.value() + ":" + Username.value() + Password.value();
+        return UuidUtils.nameUUIDFromBytes(base.getBytes(StandardCharsets.UTF_8)).toString();
+    }
+
+    @Override
+    public boolean start() {
+        allowedClientCidrsCache = new SingleCache<>(30, this::getAllowedClientCidrsInternal);
+        veeamControlServer = new VeeamControlServer(getRouteHandlers(), this);
+        try {
+            veeamControlServer.startIfEnabled();
+        } catch (Exception e) {
+            logger.error("Failed to start Veeam Control API server, continuing without it", e);
+        }
+        return true;
+    }
+
+    @Override
+    public boolean stop() {
+        try {
+            veeamControlServer.stop();
+        } catch (Exception e) {
+            logger.error("Failed to stop Veeam Control API server cleanly", e);
+        }
+        return true;
+    }
+
+    @Override
+    public List<Class<?>> getCommands() {
+        return List.of();
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return VeeamControlService.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[] {
+                Enabled,
+                BindAddress,
+                Port,
+                ContextPath,
+                Username,
+                Password,
+                ServiceAccountId,
+                InstanceRestoreAssignOwner,
+                InstanceEncryptVolumes,
+                AllowedClientCidrs,
+                DeveloperLogs
+        };
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java
new file mode 100644
index 000000000000..493fb00ebe7e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.ResponseWriter;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public class VeeamControlServlet extends HttpServlet {
+    private static final Logger LOGGER = LogManager.getLogger(VeeamControlServlet.class);
+    private static final boolean LOG_REQUESTS = false;
+
+    private final ResponseWriter writer;
+    private final Mapper mapper;
+    private final List<RouteHandler> routeHandlers;
+
+    public VeeamControlServlet(List<RouteHandler> routeHandlers) {
+        this.routeHandlers = routeHandlers;
+        mapper = new Mapper();
+        writer = new ResponseWriter(mapper);
+    }
+
+    public ResponseWriter getWriter() {
+        return writer;
+    }
+
+    public Mapper getMapper() {
+        return mapper;
+    }
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp) throws IOException, ServletException {
+        String method = req.getMethod();
+        String path = normalize(req);
+        Negotiation.OutFormat outFormat = Negotiation.responseFormat(req);
+
+        LOGGER.info("Received {} request for {} with out format: {}", method, path, outFormat);
+
+        logRequest(req, method, path);
+
+        try {
+            if ("/".equals(path)) {
+                handleRoot(req, resp, outFormat);
+                return;
+            }
+
+            if (CollectionUtils.isNotEmpty(this.routeHandlers)) {
+                for (RouteHandler handler : this.routeHandlers) {
+                    if (handler.canHandle(method, path)) {
+                        handler.handle(req, resp, path, outFormat, this);
+                        return;
+                    }
+                }
+            }
+            notFound(resp, null, outFormat);
+        } catch (Error e) {
+            writer.writeFault(resp, e.status, e.message, null, outFormat);
+        }
+    }
+
+    private static void logRequest(HttpServletRequest req, String method, String path) {
+        if (!LOG_REQUESTS) {
+            return;
+        }
+        // Add a log to give all info about the request
+        try {
+            StringBuilder details = new StringBuilder();
+            details.append("Request details: Method: ").append(method).append(", Path: ").append(path);
+            details.append(", Query: ").append(req.getQueryString() == null ? "" : req.getQueryString());
+            details.append(", Headers: ");
+            java.util.Enumeration<String> headerNames = req.getHeaderNames();
+            while (headerNames != null && headerNames.hasMoreElements()) {
+                String name = headerNames.nextElement();
+                details.append(name).append("=").append(req.getHeader(name)).append("; ");
+            }
+            LOGGER.debug(details.toString());
+        } catch (Exception e) {
+            LOGGER.debug("Failed to capture request details", e);
+        }
+    }
+
+    private String normalize(HttpServletRequest req) {
+        String path = req.getPathInfo();
+        if (path == null || path.isBlank()) {
+            path = req.getRequestURI();
+        }
+        if (path == null || path.isBlank()) {
+            return "/";
+        }
+        return path;
+    }
+
+    protected void handleRoot(HttpServletRequest req, HttpServletResponse resp, Negotiation.OutFormat outFormat)
+            throws IOException {
+
+        String method = req.getMethod();
+        if (!"GET".equals(method) && !"POST".equals(method)) {
+            throw Error.badRequest("Unsupported method for root: " + method);
+        }
+        Map<String, String> responseData = new HashMap<>();
+        responseData.put("name", VeeamControlService.PLUGIN_NAME);
+        responseData.put("pluginVersion", this.getClass().getPackage().getImplementationVersion());
+
+        writer.write(resp, 200, responseData, outFormat);
+    }
+
+    public void methodNotAllowed(final HttpServletResponse resp, final String allow, final Negotiation.OutFormat outFormat) throws IOException {
+        resp.setHeader("Allow", allow);
+        writer.writeFault(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, "Method Not Allowed", "Allowed methods: " + allow, outFormat);
+    }
+
+    public void badRequest(final HttpServletResponse resp, String detail, Negotiation.OutFormat outFormat) throws IOException {
+        writer.writeFault(resp, HttpServletResponse.SC_BAD_REQUEST, "Bad request", detail, outFormat);
+    }
+
+
+    public void notFound(final HttpServletResponse resp, String detail, Negotiation.OutFormat outFormat) throws IOException {
+        writer.writeFault(resp, HttpServletResponse.SC_NOT_FOUND, "Not found", detail, outFormat);
+    }
+
+    public static class Error extends RuntimeException {
+        final int status;
+        final String message;
+        public Error(int status, String message) {
+            super(message);
+            this.status = status;
+            this.message = message;
+        }
+        public static Error badRequest(String msg) { return new Error(400, msg); }
+        public static Error unauthorized(String msg) { return new Error(401, msg); }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java
new file mode 100644
index 000000000000..4bb6de06e47e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java
@@ -0,0 +1,31 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.apache.cloudstack.api.BaseCmd;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface ApiAccess {
+    Class<? extends BaseCmd> command();
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java
new file mode 100644
index 000000000000..b0cd0cd33781
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java
@@ -0,0 +1,68 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.lang.reflect.Method;
+
+import javax.inject.Inject;
+
+import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+
+public class ApiAccessInterceptor implements MethodInterceptor {
+    @Inject
+    AccountManager accountManager;
+
+    @Override
+    public Object invoke(MethodInvocation invocation) throws Throwable {
+        Method m = invocation.getMethod();
+        Object target = invocation.getThis();
+        if (target == null) {
+            return invocation.proceed();
+        }
+
+        ApiAccess access = m.getAnnotation(ApiAccess.class);
+        if (access == null) {
+            m = target.getClass().getMethod(m.getName(), m.getParameterTypes());
+            access = m.getAnnotation(ApiAccess.class);
+        }
+        if (access == null) {
+            return invocation.proceed();
+        }
+
+        ServerAdapter adapter = (ServerAdapter) target;
+        Pair<User, Account> serviceUserAccount = adapter.getServiceAccount();
+        String apiName = BaseCmd.getCommandNameByClass(access.command());
+
+        accountManager.checkApiAccess(serviceUserAccount.second(), apiName);
+
+        CallContext.register(serviceUserAccount.first(), serviceUserAccount.second());
+        try {
+            return invocation.proceed();
+        } finally {
+            CallContext.unregister();
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
new file mode 100644
index 000000000000..510ad74d1558
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
@@ -0,0 +1,2188 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.SecurityChecker;
+import org.apache.cloudstack.affinity.AffinityGroupVO;
+import org.apache.cloudstack.affinity.dao.AffinityGroupDao;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiServerService;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.command.admin.cluster.ListClustersCmd;
+import org.apache.cloudstack.api.command.admin.host.ListHostsCmd;
+import org.apache.cloudstack.api.command.admin.storage.ListStoragePoolsCmd;
+import org.apache.cloudstack.api.command.admin.vm.AssignVMCmd;
+import org.apache.cloudstack.api.command.admin.vm.DeployVMCmdByAdmin;
+import org.apache.cloudstack.api.command.admin.vm.DestroyVMCmdByAdmin;
+import org.apache.cloudstack.api.command.user.backup.ListBackupsCmd;
+import org.apache.cloudstack.api.command.user.job.ListAsyncJobsCmd;
+import org.apache.cloudstack.api.command.user.network.ListNetworksCmd;
+import org.apache.cloudstack.api.command.user.offering.ListServiceOfferingsCmd;
+import org.apache.cloudstack.api.command.user.tag.CreateTagsCmd;
+import org.apache.cloudstack.api.command.user.tag.ListTagsCmd;
+import org.apache.cloudstack.api.command.user.vm.AddNicToVMCmd;
+import org.apache.cloudstack.api.command.user.vm.DeployVMCmd;
+import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
+import org.apache.cloudstack.api.command.user.vm.ListNicsCmd;
+import org.apache.cloudstack.api.command.user.vm.ListVMsCmd;
+import org.apache.cloudstack.api.command.user.vm.StartVMCmd;
+import org.apache.cloudstack.api.command.user.vm.StopVMCmd;
+import org.apache.cloudstack.api.command.user.vm.UpdateVMCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.CreateVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.DeleteVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.ListVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.RevertToVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.volume.AssignVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.AttachVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.CreateVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.DestroyVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.DetachVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.ListVolumesCmd;
+import org.apache.cloudstack.api.command.user.volume.UpdateVolumeCmd;
+import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ServiceOfferingResponse;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.ImageTransfer.Direction;
+import org.apache.cloudstack.backup.ImageTransfer.Format;
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.jobs.dao.AsyncJobDao;
+import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.query.QueryService;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.sharedfs.SharedFS;
+import org.apache.cloudstack.storage.sharedfs.SharedFSService;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.converter.AsyncJobJoinVOToJobConverter;
+import org.apache.cloudstack.veeam.api.converter.BackupVOToBackupConverter;
+import org.apache.cloudstack.veeam.api.converter.ClusterVOToClusterConverter;
+import org.apache.cloudstack.veeam.api.converter.DataCenterJoinVOToDataCenterConverter;
+import org.apache.cloudstack.veeam.api.converter.HostJoinVOToHostConverter;
+import org.apache.cloudstack.veeam.api.converter.ImageTransferVOToImageTransferConverter;
+import org.apache.cloudstack.veeam.api.converter.NetworkVOToNetworkConverter;
+import org.apache.cloudstack.veeam.api.converter.NetworkVOToVnicProfileConverter;
+import org.apache.cloudstack.veeam.api.converter.NicVOToNicConverter;
+import org.apache.cloudstack.veeam.api.converter.ResourceTagVOToTagConverter;
+import org.apache.cloudstack.veeam.api.converter.StoreVOToStorageDomainConverter;
+import org.apache.cloudstack.veeam.api.converter.UserVmJoinVOToVmConverter;
+import org.apache.cloudstack.veeam.api.converter.UserVmVOToCheckpointConverter;
+import org.apache.cloudstack.veeam.api.converter.VmSnapshotVOToSnapshotConverter;
+import org.apache.cloudstack.veeam.api.converter.VolumeJoinVOToDiskConverter;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.utils.CloudConfigUtil;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+import com.cloud.api.query.dao.AsyncJobJoinDao;
+import com.cloud.api.query.dao.DataCenterJoinDao;
+import com.cloud.api.query.dao.HostJoinDao;
+import com.cloud.api.query.dao.StoragePoolJoinDao;
+import com.cloud.api.query.dao.UserVmJoinDao;
+import com.cloud.api.query.dao.VolumeJoinDao;
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.domain.Domain;
+import com.cloud.domain.dao.DomainDao;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.Networks;
+import com.cloud.network.as.AutoScaleVmGroupVmMapVO;
+import com.cloud.network.as.dao.AutoScaleVmGroupVmMapDao;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.security.SecurityGroupVMMapVO;
+import com.cloud.network.security.SecurityGroupVO;
+import com.cloud.network.security.dao.SecurityGroupDao;
+import com.cloud.network.security.dao.SecurityGroupVMMapDao;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.org.Grouping;
+import com.cloud.projects.Project;
+import com.cloud.projects.ProjectManager;
+import com.cloud.server.ResourceTag;
+import com.cloud.server.TaggedResourceService;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.GuestOS;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeApiService;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.DiskOfferingDao;
+import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import com.cloud.tags.ResourceTagVO;
+import com.cloud.tags.dao.ResourceTagDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.DomainService;
+import com.cloud.user.SSHKeyPairVO;
+import com.cloud.user.User;
+import com.cloud.user.UserDataVO;
+import com.cloud.user.dao.SSHKeyPairDao;
+import com.cloud.user.dao.UserDataDao;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.EnumUtils;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.component.ComponentContext;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallbackWithException;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+
+public class ServerAdapter extends ManagerBase {
+    private static final List<Storage.StoragePoolType> SUPPORTED_STORAGE_TYPES = Arrays.asList(
+            Storage.StoragePoolType.Filesystem,
+            Storage.StoragePoolType.NetworkFilesystem,
+            Storage.StoragePoolType.SharedMountPoint
+    );
+    private static final String VM_TAG_KEY = "veeam_tag";
+    private static final String WORKER_VM_GUEST_CPU_MODE = "host-passthrough";
+    private static final String WORKER_VM_GUEST_OS = "Rocky Linux 9";
+    private static final String WORKER_VM_IP_DETAIL = "worker.vm.ip";
+    private static final String RESTORE_CONFIG = "restore.config";
+
+    @Inject
+    AccountService accountService;
+
+    @Inject
+    DataCenterDao dataCenterDao;
+
+    @Inject
+    DataCenterJoinDao dataCenterJoinDao;
+
+    @Inject
+    StoragePoolJoinDao storagePoolJoinDao;
+
+    @Inject
+    ClusterDao clusterDao;
+
+    @Inject
+    HostJoinDao hostJoinDao;
+
+    @Inject
+    NetworkDao networkDao;
+
+    @Inject
+    UserVmDao userVmDao;
+
+    @Inject
+    UserVmJoinDao userVmJoinDao;
+
+    @Inject
+    VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Inject
+    VolumeDao volumeDao;
+
+    @Inject
+    VolumeJoinDao volumeJoinDao;
+
+    @Inject
+    VolumeDetailsDao volumeDetailsDao;
+
+    @Inject
+    VolumeApiService volumeApiService;
+
+    @Inject
+    PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Inject
+    ImageTransferDao imageTransferDao;
+
+    @Inject
+    KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    QueryService queryService;
+
+    @Inject
+    ServiceOfferingDao serviceOfferingDao;
+
+    @Inject
+    VMTemplateDao templateDao;
+
+    @Inject
+    UserVmManager userVmManager;
+
+    @Inject
+    NicDao nicDao;
+
+    @Inject
+    ApiServerService apiServerService;
+
+    @Inject
+    AsyncJobDao asyncJobDao;
+
+    @Inject
+    AsyncJobJoinDao asyncJobJoinDao;
+
+    @Inject
+    VMSnapshotDao vmSnapshotDao;
+
+    @Inject
+    BackupDao backupDao;
+
+    @Inject
+    ResourceTagDao resourceTagDao;
+
+    @Inject
+    NetworkModel networkModel;
+
+    @Inject
+    ProjectManager projectManager;
+
+    @Inject
+    AffinityGroupDao affinityGroupDao;
+
+    @Inject
+    UserDataDao userDataDao;
+
+    @Inject
+    DomainService domainService;
+
+    @Inject
+    DomainDao domainDao;
+
+    @Inject
+    TaggedResourceService taggedResourceService;
+
+    @Inject
+    SSHKeyPairDao sshKeyPairDao;
+
+    @Inject
+    GuestOSDao guestOSDao;
+
+    @Inject
+    SecurityGroupDao securityGroupDao;
+
+    @Inject
+    SecurityGroupVMMapDao securityGroupVMMapDao;
+
+    @Inject
+    SharedFSService sharedFSService;
+
+    @Inject
+    AutoScaleVmGroupVmMapDao autoScaleVmGroupVmMapDao;
+
+    @Inject
+    DiskOfferingDao diskOfferingDao;
+
+    protected static Map<String, Tag> getDummyTags() {
+        Map<String, Tag> tags = new HashMap<>();
+        Tag rootTag = ResourceTagVOToTagConverter.getRootTag();
+        tags.put(rootTag.getId(), rootTag);
+        return tags;
+    }
+
+    protected void waitForJobCompletion(long jobId) {
+        long timeoutNanos = TimeUnit.MINUTES.toNanos(5);
+        final long deadline = System.nanoTime() + timeoutNanos;
+        long sleepMillis = 500;
+        while (true) {
+            AsyncJobVO job = asyncJobDao.findByIdIncludingRemoved(jobId);
+            if (job == null) {
+                logger.warn("Async job with ID {} not found", jobId);
+                return;
+            }
+            if (job.getStatus() == AsyncJobVO.Status.SUCCEEDED || job.getStatus() == AsyncJobVO.Status.FAILED) {
+                return;
+            }
+            if (System.nanoTime() > deadline) {
+                logger.warn("Timed out waiting for {} completion", job);
+            }
+            try {
+                Thread.sleep(sleepMillis);
+                // back off gradually to reduce DB pressure
+                sleepMillis = Math.min(5000, sleepMillis + 500);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                logger.warn("Interrupted while waiting for async job completion");
+            }
+        }
+    }
+
+    protected void waitForJobCompletion(AsyncJobJoinVO job) {
+        if (job == null) {
+            logger.warn("Async job not found");
+            return;
+        }
+        if (job.getStatus() == AsyncJobVO.Status.SUCCEEDED.ordinal() ||
+                job.getStatus() == AsyncJobVO.Status.FAILED.ordinal()) {
+            logger.warn("Async job with ID {} already completed with status {}", job.getId(), job.getStatus());
+        }
+        waitForJobCompletion(job.getId());
+    }
+
+    protected ApiServerService.AsyncCmdResult processAsyncCmdWithContext(BaseAsyncCmd cmd, Map<String, String> params)
+            throws Exception {
+        final CallContext ctx = CallContext.current();
+        final long callerUserId = ctx.getCallingUserId();
+        final Account caller = ctx.getCallingAccount();
+        return apiServerService.processAsyncCmd(cmd, params, ctx, callerUserId, caller);
+    }
+
+    protected Account getOwnerForInstanceCreation(Vm request) {
+        if (!VeeamControlService.InstanceRestoreAssignOwner.value()) {
+            return null;
+        }
+        String accountUuid = request.getAccountId();
+        if (StringUtils.isBlank(accountUuid)) {
+            return null;
+        }
+        Account account = accountService.getActiveAccountByUuid(accountUuid);
+        if (account == null) {
+            logger.warn("Account with ID {} not found, unable to determine owner for VM creation request", accountUuid);
+            return null;
+        }
+        return account;
+    }
+
+    protected Ternary<Long, String, Long> getOwnerDetailsForInstanceCreation(Account account) {
+        if (account == null) {
+            return new Ternary<>(null, null, null);
+        }
+        String accountName = account.getAccountName();
+        Long projectId = null;
+        if (Account.Type.PROJECT.equals(account.getType())) {
+            Project project = projectManager.findByProjectAccountId(account.getId());
+            if (project == null) {
+                logger.warn("Project for {} not found, unable to determine owner for VM creation request", account);
+                return new Ternary<>(null, null, null);
+            }
+            projectId = project.getId();
+            accountName = null;
+        }
+        return new Ternary<>(account.getDomainId(), accountName, projectId);
+    }
+
+    protected Pair<List<Long>, String> getResourceOwnerFilters() {
+        final Account caller = CallContext.current().getCallingAccount();
+        final Account.Type type = caller.getType();
+        if (Account.Type.ADMIN.equals(type)) {
+            return new Pair<>(null, null);
+        }
+        List<Long> permittedAccountIds = null;
+        String domainPath = null;
+        if (Account.Type.DOMAIN_ADMIN.equals(type) || Account.Type.NORMAL.equals(type)) {
+            permittedAccountIds = projectManager.listPermittedProjectAccounts(caller.getId());
+            permittedAccountIds.add(caller.getId());
+        }
+        if (Account.Type.DOMAIN_ADMIN.equals(type)) {
+            Domain domain = domainService.getDomain(caller.getDomainId());
+            if (domain == null) {
+                throw new InvalidParameterValueException("Invalid service account specified");
+            }
+            domainPath = domain.getPath();
+        }
+        if (Account.Type.PROJECT.equals(type)) {
+            Project project = projectManager.findByProjectAccountId(caller.getId());
+            if (project == null) {
+                throw new InvalidParameterValueException("Invalid service account specified");
+            }
+            permittedAccountIds = new ArrayList<>();
+            permittedAccountIds.add(caller.getId());
+        }
+        return new Pair<>(permittedAccountIds, domainPath);
+    }
+
+    protected Pair<List<Long>, List<Long>> getResourceOwnerFiltersWithDomainIds() {
+        Pair<List<Long>, String> filters = getResourceOwnerFilters();
+        if (StringUtils.isNotBlank(filters.second())) {
+            return new Pair<>(filters.first(), domainDao.getDomainChildrenIds(filters.second()));
+        }
+        return new Pair<>(filters.first(), null);
+    }
+
+    protected ServiceOfferingVO getServiceOfferingFromRequest(com.cloud.dc.DataCenter zone, Account account,
+                      String uuid, int cpu, int memory) {
+        if (StringUtils.isBlank(uuid)) {
+            return null;
+        }
+        ServiceOfferingVO offering = serviceOfferingDao.findByUuid(uuid);
+        if (offering == null) {
+            logger.warn("Service offering with ID {} linked with the VM request not found", uuid);
+            return null;
+        }
+        try {
+            accountService.checkAccess(account, offering, zone);
+        } catch (PermissionDeniedException e) {
+            logger.warn("{} linked with the VM request is not accessible for the account {} in zone: {}",
+                    offering, account, zone);
+            return null;
+        }
+        if (!offering.isCustomized() && (offering.getCpu() != cpu || offering.getRamSize() != memory)) {
+            logger.warn("{} linked with the VM request has different CPU or memory than requested. Requested CPU: {}, requested memory: {}",
+                    offering, cpu, memory);
+            return null;
+        }
+        if (offering.isCustomized()) {
+            Map<String, String> params = Map.of(
+                    VmDetailConstants.CPU_NUMBER, String.valueOf(cpu),
+                    VmDetailConstants.MEMORY, String.valueOf(memory)
+            );
+            try {
+                userVmManager.validateCustomParameters(offering, params);
+                offering.setCpu(cpu);
+                offering.setRamSize(memory);
+            } catch (InvalidParameterValueException e) {
+                logger.warn("{} linked with the VM request is customized but does not support requested CPU or memory. Requested CPU: {}, requested memory: {}",
+                        offering, cpu, memory);
+                return null;
+            }
+        }
+        if (VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId())) {
+            DiskOfferingVO diskOfferingVO = diskOfferingDao.findById(offering.getDiskOfferingId());
+            if (!diskOfferingVO.getEncrypt()) {
+                logger.warn("{} is set to true, but {} linked with the VM request does not support encrypted volumes.",
+                        VeeamControlService.InstanceEncryptVolumes.key(), offering);
+                return null;
+            }
+        }
+        return offering;
+    }
+
+    protected ServiceOffering getServiceOfferingIdForVmCreation(com.cloud.dc.DataCenter zone, Account account,
+                    String serviceOfferingUuid, int cpu, int memory) {
+        ServiceOfferingVO offering = getServiceOfferingFromRequest(zone, account, serviceOfferingUuid, cpu, memory);
+        if (offering != null) {
+            return offering;
+        }
+        ListServiceOfferingsCmd cmd = new ListServiceOfferingsCmd();
+        ComponentContext.inject(cmd);
+        cmd.setZoneId(zone.getId());
+        cmd.setCpuNumber(cpu);
+        cmd.setMemory(memory);
+        if (VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId())) {
+            logger.debug("{} is set to true, filtering service offerings that support encrypted volumes",
+                    VeeamControlService.InstanceEncryptVolumes.key());
+            cmd.setEncryptRoot(true);
+        }
+        ListResponse<ServiceOfferingResponse> offerings = queryService.searchForServiceOfferings(cmd);
+        if (offerings.getResponses().isEmpty()) {
+            return null;
+        }
+        String uuid = offerings.getResponses().get(0).getId();
+        offering = serviceOfferingDao.findByUuid(uuid);
+        if (offering.isCustomized()) {
+            offering.setCpu(cpu);
+            offering.setRamSize(memory);
+        }
+        return offering;
+    }
+
+    protected GuestOS getGuestOsForInstance(Vm request) {
+        if (request.isWorkerVm()) {
+            GuestOS os = guestOSDao.findOneByDisplayName(WORKER_VM_GUEST_OS);
+            if (os == null) {
+                logger.warn("Guest OS with name {} for worker VM not found, VM will be created with default guest OS",
+                        WORKER_VM_GUEST_OS);
+            }
+            return os;
+        }
+        final String guestOsId = request.getGuestOsId();
+        final String guestOsName = request.getGuestOsName();
+        if (StringUtils.isAllBlank(guestOsId, guestOsName)) {
+            return null;
+        }
+        GuestOS os = null;
+        if (StringUtils.isNotBlank(guestOsId)) {
+            os = guestOSDao.findByUuid(guestOsId);
+        }
+        if (os == null && StringUtils.isNotBlank(guestOsName)) {
+            os = guestOSDao.findOneByDisplayName(guestOsName);
+        }
+        if (os == null) {
+            logger.debug("Guest OS could not be identified with ID: {} and name: {} for the VM request",
+                    guestOsId, guestOsName);
+        }
+        return os;
+    }
+
+    protected VMTemplateVO getTemplateForInstanceCreation(String templateUuid, GuestOS guestOs) {
+        if (StringUtils.isBlank(templateUuid)) {
+            return null;
+        }
+        VMTemplateVO template = templateDao.findByUuid(templateUuid);
+        if (template == null) {
+            logger.warn("Template with ID {} not found, guest OS: {}, VM will be created with default template",
+                    guestOs, templateUuid);
+            return null;
+        }
+        return template;
+    }
+
+    protected List<String> getValidatedSshKeyPairNames(String sshKeyPairNames, Account owner) {
+        if (StringUtils.isBlank(sshKeyPairNames)) {
+            return null;
+        }
+        List<String> sshKeys = Arrays.stream(sshKeyPairNames.split(","))
+                .map(String::trim)
+                .filter(StringUtils::isNotEmpty)
+                .collect(Collectors.toList());
+        Account account = owner != null ? owner : CallContext.current().getCallingAccount();
+        List<SSHKeyPairVO> keyPairs = sshKeyPairDao.findByNames(account.getId(), account.getDomainId(), sshKeys);
+        List<String> validatedNames = keyPairs.stream().map(SSHKeyPairVO::getName).collect(Collectors.toList());
+        if (sshKeys.size() != validatedNames.size()) {
+            logger.warn("Some SSH key pairs specified in the VM creation request were not found for {}. " +
+                            "Specified SSH key pairs: [{}], valid SSH key pairs: [{}]",
+                    account, StringUtils.join(sshKeys, ","), StringUtils.join(validatedNames, ","));
+        }
+        return validatedNames;
+    }
+
+    protected AffinityGroupVO getValidatedAffinityGroup(String affinityGroupUuid) {
+        if (StringUtils.isBlank(affinityGroupUuid)) {
+            return null;
+        }
+        AffinityGroupVO group = affinityGroupDao.findByUuid(affinityGroupUuid);
+        if (group == null) {
+            logger.warn("Failed to find affinity group with ID {} specified in Instance creation request, " +
+                    "skipping affinity group assignment", affinityGroupUuid);
+            return null;
+        }
+        return group;
+    }
+
+    protected UserDataVO getValidatedUserdata(String userdataUuid) {
+        if (StringUtils.isBlank(userdataUuid)) {
+            return null;
+        }
+        UserDataVO userDataVO = userDataDao.findByUuid(userdataUuid);
+        if (userDataVO == null) {
+            logger.warn("Failed to find userdata with ID {} specified in Instance creation request, " +
+                    "skipping userdata assignment", userdataUuid);
+            return null;
+        }
+        return userDataVO;
+    }
+
+    protected SecurityGroupVO getValidatedSecurityGroup(String securityGroupUuid) {
+        if (StringUtils.isBlank(securityGroupUuid)) {
+            return null;
+        }
+        SecurityGroupVO group = securityGroupDao.findByUuid(securityGroupUuid);
+        if (group == null) {
+            logger.warn("Failed to find security group with ID {} specified in Instance creation request, " +
+                    "skipping its assignment", securityGroupUuid);
+            return null;
+        }
+        return group;
+    }
+
+    protected List<Long> getValidatedSecurityGroups(List<String> uuids, long vmId) {
+        if (CollectionUtils.isEmpty(uuids)) {
+            return null;
+        }
+        List<SecurityGroupVO> instanceGroups = getSecurityGroupsForInstance(vmId);
+        Set<Long> existingIds = CollectionUtils.isNotEmpty(instanceGroups)
+                ? instanceGroups.stream().map(SecurityGroupVO::getId).collect(Collectors.toSet())
+                : new HashSet<>();
+        Set<Long> requestedIds = uuids.stream()
+                .map(uuid -> {
+                    SecurityGroupVO group = getValidatedSecurityGroup(uuid);
+                    return group != null ? group.getId() : null;
+                })
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+        if (CollectionUtils.isEmpty(requestedIds)) {
+            return null;
+        }
+        Set<Long> mergedIds = new HashSet<>(existingIds);
+        mergedIds.addAll(requestedIds);
+        if (mergedIds.equals(existingIds)) {
+            return null;
+        }
+        return new ArrayList<>(mergedIds);
+    }
+
+    protected String getValidatedInstanceType(Vm request) {
+        String instanceType = StringUtils.trimToNull(request.getInstanceType());
+        if (StringUtils.isEmpty(request.getInstanceType())) {
+            return null;
+        }
+        if (!UserVmManager.SHAREDFSVM.equals(instanceType)) {
+            logger.warn("{} is not supported for restore, returning null Instance type");
+            return null;
+        }
+        if (StringUtils.isBlank(request.getSharedFSId())) {
+            logger.warn("Shared Filesystem ID not available, returning null Instance type");
+            return null;
+        }
+        SharedFS sharedFS = sharedFSService.getSharedFSByUuid(request.getSharedFSId());
+        if (sharedFS == null) {
+            logger.warn("Shared Filesystem for ID: {} not found, returning null Instance type", request.getSharedFSId());
+            return null;
+        }
+        UserVmVO existingVm = userVmDao.findById(sharedFS.getVmId());
+        if (existingVm != null) {
+            logger.error("{} already has a {}, returning null Instance type", sharedFS, existingVm);
+            return null;
+        }
+        return instanceType;
+    }
+
+    protected UserVm createVmWithForRestoreIfNeeded(DeployVMCmdByAdmin cmd, Vm request) {
+        return Transaction.execute((TransactionCallbackWithException<UserVm, CloudRuntimeException>) status -> {
+            final String uuid = request.getInstanceId();
+            if (StringUtils.isNotBlank(uuid)) {
+                logger.debug("UUID for new VM needs to be {}", uuid);
+                updateOldInstanceUuid(uuid);
+                cmd.setCustomId(uuid);
+            }
+            try {
+                return userVmManager.createVirtualMachine(cmd);
+            } catch (InsufficientCapacityException | ResourceUnavailableException |
+                     ResourceAllocationException | CloudRuntimeException e) {
+                throw new CloudRuntimeException("Failed to create VM: " + e.getMessage(), e);
+            }
+        });
+    }
+
+    private void updateOldInstanceUuid(String uuid) {
+        UserVmVO oldVM = userVmDao.findByUuidIncludingRemoved(uuid);
+        if (oldVM == null) {
+            return;
+        }
+        if (oldVM.getRemoved() == null) {
+            logger.error("Found existing VM with the UUID from request data and it is not removed. Cannot " +
+                    "proceed with UUID update. VM with conflicting UUID: {}", oldVM);
+            throw new CloudRuntimeException("VM with ID " + uuid + " already exists and is not removed. Cannot proceed with VM creation for restore.");
+        }
+        logger.debug("Found removed VM with UUID from request data. Updating its UUID to a new random " +
+                "value to free up the requested UUID for the new VM. Old VM: {}", uuid, oldVM);
+        UserVmVO updateObj = userVmDao.createForUpdate(oldVM.getId());
+        updateObj.setUuid(UUID.randomUUID().toString());
+        userVmDao.update(updateObj.getId(), updateObj);
+    }
+
+    protected Pair<Vm, UserVm> createInstance(com.cloud.dc.DataCenter zone, Long clusterId, Account owner, Long domainId,
+                String accountName, Long projectId, String name, String displayName, String serviceOfferingUuid,
+                int cpu, int memory, String templateUuid, GuestOS guestOs, String userdata, ApiConstants.BootType bootType,
+                ApiConstants.BootMode bootMode, Vm request) {
+        final String affinityGroupId = request.getAffinityGroupId();
+        final String userDataId = request.getUserDataId();
+        final String sshKeyPairNames = request.getSshKeyPairNames();
+        final Map<String, String> details = request.getDetails();
+        Account account = owner != null ? owner : CallContext.current().getCallingAccount();
+        ServiceOffering serviceOffering = getServiceOfferingIdForVmCreation(zone, account, serviceOfferingUuid, cpu,
+                memory);
+        if (serviceOffering == null) {
+            throw new CloudRuntimeException("No service offering found for VM creation with specified CPU and memory");
+        }
+        DeployVMCmdByAdmin cmd = new DeployVMCmdByAdmin();
+        cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+        ComponentContext.inject(cmd);
+        cmd.setZoneId(zone.getId());
+        cmd.setClusterId(clusterId);
+        if (domainId != null && StringUtils.isNotEmpty(accountName)) {
+            cmd.setDomainId(domainId);
+            cmd.setAccountName(accountName);
+        }
+        if (projectId != null) {
+            cmd.setProjectId(projectId);
+        }
+        cmd.setName(name);
+        if (displayName != null) {
+            cmd.setDisplayName(displayName);
+        }
+        cmd.setServiceOfferingId(serviceOffering.getId());
+        if (StringUtils.isNotEmpty(userdata)) {
+            cmd.setUserData(Base64.getEncoder().encodeToString(userdata.getBytes(StandardCharsets.UTF_8)));
+        }
+        if (bootType != null) {
+            cmd.setBootType(bootType.toString());
+        }
+        if (bootMode != null) {
+            cmd.setBootMode(bootMode.toString());
+        }
+        VMTemplateVO template = getTemplateForInstanceCreation(templateUuid, guestOs);
+        if (template != null) {
+            cmd.setTemplateId(template.getId());
+        } else if (guestOs != null) {
+            CallContext.current().putContextParameter(ApiConstants.OS_ID, guestOs);
+        }
+        AffinityGroupVO group = getValidatedAffinityGroup(affinityGroupId);
+        if (group != null) {
+            cmd.setAffinityGroupIds(List.of(group.getId()));
+        }
+        UserDataVO userData = getValidatedUserdata(userDataId);
+        if (userData != null) {
+            cmd.setUserDataId(userData.getId());
+        }
+        if (StringUtils.isNotBlank(sshKeyPairNames)) {
+            cmd.setSshKeyPairNames(getValidatedSshKeyPairNames(sshKeyPairNames, owner));
+        }
+        final String instanceType = getValidatedInstanceType(request);
+        cmd.setInstanceType(StringUtils.trimToNull(instanceType));
+        cmd.setHypervisor(Hypervisor.HypervisorType.KVM.name());
+        Map<String, String> instanceDetails = getDetailsForInstanceCreation(request, serviceOffering, details);
+        if (MapUtils.isNotEmpty(instanceDetails)) {
+            Map<Integer, Map<String, String>> map = new HashMap<>();
+            map.put(0, instanceDetails);
+            cmd.setDetails(map);
+        }
+        cmd.setBlankInstance(true);
+        UserVm vm = createVmWithForRestoreIfNeeded(cmd, request);
+        vm = userVmManager.finalizeCreateVirtualMachine(vm.getId());
+        UserVmJoinVO vo = userVmJoinDao.findById(vm.getId());
+        Vm vmObj = UserVmJoinVOToVmConverter.toVm(vo, this::getHostById, this::getDetailsByInstanceId,
+                this::listTagsByInstanceId, this::listDiskAttachmentsByInstanceId, this::listNicsByInstance,
+                null, null, false);
+        return new Pair<>(vmObj, vm);
+    }
+
+    @NotNull
+    protected static Map<String, String> getDetailsForInstanceCreation(Vm request, ServiceOffering serviceOffering,
+                           Map<String, String> existingDetails) {
+        Map<String, String> details = new HashMap<>();
+        List<String> detailsTobeSkipped = List.of(
+                ApiConstants.BootType.BIOS.toString(),
+                ApiConstants.BootType.UEFI.toString());
+        if (MapUtils.isNotEmpty(existingDetails)) {
+            for (Map.Entry<String, String> entry : existingDetails.entrySet()) {
+                if (detailsTobeSkipped.contains(entry.getKey())) {
+                    continue;
+                }
+                details.put(entry.getKey(), entry.getValue());
+            }
+        }
+        if (request.isWorkerVm()) {
+            // Assumption: Only worker VM will have userdata and it needs CPU mode
+            details.put(VmDetailConstants.GUEST_CPU_MODE, WORKER_VM_GUEST_CPU_MODE);
+        }
+        if (serviceOffering.isCustomized()) {
+            details.put(VmDetailConstants.CPU_NUMBER, String.valueOf(serviceOffering.getCpu()));
+            details.put(VmDetailConstants.MEMORY, String.valueOf(serviceOffering.getRamSize()));
+            if (serviceOffering.getSpeed() == null && !details.containsKey(VmDetailConstants.CPU_SPEED)) {
+                details.put(VmDetailConstants.CPU_SPEED, String.valueOf(1000));
+            }
+        }
+        return details;
+    }
+
+    protected void saveInstanceAdditionalDetails(Vm request, UserVm vm) {
+        if (request.isWorkerVm()) {
+            Optional<String> ip = CloudConfigUtil.extractIpv4Address(
+                    request.getInitialization().getCustomScript());
+            if (ip.isPresent() && StringUtils.isNotBlank(ip.get())) {
+                logger.debug("Saving worker VM IP {} in details for {}", ip.get(), vm);
+                vmInstanceDetailsDao.addDetail(vm.getId(), WORKER_VM_IP_DETAIL, ip.get(), false);
+            }
+            return;
+        }
+        saveInstanceRestoreConfig(request, vm);
+    }
+
+    protected void saveInstanceRestoreConfig(Vm request, UserVm vm) {
+        if (StringUtils.isBlank(request.getAccountId())) {
+            return;
+        }
+        if (accountService.getAccountByUuid(request.getAccountId()) == null) {
+            return;
+        }
+        String restoreConfig = OvfXmlUtil.getConfigMetadataXml(request, logger);
+        if (StringUtils.isBlank(restoreConfig)) {
+            return;
+        }
+        logger.debug("Saving restore config: {} in details for {}", restoreConfig, vm);
+        vmInstanceDetailsDao.addDetail(vm.getId(), RESTORE_CONFIG, restoreConfig, false);
+    }
+
+    protected void removeInstanceRestoreConfig(UserVm vm) {
+        vmInstanceDetailsDao.removeDetail(vm.getId(), RESTORE_CONFIG);
+    }
+
+    protected void removeInstanceWorkerVmIp(UserVm vm) {
+        vmInstanceDetailsDao.removeDetail(vm.getId(), WORKER_VM_IP_DETAIL);
+    }
+
+    protected void processInstanceRestoreConfigIfNeeded(UserVm userVm, Volume volume) {
+        VMInstanceDetailVO detail = vmInstanceDetailsDao.findDetail(userVm.getId(), RESTORE_CONFIG);
+        if (detail == null) {
+            return;
+        }
+        String config = detail.getValue();
+        if (StringUtils.isAnyBlank(userVm.getUserVmType(), config)) {
+            removeInstanceRestoreConfig(userVm);
+            return;
+        }
+        Vm vm = OvfXmlUtil.parseVmRestoreConfig(config, logger);
+        if (StringUtils.isAnyBlank(vm.getSharedFSId(), vm.getSharedFsVolumeName())) {
+            removeInstanceRestoreConfig(userVm);
+            return;
+        }
+        if (!vm.getSharedFsVolumeName().equals(volume.getName())) {
+            return;
+        }
+        removeInstanceRestoreConfig(userVm);
+        SharedFS sharedFS = sharedFSService.getSharedFSByUuid(vm.getSharedFSId());
+        if (sharedFS == null) {
+            logger.warn("Shared Filesystem with ID {} specified in the restore config for {} not found, unable to restore Instance for Shared Filesystem",
+                    vm.getSharedFSId(), userVm);
+            return;
+        }
+        UserVm existingVm = userVmDao.findById(sharedFS.getId());
+        if (existingVm != null) {
+            logger.error("{} specified in the restore config for {} is already associated with {}, unable to restore Instance for Shared Filesystem",
+                    sharedFS, userVm, existingVm);
+        }
+        sharedFSService.updateSharedFSPostRestore(sharedFS.getId(), volume.getId());
+    }
+
+    protected Pair<String, String> getValidatedInstanceNicDetails(final String config, final NetworkVO network) {
+        if (ObjectUtils.anyNull(config, network) || StringUtils.isBlank(config)) {
+            return new Pair<>(null, null);
+        }
+        Pair<String, String> result = OvfXmlUtil.getVmNicDetailFromStoredConfig(config, network.getUuid(), logger);
+        String mac = StringUtils.trimToNull(result.first());
+        String ip4Address = StringUtils.trimToNull(result.second());
+        NicVO nic = null;
+        if (mac != null) {
+            nic = nicDao.findByNetworkIdAndMacAddress(network.getId(), mac);
+            if (nic != null) {
+                logger.warn("MAC address {} specified in the restore config for {} is already in use by {}, ignoring it",
+                        mac, network, nic);
+                mac = null;
+                if (!Objects.equals(ip4Address, nic.getIPv4Address())) {
+                    nic = null;
+                }
+            }
+        }
+        if (ip4Address != null) {
+            if (nic == null) {
+                nic = nicDao.findNonPlaceHolderByIp4AddressAndNetworkId(ip4Address, network.getId());
+            }
+            if (nic != null) {
+                logger.warn("IPv4 address {} specified in the restore config for {} is already in use by {}, ignoring it",
+                        ip4Address, network, nic);
+                mac = null;
+                if (Objects.equals(ip4Address, nic.getIPv4Address())) {
+                    ip4Address = null;
+                }
+            }
+        }
+        return new Pair<>(mac, ip4Address);
+    }
+
+    protected void updateInstanceSecurityGroupsIfNeeded(final UserVmVO vmVo, final String config, final NetworkVO network) {
+        if (ObjectUtils.anyNull(config, network) || StringUtils.isBlank(config)) {
+            return;
+        }
+        Vm vm = OvfXmlUtil.parseVmRestoreConfig(config, logger);
+        if (CollectionUtils.isEmpty(vm.getSecurityGroupIds())) {
+            return;
+        }
+        List<Long> securityGroupIds = getValidatedSecurityGroups(vm.getSecurityGroupIds(), vmVo.getId());
+        if (CollectionUtils.isEmpty(securityGroupIds)) {
+            return;
+        }
+        if (!networkModel.areServicesSupportedInNetwork(network.getId(), NetworkVO.Service.SecurityGroup)) {
+            logger.debug("{} does not support security groups, will try with remaining networks for {}", network, vmVo);
+            return;
+        }
+        UpdateVMCmd cmd = new UpdateVMCmd();
+        ComponentContext.inject(cmd);
+        cmd.setId(vmVo.getId());
+        cmd.setSecurityGroupIdList(securityGroupIds);
+        try {
+            userVmManager.updateVirtualMachine(cmd);
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
+            throw new CloudRuntimeException("Failed to add security group(s) due to: " + e.getMessage());
+        }
+    }
+
+    protected static long getProvisionedSizeInGb(String sizeStr) {
+        long provisionedSizeInGb;
+        try {
+            provisionedSizeInGb = Long.parseLong(sizeStr);
+        } catch (NumberFormatException ex) {
+            throw new InvalidParameterValueException("Invalid provisioned size: " + sizeStr);
+        }
+        if (provisionedSizeInGb <= 0) {
+            throw new InvalidParameterValueException("Provisioned size must be greater than zero");
+        }
+        // round-up provisionedSizeInGb to the next whole GB
+        long GB = 1024L * 1024L * 1024L;
+        provisionedSizeInGb = Math.max(1L, (provisionedSizeInGb + GB - 1) / GB);
+        return provisionedSizeInGb;
+    }
+
+    protected Long getVolumePhysicalSize(VolumeJoinVO vo) {
+        return volumeApiService.getVolumePhysicalSize(vo.getFormat(), vo.getPath(), vo.getChainInfo());
+    }
+
+    @NotNull
+    protected Disk createDisk(Account serviceAccount, StoragePoolVO pool, String name, Long diskOfferingId, long sizeInGb, Long initialSize) {
+        Volume volume;
+        try {
+            volume = volumeApiService.allocVolume(serviceAccount.getId(), pool.getDataCenterId(), diskOfferingId, null,
+                    null, name, sizeInGb, null, null, null, null);
+        } catch (ResourceAllocationException e) {
+            throw new CloudRuntimeException(e.getMessage(), e);
+        }
+        if (volume == null) {
+            throw new CloudRuntimeException("Failed to create volume");
+        }
+        volume = volumeApiService.createVolume(volume.getId(), null, null, pool.getId(), true);
+        if (initialSize != null) {
+            volumeDetailsDao.addDetail(volume.getId(), ApiConstants.VIRTUAL_SIZE, String.valueOf(initialSize), true);
+        }
+
+        // Implementation for creating a Disk resource
+        return VolumeJoinVOToDiskConverter.toDisk(volumeJoinDao.findById(volume.getId()), this::getVolumePhysicalSize);
+    }
+
+    protected List<Nic> listNicsByInstance(final long instanceId, final String instanceUuid) {
+        List<NicVO> nics = nicDao.listByVmId(instanceId);
+        return NicVOToNicConverter.toNicList(nics, instanceUuid, this::getNetworkById);
+    }
+
+    protected List<Nic> listNicsByInstance(final UserVmJoinVO vo) {
+        return listNicsByInstance(vo.getId(), vo.getUuid());
+    }
+
+    protected boolean accountCannotAccessNetwork(NetworkVO networkVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        try {
+            networkModel.checkNetworkPermissions(account, networkVO);
+            return false;
+        } catch (CloudRuntimeException e) {
+            logger.debug("{} cannot access {}: {}", account, networkVO, e.getMessage());
+        }
+        return true;
+    }
+
+    protected void assignVmToAccount(UserVmVO vmVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        if (account == null) {
+            throw new InvalidParameterValueException("Account with ID " + accountId + " not found");
+        }
+        try {
+            AssignVMCmd cmd = new AssignVMCmd();
+            ComponentContext.inject(cmd);
+            cmd.setVirtualMachineId(vmVO.getId());
+            cmd.setDomainId(account.getDomainId());
+            if (Account.Type.PROJECT.equals(account.getType())) {
+                Project project = projectManager.findByProjectAccountId(account.getId());
+                if (project == null) {
+                    throw new InvalidParameterValueException("Project for " + account + " not found");
+                }
+                cmd.setProjectId(project.getId());
+            } else {
+                cmd.setAccountName(account.getAccountName());
+            }
+            cmd.setSkipNetwork(true);
+            userVmManager.moveVmToUser(cmd);
+        } catch (ResourceAllocationException | CloudRuntimeException | ResourceUnavailableException |
+                 InsufficientCapacityException e) {
+            logger.error("Failed to assign {} to {}: {}", vmVO, account, e.getMessage(), e);
+        }
+    }
+
+    protected ImageTransfer createImageTransfer(Long backupId, Long volumeId, Direction direction, Format format) {
+        org.apache.cloudstack.backup.ImageTransfer imageTransfer =
+                kvmBackupExportService.createImageTransfer(volumeId, backupId, direction, format);
+        ImageTransferVO imageTransferVO = imageTransferDao.findById(imageTransfer.getId());
+        return ImageTransferVOToImageTransferConverter.toImageTransfer(imageTransferVO, this::getHostById,
+                this::getVolumeById);
+    }
+
+    protected DataCenterJoinVO getZoneById(Long zoneId) {
+        if (zoneId == null) {
+            return null;
+        }
+        return dataCenterJoinDao.findById(zoneId);
+    }
+
+    protected HostJoinVO getHostById(Long hostId) {
+        if (hostId == null) {
+            return null;
+        }
+        return hostJoinDao.findById(hostId);
+    }
+
+    protected VolumeJoinVO getVolumeById(Long volumeId) {
+        if (volumeId == null) {
+            return null;
+        }
+        return volumeJoinDao.findById(volumeId);
+    }
+
+    protected NetworkVO getNetworkById(Long networkId) {
+        if (networkId == null) {
+            return null;
+        }
+        return networkDao.findById(networkId);
+    }
+
+    protected Map<String, String> getDetailsByInstanceId(Long instanceId) {
+        return vmInstanceDetailsDao.listDetailsKeyPairs(instanceId, true);
+    }
+
+    protected SharedFS getSharedFSForInstance(UserVmJoinVO vo) {
+        if (vo == null || !UserVmManager.SHAREDFSVM.equals(vo.getUserVmType())) {
+            return null;
+        }
+        return sharedFSService.getSharedFSForVmId(vo.getId());
+    }
+
+    protected List<SecurityGroupVO> getSecurityGroupsForInstance(long vmId) {
+        List<SecurityGroupVMMapVO> mappings = securityGroupVMMapDao.listByInstanceId(vmId);
+        if (CollectionUtils.isEmpty(mappings)) {
+            return null;
+        }
+        return securityGroupDao.listByIds(
+                mappings.stream()
+                        .map(SecurityGroupVMMapVO::getSecurityGroupId)
+                        .collect(Collectors.toList()));
+    }
+
+    protected void validateInstanceBackupConditions(UserVm vm) {
+        List<AutoScaleVmGroupVmMapVO> asGroupVmVOs = autoScaleVmGroupVmMapDao.listByVm(vm.getId());
+        if (CollectionUtils.isNotEmpty(asGroupVmVOs)) {
+            throw new CloudRuntimeException("Instance is part of an AutoScale group, unable to proceed with backup");
+        }
+    }
+
+    public Pair<User, Account> getServiceAccount() {
+        String serviceAccountUuid = VeeamControlService.ServiceAccountId.value();
+        if (StringUtils.isEmpty(serviceAccountUuid)) {
+            throw new CloudRuntimeException("Service account is not configured, unable to proceed");
+        }
+        Account account = accountService.getActiveAccountByUuid(serviceAccountUuid);
+        if (account == null) {
+            throw new CloudRuntimeException("Service account with ID " + serviceAccountUuid + " not found, unable to proceed");
+        }
+        User user = accountService.getOneActiveUserForAccount(account);
+        if (user == null) {
+            throw new CloudRuntimeException("No active user found for service account with ID " + serviceAccountUuid);
+        }
+        return new Pair<>(user, account);
+    }
+
+    @ApiAccess(command = ListZonesCmd.class)
+    public List<DataCenter> listAllDataCenters(Long offset, Long limit) {
+        Filter filter = new Filter(DataCenterJoinVO.class, "id", true, offset, limit);
+        final List<DataCenterJoinVO> clusters = dataCenterJoinDao.listByIds(
+                kvmBackupExportService.listCompatibleDataCenterIds(), filter);
+        return DataCenterJoinVOToDataCenterConverter.toDCList(clusters);
+    }
+
+    @ApiAccess(command = ListZonesCmd.class)
+    public DataCenter getDataCenter(String uuid) {
+        final DataCenterJoinVO vo = dataCenterJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        return  DataCenterJoinVOToDataCenterConverter.toDataCenter(vo);
+    }
+
+    @ApiAccess(command = ListStoragePoolsCmd.class)
+    public List<StorageDomain> listStorageDomainsByDcId(final String uuid, final Long offset, final Long limit) {
+        final DataCenterVO dataCenterVO = dataCenterDao.findByUuid(uuid);
+        if (dataCenterVO == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        Filter filter = new Filter(StoragePoolJoinVO.class, "id", true, offset, limit);
+        List<StoragePoolJoinVO> storagePoolVOS = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(dataCenterVO.getId(),
+                Hypervisor.HypervisorType.KVM, SUPPORTED_STORAGE_TYPES, filter);
+        return StoreVOToStorageDomainConverter.toStorageDomainListFromPools(storagePoolVOS);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<Network> listNetworksByDcId(final String uuid, final Long offset, final Long limit) {
+        final DataCenterJoinVO dataCenterVO = dataCenterJoinDao.findByUuid(uuid);
+        if (dataCenterVO == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        List<NetworkVO> networks = networkDao.listByZoneAndTrafficType(dataCenterVO.getId(), Networks.TrafficType.Guest, filter);
+        return NetworkVOToNetworkConverter.toNetworkList(networks, (dcId) -> dataCenterVO);
+    }
+
+    @ApiAccess(command = ListClustersCmd.class)
+    public List<Cluster> listAllClusters(Long offset, Long limit) {
+        Filter filter = new Filter(ClusterVO.class, "id", true, offset, limit);
+        final List<ClusterVO> clusters = clusterDao.listByZonesAndHypervisorType(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM, filter);
+        return ClusterVOToClusterConverter.toClusterList(clusters, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListClustersCmd.class)
+    public Cluster getCluster(String uuid) {
+        final ClusterVO vo = clusterDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Cluster with ID " + uuid + " not found");
+        }
+        return ClusterVOToClusterConverter.toCluster(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListHostsCmd.class)
+    public List<Host> listAllHosts(Long offset, Long limit) {
+        Filter filter = new Filter(HostJoinVO.class, "id", true, offset, limit);
+        final List<HostJoinVO> hosts = hostJoinDao.listAvailableRoutingByZonesAndHypervisor(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM, filter);
+        return HostJoinVOToHostConverter.toHostList(hosts);
+    }
+
+    @ApiAccess(command = ListHostsCmd.class)
+    public Host getHost(String uuid) {
+        final HostJoinVO vo = hostJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Host with ID " + uuid + " not found");
+        }
+        return HostJoinVOToHostConverter.toHost(vo);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<Network> listAllNetworks(Long offset, Long limit) {
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        final List<NetworkVO> networks = networkDao.listByZonesTrafficTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Networks.TrafficType.Guest,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return NetworkVOToNetworkConverter.toNetworkList(networks, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public Network getNetwork(String uuid) {
+        final NetworkVO vo = networkDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Network with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return NetworkVOToNetworkConverter.toNetwork(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<VnicProfile> listAllVnicProfiles(Long offset, Long limit) {
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        final List<NetworkVO> networks = networkDao.listByZonesTrafficTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Networks.TrafficType.Guest,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return NetworkVOToVnicProfileConverter.toVnicProfileList(networks, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public VnicProfile getVnicProfile(String uuid) {
+        final NetworkVO vo = networkDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Nic profile with ID " + uuid + " not found");
+        }
+        return NetworkVOToVnicProfileConverter.toVnicProfile(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListVMsCmd.class)
+    public List<Vm> listAllInstances(boolean includeTags, boolean includeDisks, boolean includeNics,
+                 boolean allContent, Long offset, Long limit) {
+        Filter filter = new Filter(UserVmJoinVO.class, "id", true, offset, limit);
+        Pair<List<Long>, String> ownerDetails = getResourceOwnerFilters();
+        List<UserVmJoinVO> vms = userVmJoinDao.listByZonesHypervisorNotTypesAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM,
+                Arrays.asList(UserVmManager.CKS_NODE), ownerDetails.first(), ownerDetails.second(), filter);
+        return UserVmJoinVOToVmConverter.toVmList(vms,
+                this::getHostById,
+                this::getDetailsByInstanceId,
+                (includeTags || allContent) ? this::listTagsByInstanceId : null,
+                (includeDisks || allContent) ? this::listDiskAttachmentsByInstanceId : null,
+                (includeNics || allContent) ? this::listNicsByInstance : null,
+                allContent ? this::getSharedFSForInstance: null,
+                allContent ? this::getSecurityGroupsForInstance: null,
+                allContent);
+    }
+
+    @ApiAccess(command = ListVMsCmd.class)
+    public Vm getInstance(String uuid, boolean includeTags, boolean includeDisks, boolean includeNics,
+              boolean allContent) {
+        UserVmJoinVO vo = userVmJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        return UserVmJoinVOToVmConverter.toVm(vo,
+                this::getHostById,
+                this::getDetailsByInstanceId,
+                (includeTags || allContent) ? this::listTagsByInstanceId : null,
+                (includeDisks || allContent) ? this::listDiskAttachmentsByInstanceId : null,
+                (includeNics || allContent) ? this::listNicsByInstance : null,
+                allContent ? this::getSharedFSForInstance: null,
+                allContent ? this::getSecurityGroupsForInstance: null,
+                allContent);
+    }
+
+    @ApiAccess(command = DeployVMCmd.class)
+    public Vm createInstance(Vm request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request VM data is empty");
+        }
+        logger.debug("VM create request [worker-vm: {}]", request.isWorkerVm());
+        OvfXmlUtil.updateFromConfiguration(request);
+        String name = request.getName();
+        if (StringUtils.isBlank(name)) {
+            throw new InvalidParameterValueException("Invalid name specified for the VM");
+        }
+        String displayName = name;
+        name = name.replace("_", "-");
+        Long zoneId = null;
+        Long clusterId = null;
+        if (request.getCluster() != null && StringUtils.isNotEmpty(request.getCluster().getId())) {
+            ClusterVO clusterVO = clusterDao.findByUuid(request.getCluster().getId());
+            if (clusterVO != null) {
+                zoneId = clusterVO.getDataCenterId();
+                clusterId = clusterVO.getId();
+            }
+        }
+        if (zoneId == null) {
+            throw new InvalidParameterValueException("Failed to determine datacenter for VM creation request");
+        }
+        DataCenterVO zone = dataCenterDao.findById(zoneId);
+        if (zone == null) {
+            throw new InvalidParameterValueException("DataCenter could not be determined for the request");
+        }
+        Integer cpu = null;
+        try {
+            cpu = Integer.valueOf(request.getCpu().getTopology().getSockets());
+        } catch (Exception ignored) {
+        }
+        if (cpu == null) {
+            throw new InvalidParameterValueException("CPU topology sockets must be specified");
+        }
+        Long memory = null;
+        try {
+            memory = Long.valueOf(request.getMemory());
+        } catch (Exception ignored) {
+        }
+        if (memory == null) {
+            throw new InvalidParameterValueException("Memory must be specified");
+        }
+        int memoryMB = (int)(memory / (1024L * 1024L));
+        String userdata = null;
+        if (request.getInitialization() != null) {
+            userdata = request.getInitialization().getCustomScript();
+        }
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> bootOptions = Vm.Bios.retrieveBootOptions(request.getBios());
+        Account owner = getOwnerForInstanceCreation(request);
+        Ternary<Long, String, Long> ownerDetails = getOwnerDetailsForInstanceCreation(owner);
+        String serviceOfferingUuid = null;
+        if (request.getCpuProfile() != null && StringUtils.isNotEmpty(request.getCpuProfile().getId())) {
+            serviceOfferingUuid = request.getCpuProfile().getId();
+        }
+        String templateUuid = null;
+        if (request.getTemplate() != null && StringUtils.isNotEmpty(request.getTemplate().getId())) {
+            templateUuid = request.getTemplate().getId();
+        }
+        GuestOS guestOs = getGuestOsForInstance(request);
+        Pair<Vm, UserVm> result = createInstance(zone, clusterId, owner, ownerDetails.first(), ownerDetails.second(),
+                ownerDetails.third(), name, displayName, serviceOfferingUuid, cpu, memoryMB, templateUuid, guestOs,
+                userdata, bootOptions.first(), bootOptions.second(), request);
+        saveInstanceRestoreConfig(request, result.second());
+        return result.first();
+    }
+
+    @ApiAccess(command = UpdateVMCmd.class)
+    public Vm updateInstance(String uuid, Vm request) {
+        logger.warn("Received request to update VM with ID {}. No action, returning existing VM data.", uuid);
+        return getInstance(uuid, false, false, false, false);
+    }
+
+    @ApiAccess(command = DestroyVMCmd.class)
+    public VmAction deleteInstance(String uuid, boolean deleteVolumes, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        boolean isAdmin = accountService.isRootAdmin(CallContext.current().getCallingAccountId());
+        try {
+            DestroyVMCmd cmd = isAdmin ? new DestroyVMCmdByAdmin() : new DestroyVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.EXPUNGE, Boolean.TRUE.toString());
+            if (deleteVolumes) {
+                List<String>volumeIds = volumeDao.findByInstance(vo.getId()).stream()
+                        .filter(v -> Volume.Type.DATADISK.equals(v.getVolumeType()))
+                        .map(VolumeVO::getUuid)
+                        .collect(Collectors.toList());
+                if (CollectionUtils.isNotEmpty(volumeIds)) {
+                    params.put(ApiConstants.VOLUME_IDS, String.join(",", volumeIds));
+                }
+            }
+            if (isAdmin) {
+                params.put(ApiConstants.FORCED, Boolean.TRUE.toString());
+            }
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM deletion");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StartVMCmd.class)
+    public VmAction startInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StartVMCmd cmd = new StartVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM start");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to start VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StopVMCmd.class)
+    public VmAction stopInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StopVMCmd cmd = new StopVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.FORCED, Boolean.TRUE.toString());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM stop");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to stop VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StopVMCmd.class)
+    public VmAction shutdownInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StopVMCmd cmd = new StopVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.FORCED, Boolean.FALSE.toString());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM shutdown");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to shutdown VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    protected List<Tag> listTagsByInstanceId(final long instanceId) {
+        List<ResourceTagVO> tags = resourceTagDao.listByResourceTypeIdAndKeyPrefix(
+                ResourceTag.ResourceObjectType.UserVm, instanceId, VM_TAG_KEY);
+        return ResourceTagVOToTagConverter.toTags(tags);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    protected List<DiskAttachment> listDiskAttachmentsByInstanceId(final long instanceId) {
+        List<VolumeJoinVO> kvmVolumes = volumeJoinDao.listByInstanceId(instanceId);
+        return VolumeJoinVOToDiskConverter.toDiskAttachmentList(kvmVolumes, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public List<DiskAttachment> listDiskAttachmentsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return listDiskAttachmentsByInstanceId(vo.getId());
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public List<Disk> listAllDisks(Long offset, Long limit) {
+        Filter filter = new Filter(VolumeJoinVO.class, "id", true, offset, limit);
+        Pair<List<Long>, String> ownerDetails = getResourceOwnerFilters();
+        List<VolumeJoinVO> kvmVolumes = volumeJoinDao.listByZonesHypervisorTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return VolumeJoinVOToDiskConverter.toDiskList(kvmVolumes, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public Disk getDisk(String uuid) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return VolumeJoinVOToDiskConverter.toDisk(volumeJoinDao.findByUuid(uuid), this::getVolumePhysicalSize);
+    }
+
+    protected void assignVolumeToAccount(VolumeVO volumeVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        if (account == null) {
+            throw new InvalidParameterValueException("Account with ID " + accountId + " not found");
+        }
+        try {
+            AssignVolumeCmd cmd = new AssignVolumeCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            cmd.setVolumeId(volumeVO.getId());
+            params.put(ApiConstants.VOLUME_ID, volumeVO.getUuid());
+            if (Account.Type.PROJECT.equals(account.getType())) {
+                Project project = projectManager.findByProjectAccountId(account.getId());
+                if (project == null) {
+                    throw new InvalidParameterValueException("Project for " + account + " not found");
+                }
+                cmd.setProjectId(project.getId());
+                params.put(ApiConstants.PROJECT_ID, project.getUuid());
+            } else {
+                cmd.setAccountId(account.getId());
+                params.put(ApiConstants.ACCOUNT_ID, account.getUuid());
+            }
+            cmd.setFullUrlParams(params);
+            volumeApiService.assignVolumeToAccount(cmd);
+        } catch (ResourceAllocationException | CloudRuntimeException e) {
+            logger.error("Failed to assign {} to {}: {}", volumeVO, account, e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = AttachVolumeCmd.class)
+    public DiskAttachment attachInstanceDisk(final String vmUuid, final DiskAttachment request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (request == null || request.getDisk() == null || StringUtils.isEmpty(request.getDisk().getId())) {
+            throw new InvalidParameterValueException("Request disk data is empty");
+        }
+        VolumeVO volumeVO = volumeDao.findByUuid(request.getDisk().getId());
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Disk with ID " + request.getDisk().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (vmVo.getAccountId() != volumeVO.getAccountId()) {
+            if (VeeamControlService.InstanceRestoreAssignOwner.value()) {
+                assignVolumeToAccount(volumeVO, vmVo.getAccountId());
+            } else {
+                throw new PermissionDeniedException("Disk with ID " + request.getDisk().getId() +
+                        " belongs to a different account and cannot be attached to the VM");
+            }
+        }
+        Long deviceId = null;
+        if (Boolean.parseBoolean(request.getBootable()) || Volume.Type.ROOT.equals(volumeVO.getVolumeType())) {
+            deviceId = 0L;
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + volumeVO.getUuid() + " VmId: " + vmVo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(volumeVO.getId());
+        Volume volume = volumeApiService.attachVolumeToVM(vmVo.getId(), volumeVO.getId(), deviceId, true);
+        processInstanceRestoreConfigIfNeeded(vmVo, volume);
+        VolumeJoinVO attachedVolumeVO = volumeJoinDao.findById(volume.getId());
+        return VolumeJoinVOToDiskConverter.toDiskAttachment(attachedVolumeVO, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = DetachVolumeCmd.class)
+    public void detachInstanceDisk(final String vmUuid, final String volumeUuid) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        if (!VirtualMachine.State.Stopped.equals(vmVo.getState())) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " must be in stopped state to detach disk");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        VolumeVO volumeVO = volumeDao.findByUuid(volumeUuid);
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Volume with ID " + volumeUuid + " not found");
+        }
+        if (volumeVO.getInstanceId() != vmVo.getId()) {
+            throw new InvalidParameterValueException("Volume with ID " + volumeUuid + " is not attached to VM with ID " + vmUuid);
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + volumeVO.getUuid() + " VmId: " + vmVo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(volumeVO.getId());
+        DetachVolumeCmd cmd = new DetachVolumeCmd();
+        ComponentContext.inject(cmd);
+        cmd.setId(volumeVO.getId());
+        volumeApiService.detachVolumeFromVM(cmd);
+    }
+
+    @ApiAccess(command = CreateVolumeCmd.class)
+    public Disk createDisk(Disk request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request disk data is empty");
+        }
+        String name = request.getName();
+        if (request.getStorageDomains() == null || CollectionUtils.isEmpty(request.getStorageDomains().getItems()) ||
+                request.getStorageDomains().getItems().size() > 1) {
+            throw new InvalidParameterValueException("Exactly one storage domain must be specified");
+        }
+        StorageDomain domain = request.getStorageDomains().getItems().get(0);
+        if (domain == null || domain.getId() == null) {
+            throw new InvalidParameterValueException("Storage domain ID must be specified");
+        }
+        StoragePoolVO pool = primaryDataStoreDao.findByUuid(domain.getId());
+        if (pool == null) {
+            throw new InvalidParameterValueException("Storage domain with ID " + domain.getId() + " not found");
+        }
+        String sizeStr = request.getProvisionedSize();
+        if (StringUtils.isBlank(sizeStr)) {
+            throw new InvalidParameterValueException("Provisioned size must be specified");
+        }
+        long provisionedSizeInGb = getProvisionedSizeInGb(sizeStr);
+        Long initialSize = null;
+        if (StringUtils.isNotBlank(request.getInitialSize())) {
+            try {
+                initialSize = Long.parseLong(request.getInitialSize());
+            } catch (NumberFormatException ignored) {}
+        }
+        Account caller = CallContext.current().getCallingAccount();
+        DataCenterVO zone = dataCenterDao.findById(pool.getDataCenterId());
+        if (zone == null || !Grouping.AllocationState.Enabled.equals(zone.getAllocationState())) {
+            throw new InvalidParameterValueException("Datacenter for the specified storage domain is not found or not active");
+        }
+        Long diskOfferingId = volumeApiService.getCustomDiskOfferingIdForVolumeUpload(caller, zone,
+                VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId()));
+        if (diskOfferingId == null) {
+            throw new CloudRuntimeException("Failed to find custom offering for disk" + zone.getName());
+        }
+        return createDisk(caller, pool, name, diskOfferingId, provisionedSizeInGb, initialSize);
+    }
+
+    @ApiAccess(command = DestroyVolumeCmd.class)
+    public void deleteDisk(String uuid) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + vo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(vo.getId());
+        volumeApiService.destroyVolume(vo.getId(), CallContext.current().getCallingAccount(), true, false);
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk updateDisk(String uuid, Disk request) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        logger.warn("Update disk is not implemented, returning disk ID: {} as it is", uuid);
+        return getDisk(uuid);
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk copyDisk(String uuid) {
+        throw new InvalidParameterValueException("Copy Disk with ID " + uuid + " not implemented");
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk reduceDisk(String uuid) {
+        throw new InvalidParameterValueException("Reduce Disk with ID " + uuid + " not implemented");
+    }
+
+    @ApiAccess(command = ListNicsCmd.class)
+    public List<Nic> listNicsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return listNicsByInstance(vo.getId(), vo.getUuid());
+    }
+
+    @ApiAccess(command = AddNicToVMCmd.class)
+    public Nic attachInstanceNic(final String vmUuid, final Nic request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (request == null || request.getVnicProfile() == null || StringUtils.isEmpty(request.getVnicProfile().getId())) {
+            throw new InvalidParameterValueException("Request nic data is empty");
+        }
+        NetworkVO networkVO = networkDao.findByUuid(request.getVnicProfile().getId());
+        if (networkVO == null) {
+            throw new InvalidParameterValueException("VNic profile " + request.getVnicProfile().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, networkVO);
+        if (vmVo.getAccountId() != networkVO.getAccountId() &&
+                networkVO.getAccountId() != Account.ACCOUNT_ID_SYSTEM &&
+                VeeamControlService.InstanceRestoreAssignOwner.value() &&
+                accountCannotAccessNetwork(networkVO, vmVo.getAccountId())) {
+            assignVmToAccount(vmVo, networkVO.getAccountId());
+        }
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(
+                vmVo.getId(), List.of(RESTORE_CONFIG, WORKER_VM_IP_DETAIL));
+        String restoreConfig = details.get(RESTORE_CONFIG);
+        Pair<String, String> nicDetails = getValidatedInstanceNicDetails(restoreConfig, networkVO);
+        String workerVmIp = details.get(WORKER_VM_IP_DETAIL);
+        if (StringUtils.isNotBlank(workerVmIp)) {
+            nicDetails = new Pair<>(null, workerVmIp);
+            removeInstanceWorkerVmIp(vmVo);
+        }
+        CallContext context = CallContext.current();
+        context.setEventResourceType(ApiCommandResourceType.VirtualMachine);
+        context.setEventResourceId(vmVo.getId());
+        CallContext.current().setEventDetails("Vm Id: " + vmVo.getUuid() + " Network Id: " + networkVO.getUuid());
+        AddNicToVMCmd cmd = new AddNicToVMCmd();
+        ComponentContext.inject(cmd);
+        cmd.setVmId(vmVo.getId());
+        cmd.setNetworkId(networkVO.getId());
+        cmd.setMacAddress(nicDetails.first());
+        cmd.setIpaddr(nicDetails.second());
+        if (request.getMac() != null && StringUtils.isNotBlank(request.getMac().getAddress())) {
+            cmd.setMacAddress(request.getMac().getAddress());
+        }
+        userVmManager.addNicToVirtualMachine(cmd);
+        NicVO nic = nicDao.findByInstanceIdAndNetworkIdIncludingRemoved(networkVO.getId(), vmVo.getId());
+        if (nic == null) {
+            throw new CloudRuntimeException("Failed to attach NIC to VM");
+        }
+        updateInstanceSecurityGroupsIfNeeded(vmVo, restoreConfig, networkVO);
+        return NicVOToNicConverter.toNic(nic, vmUuid, this::getNetworkById);
+    }
+
+    @ApiAccess(command = ListImageTransfersCmd.class)
+    public List<ImageTransfer> listAllImageTransfers(Long offset, Long limit) {
+        Filter filter = new Filter(ImageTransferVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        List<ImageTransferVO> imageTransfers = imageTransferDao.listByZonesAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), ownerDetails.first(),
+                ownerDetails.second(), filter);
+        return ImageTransferVOToImageTransferConverter.toImageTransferList(imageTransfers, this::getHostById, this::getVolumeById);
+    }
+
+    @ApiAccess(command = ListImageTransfersCmd.class)
+    public ImageTransfer getImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return ImageTransferVOToImageTransferConverter.toImageTransfer(vo, this::getHostById, this::getVolumeById);
+    }
+
+    @ApiAccess(command = CreateImageTransferCmd.class)
+    public ImageTransfer createImageTransfer(ImageTransfer request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request image transfer data is empty");
+        }
+        if (request.getDisk() == null || StringUtils.isBlank(request.getDisk().getId())) {
+            throw new InvalidParameterValueException("Disk ID must be specified");
+        }
+        VolumeJoinVO volumeVO = volumeJoinDao.findByUuid(request.getDisk().getId());
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Disk with ID " + request.getDisk().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false,
+                volumeVO);
+        Direction direction = EnumUtils.getEnum(Direction.class, request.getDirection());
+        if (direction == null) {
+            throw new InvalidParameterValueException("Invalid or missing direction");
+        }
+        Format format = EnumUtils.getEnum(Format.class, request.getFormat());
+        Long backupId = null;
+        if (request.getBackup() != null && StringUtils.isNotBlank(request.getBackup().getId())) {
+            BackupVO backupVO = backupDao.findByUuid(request.getBackup().getId());
+            if (backupVO == null) {
+                throw new InvalidParameterValueException("Backup with ID " + request.getBackup().getId() + " not found");
+            }
+            backupId = backupVO.getId();
+        }
+        return createImageTransfer(backupId, volumeVO.getId(), direction, format);
+    }
+
+    @ApiAccess(command = FinalizeImageTransferCmd.class)
+    public boolean cancelImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        return kvmBackupExportService.cancelImageTransfer(vo.getId());
+    }
+
+    @ApiAccess(command = FinalizeImageTransferCmd.class)
+    public boolean finalizeImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        return kvmBackupExportService.finalizeImageTransfer(vo.getId());
+    }
+
+    @ApiAccess(command = ListAsyncJobsCmd.class)
+    public List<Job> listPendingJobs() {
+        List<Long> jobIds = asyncJobDao.listPendingJobIdsForAccount(CallContext.current().getCallingAccountId());
+        List<AsyncJobJoinVO> jobJoinVOs = asyncJobJoinDao.listByIds(jobIds);
+        return AsyncJobJoinVOToJobConverter.toJobList(jobJoinVOs);
+    }
+
+    @ApiAccess(command = ListAsyncJobsCmd.class)
+    public Job getJob(String uuid) {
+        final AsyncJobJoinVO vo = asyncJobJoinDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Job with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return AsyncJobJoinVOToJobConverter.toJob(vo);
+    }
+
+    @ApiAccess(command = ListVMSnapshotCmd.class)
+    public List<Snapshot> listSnapshotsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        List<VMSnapshotVO> snapshots = vmSnapshotDao.findByVm(vo.getId());
+        return VmSnapshotVOToSnapshotConverter.toSnapshotList(snapshots, vo.getUuid());
+    }
+
+    @ApiAccess(command = CreateVMSnapshotCmd.class)
+    public Snapshot createInstanceSnapshot(final String vmUuid, final Snapshot request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        try {
+            CreateVMSnapshotCmd cmd = new CreateVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vmVo.getUuid());
+            params.put(ApiConstants.VM_SNAPSHOT_DESCRIPTION, request.getDescription());
+            params.put(ApiConstants.VM_SNAPSHOT_MEMORY, String.valueOf(Boolean.parseBoolean(request.getPersistMemorystate())));
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result.objectId == null) {
+                throw new CloudRuntimeException("No snapshot ID returned");
+            }
+            VMSnapshotVO vo = vmSnapshotDao.findById(result.objectId);
+            if (vo == null) {
+                throw new CloudRuntimeException("Snapshot not found");
+            }
+            return VmSnapshotVOToSnapshotConverter.toSnapshot(vo, vmVo.getUuid());
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to create snapshot: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListVMSnapshotCmd.class)
+    public Snapshot getSnapshot(String uuid) {
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        UserVmVO vm = userVmDao.findById(vo.getVmId());
+        return VmSnapshotVOToSnapshotConverter.toSnapshot(vo, vm.getUuid());
+    }
+
+    public ResourceAction deleteSnapshot(String uuid, boolean async) {
+        ResourceAction action = null;
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vo);
+        try {
+            DeleteVMSnapshotCmd cmd = new DeleteVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VM_SNAPSHOT_ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for snapshot deletion");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            action = AsyncJobJoinVOToJobConverter.toAction(jobVo);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete snapshot: " + e.getMessage(), e);
+        }
+        return action;
+    }
+
+    @ApiAccess(command = RevertToVMSnapshotCmd.class)
+    public ResourceAction revertInstanceToSnapshot(String uuid, boolean async) {
+        ResourceAction action = null;
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vo);
+        try {
+            RevertToVMSnapshotCmd cmd = new RevertToVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VM_SNAPSHOT_ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for snapshot revert");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            action = AsyncJobJoinVOToJobConverter.toAction(jobVo);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to revert to snapshot: " + e.getMessage(), e);
+        }
+        return action;
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public List<Backup> listBackupsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        List<BackupVO> backups = backupDao.searchByVmIds(List.of(vo.getId()));
+        return BackupVOToBackupConverter.toBackupList(backups, id -> vo, this::getHostById);
+    }
+
+    protected void validateInstanceStorage(UserVmVO vm) {
+        List<VolumeVO> volumes = volumeDao.findUsableVolumesForInstance(vm.getId());
+        List<Long> storageIds = volumes.stream().map(VolumeVO::getPoolId).distinct().collect(Collectors.toList());
+        List<StoragePoolVO> pools = primaryDataStoreDao.listByIds(storageIds);
+        pools.stream().filter(p -> !SUPPORTED_STORAGE_TYPES.contains(p.getPoolType()))
+                .findAny().ifPresent(p -> {
+                    throw new InvalidParameterValueException("VM is using storage pool " + p.getName() +
+                            " of type " + p.getPoolType() +
+                            " which is not supported for backup operations");
+                });
+    }
+
+    @ApiAccess(command = StartBackupCmd.class)
+    public Backup createInstanceBackup(final String vmUuid, final Backup request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        validateInstanceBackupConditions(vmVo);
+        validateInstanceStorage(vmVo);
+        try {
+            StartBackupCmd cmd = new StartBackupCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vmVo.getUuid());
+            params.put(ApiConstants.NAME, request.getName());
+            params.put(ApiConstants.DESCRIPTION, request.getDescription());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result == null || result.objectId == null) {
+                throw new CloudRuntimeException("Unexpected backup ID returned");
+            }
+            BackupVO vo = backupDao.findById(result.objectId);
+            if (vo == null) {
+                throw new CloudRuntimeException("Backup not found");
+            }
+            return BackupVOToBackupConverter.toBackup(vo, id -> vmVo, this::getHostById, this::getBackupDisks);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to create backup: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public Backup getBackup(String uuid) {
+        BackupVO vo = backupDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Backup with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return BackupVOToBackupConverter.toBackup(vo, id -> userVmDao.findById(id), this::getHostById,
+                this::getBackupDisks);
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public List<Disk> listDisksByBackupUuid(final String uuid) {
+        throw new InvalidParameterValueException("List Backup Disks with ID " + uuid + " not implemented");
+        // This won't be feasible with current structure
+    }
+
+    @ApiAccess(command = FinalizeBackupCmd.class)
+    public Backup finalizeBackup(final String vmUuid, final String backupUuid) {
+        UserVmVO vm = userVmDao.findByUuid(vmUuid);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Instance with ID " + vmUuid + " not found");
+        }
+        BackupVO backup = backupDao.findByUuid(backupUuid);
+        if (backup == null) {
+            throw new InvalidParameterValueException("Backup with ID " + backupUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, backup);
+        try {
+            FinalizeBackupCmd cmd = new FinalizeBackupCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vm.getUuid());
+            params.put(ApiConstants.ID, backup.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result == null) {
+                throw new CloudRuntimeException("Failed to finalize backup");
+            }
+            backup = backupDao.findByIdIncludingRemoved(backup.getId());
+            return BackupVOToBackupConverter.toBackup(backup, id -> vm, this::getHostById, this::getBackupDisks);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to finalize backup: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    protected List<Disk> getBackupDisks(final BackupVO backup) {
+        List<org.apache.cloudstack.backup.Backup.VolumeInfo> volumeInfos = backup.getBackedUpVolumes();
+        if (CollectionUtils.isEmpty(volumeInfos)) {
+            return Collections.emptyList();
+        }
+        return VolumeJoinVOToDiskConverter.toDiskListFromVolumeInfos(volumeInfos);
+    }
+
+    @ApiAccess(command = ListVmCheckpointsCmd.class)
+    public List<Checkpoint> listCheckpointsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vo.getId());
+        Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint(
+                details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID),
+                details.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME));
+        if (checkpoint == null) {
+            return Collections.emptyList();
+        }
+        return List.of(checkpoint);
+    }
+
+    @ApiAccess(command = DeleteVmCheckpointCmd.class)
+    public void deleteCheckpoint(String vmUuid, String checkpointId) {
+        UserVmVO vo = userVmDao.findByUuid(vmUuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vo.getId());
+        if (!Objects.equals(details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID), checkpointId)) {
+            logger.warn("Checkpoint ID {} does not match active checkpoint for VM {}", checkpointId, vmUuid);
+            return;
+        }
+        try {
+            DeleteVmCheckpointCmd cmd = new DeleteVmCheckpointCmd();
+            ComponentContext.inject(cmd);
+            cmd.setVmId(vo.getId());
+            cmd.setCheckpointId(checkpointId);
+            kvmBackupExportService.deleteVmCheckpoint(cmd);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete checkpoint: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    public List<Tag> listAllTags(final Long offset, final Long limit) {
+        List<Tag> tags = new ArrayList<>(getDummyTags().values());
+        Filter filter = new Filter(ResourceTagVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        List<String> vmResourceTags = resourceTagDao.listByResourceTypeKeyPrefixAndOwners(
+                ResourceTag.ResourceObjectType.UserVm, VM_TAG_KEY, ownerDetails.first(), ownerDetails.second(), filter);
+        if (CollectionUtils.isNotEmpty(vmResourceTags)) {
+            tags.addAll(ResourceTagVOToTagConverter.toTagsFromValues(vmResourceTags));
+        }
+        return tags;
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    public Tag getTag(String uuid) {
+        if (BaseDto.ZERO_UUID.equals(uuid)) {
+            return ResourceTagVOToTagConverter.getRootTag();
+        }
+        Tag tag = getDummyTags().get(uuid);
+        if (tag == null) {
+            ResourceTagVO resourceTagVO = resourceTagDao.findByResourceTypeKeyPrefixAndValue(
+                    ResourceTag.ResourceObjectType.UserVm, VM_TAG_KEY, uuid);
+            accountService.checkAccess(CallContext.current().getCallingAccount(), null, false,
+                    resourceTagVO);
+            if (resourceTagVO != null) {
+                tag = ResourceTagVOToTagConverter.toTag(resourceTagVO);
+            }
+        }
+        if (tag == null) {
+            throw new InvalidParameterValueException("Tag with ID " + uuid + " not found");
+        }
+        return tag;
+    }
+
+    @ApiAccess(command = CreateTagsCmd.class)
+    public Tag createInstanceTag(final String vmUuid, final Tag request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        Map<String, String> tags = new HashMap<>();
+        String name = request.getId();
+        tags.put(String.format( "%s%s", VM_TAG_KEY, UuidUtils.first(UUID.randomUUID().toString())), name);
+        try {
+            List<ResourceTag> resourceTags = taggedResourceService.createTags(Collections.singletonList(vmUuid),
+                    ResourceTag.ResourceObjectType.UserVm, tags, null);
+            ResourceTagVO tag = null;
+            if (CollectionUtils.isNotEmpty(resourceTags)) {
+                tag = resourceTagDao.findById(resourceTags.get(0).getId());
+            }
+            if (tag == null) {
+                throw new CloudRuntimeException("Unknown error");
+            }
+            return ResourceTagVOToTagConverter.toTag(tag);
+        } catch (Exception e) {
+            throw new CloudRuntimeException(String.format("Failed to create tag for %s: %s", name, e.getMessage()), e);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java
new file mode 100644
index 000000000000..5380b1734881
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Api;
+import org.apache.cloudstack.veeam.api.dto.ApiSummary;
+import org.apache.cloudstack.veeam.api.dto.EmptyElement;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.ProductInfo;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.SummaryCount;
+import org.apache.cloudstack.veeam.api.dto.Version;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class ApiRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Inject
+    VeeamControlService veeamControlService;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith("/api");
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleRootApiRequest(req, resp, outFormat, io);
+            return;
+        }
+        io.notFound(resp, null, outFormat);
+    }
+
+    private void handleRootApiRequest(HttpServletRequest req, HttpServletResponse resp, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        io.getWriter().write(resp, HttpServletResponse.SC_OK,
+                createApiObject(VeeamControlService.ContextPath.value() + BASE_ROUTE),
+                outFormat);
+    }
+
+    protected Api createApiObject(String basePath) {
+        Api api = new Api();
+
+        /* ---------------- Links ---------------- */
+        List<Link> links = new ArrayList<>();
+        add(links, basePath + "/clusters", "clusters");
+        add(links, basePath + "/clusters?search={query}", "clusters/search");
+        add(links, basePath + "/datacenters", "datacenters");
+        add(links, basePath + "/datacenters?search={query}", "datacenters/search");
+        add(links, basePath + "/hosts", "hosts");
+        add(links, basePath + "/hosts?search={query}", "hosts/search");
+        add(links, basePath + "/networks", "networks");
+        add(links, basePath + "/networks?search={query}", "networks/search");
+        add(links, basePath + "/storagedomains", "storagedomains");
+        add(links, basePath + "/storagedomains?search={query}", "storagedomains/search");
+        add(links, basePath + "/vms", "vms");
+        add(links, basePath + "/vms?search={query}", "vms/search");
+        add(links, basePath + "/disks", "disks");
+        add(links, basePath + "/disks?search={query}", "disks/search");
+
+        api.setLink(links);
+
+        /* ---------------- Engine backup ---------------- */
+        api.setEngineBackup(new EmptyElement());
+
+        /* ---------------- Product info ---------------- */
+        ProductInfo productInfo = new ProductInfo();
+        productInfo.setInstanceId(veeamControlService.getInstanceId());
+        productInfo.name = VeeamControlService.PLUGIN_NAME;
+
+        productInfo.version = Version.fromPackageAndCSVersion(true);
+        api.setProductInfo(productInfo);
+
+        /* ---------------- Summary ---------------- */
+        ApiSummary summary = new ApiSummary();
+        summary.setHosts(new SummaryCount(1, 1));
+        summary.setStorageDomains(new SummaryCount(1, 2));
+        summary.setUsers(new SummaryCount(1, 1));
+        summary.setVms(new SummaryCount(1, 8));
+        api.setSummary(summary);
+
+        /* ---------------- Time ---------------- */
+        api.setTime(System.currentTimeMillis());
+
+        /* ---------------- Users ---------------- */
+        String userId = serverAdapter.getServiceAccount().first().getUuid();
+        api.setAuthenticatedUser(Ref.of(basePath + "/users/" + userId, userId));
+        api.setEffectiveUser(Ref.of(basePath + "/users/" + userId, userId));
+
+        return api;
+    }
+
+    private static void add(List<Link> links, String href, String rel) {
+        links.add(Link.of(rel, href));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java
new file mode 100644
index 000000000000..f4107ff3735e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+
+public class ClustersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/clusters";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Cluster> result = serverAdapter.listAllClusters(query.getOffset(), query.getLimit());
+            NamedList<Cluster> response = NamedList.of("cluster", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Cluster response = serverAdapter.getCluster(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java
new file mode 100644
index 000000000000..a06af4f24429
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java
@@ -0,0 +1,151 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class DataCentersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/datacenters";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("storagedomains".equals(subPath)) {
+                    handleGetStorageDomainsByDcId(id, req, resp, outFormat, io);
+                    return;
+                }
+                if ("networks".equals(subPath)) {
+                    handleGetNetworksByDcId(id, req, resp, outFormat, io);
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        ListQuery query = ListQuery.fromRequest(req);
+        final List<DataCenter> result = serverAdapter.listAllDataCenters(query.getOffset(), query.getLimit());
+        NamedList<DataCenter> response = NamedList.of("data_center", result);
+        io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            DataCenter response = serverAdapter.getDataCenter(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetStorageDomainsByDcId(final String id, final HttpServletRequest req,
+             final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            List<StorageDomain> storageDomains = serverAdapter.listStorageDomainsByDcId(id, query.getOffset(),
+                    query.getMax());
+            NamedList<StorageDomain> response = NamedList.of("storage_domain", storageDomains);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetNetworksByDcId(final String id, final HttpServletRequest req,
+           final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            List<Network> networks = serverAdapter.listNetworksByDcId(id, query.getOffset(),
+                    query.getMax());
+            NamedList<Network> response = NamedList.of("network", networks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java
new file mode 100644
index 000000000000..d12745769e1b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java
@@ -0,0 +1,201 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class DisksRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/disks";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method) &&
+                        !"PUT".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET, DELETE, PUT", outFormat);
+                    return;
+                }
+                if ("GET".equalsIgnoreCase(method)) {
+                    handleGetById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("DELETE".equalsIgnoreCase(method)) {
+                    handleDeleteById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("PUT".equalsIgnoreCase(method)) {
+                    handlePutById(id, req, resp, outFormat, io);
+                    return;
+                }
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("copy".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskCopy(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("reduce".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskReduce(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Disk> result = serverAdapter.listAllDisks(query.getOffset(), query.getLimit());
+            NamedList<Disk> response = NamedList.of("disk", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk request = io.getMapper().jsonMapper().readValue(data, Disk.class);
+            Disk response = serverAdapter.createDisk(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Disk response = serverAdapter.getDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.deleteDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Deleted disk ID: " + id, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePutById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                         final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk request = io.getMapper().jsonMapper().readValue(data, Disk.class);
+            Disk response = serverAdapter.updateDisk(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskCopy(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk response = serverAdapter.copyDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskReduce(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk response = serverAdapter.reduceDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java
new file mode 100644
index 000000000000..931291714c6c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+
+public class HostsRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/hosts";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Host> result = serverAdapter.listAllHosts(query.getOffset(), query.getLimit());
+            NamedList<Host> response = NamedList.of("host", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Host response = serverAdapter.getHost(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java
new file mode 100644
index 000000000000..1a04e4028cf0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java
@@ -0,0 +1,162 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class ImageTransfersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/imagetransfers";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET", outFormat);
+                    return;
+                }
+                handleGetById(id, resp, outFormat, io);
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                if (!"POST".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "POST", outFormat);
+                    return;
+                }
+                String subPath = idAndSubPath.get(1);
+                if ("cancel".equals(subPath)) {
+                    handleCancelById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("finalize".equals(subPath)) {
+                    handleFinalizeById(id, resp, outFormat, io);
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<ImageTransfer> result = serverAdapter.listAllImageTransfers(query.getOffset(), query.getLimit());
+            NamedList<ImageTransfer> response = NamedList.of("image_transfer", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                           Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            ImageTransfer request = io.getMapper().jsonMapper().readValue(data, ImageTransfer.class);
+            ImageTransfer response = serverAdapter.createImageTransfer(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            ImageTransfer response = serverAdapter.getImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleCancelById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.cancelImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Image transfer cancelled successfully", outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleFinalizeById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                    final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.finalizeImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Image transfer finalized successfully", outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java
new file mode 100644
index 000000000000..95e4e3c9559a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java
@@ -0,0 +1,108 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class JobsRouteHandler  extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/jobs";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                             Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            final List<Job> result = serverAdapter.listPendingJobs();
+            NamedList<Job> response = NamedList.of("job", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            Job response = serverAdapter.getJob(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java
new file mode 100644
index 000000000000..2d1f0962c2b6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class NetworksRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/networks";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Network> result = serverAdapter.listAllNetworks(query.getOffset(), query.getLimit());
+            NamedList<Network> response = NamedList.of("network", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Network response = serverAdapter.getNetwork(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java
new file mode 100644
index 000000000000..e1daefc1c443
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java
@@ -0,0 +1,111 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class TagsRouteHandler  extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/tags";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat,
+                   VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                             Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Tag> result = serverAdapter.listAllTags(query.getOffset(), query.getLimit());
+            NamedList<Tag> response = NamedList.of("tag", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            Tag response = serverAdapter.getTag(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java
new file mode 100644
index 000000000000..10ca7f80f04e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java
@@ -0,0 +1,580 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class VmsRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/vms";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                io.methodNotAllowed(resp, "GET, POST, DELETE", outFormat);
+                return;
+            }
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method) && !"PUT".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET, PUT, DELETE", outFormat);
+                } else if ("GET".equalsIgnoreCase(method)) {
+                    handleGetById(id, req, resp, outFormat, io);
+                } else if ("PUT".equalsIgnoreCase(method)) {
+                    handleUpdateById(id, req, resp, outFormat, io);
+                } else if ("DELETE".equalsIgnoreCase(method)) {
+                    handleDeleteById(id, req, resp, outFormat, io);
+                }
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("start".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleStartVmById(id, req, resp, outFormat, io);
+                    } else {
+                         io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("stop".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleStopVmById(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("shutdown".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleShutdownVmById(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("diskattachments".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetDiskAttachmentsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskAttachmentForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("nics".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetNicsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostNicForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("snapshots".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetSnapshotsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostSnapshotForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("backups".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostBackupForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("checkpoints".equals(subPath)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetCheckpointsByVmId(id, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    }
+                    return;
+                } else if ("tags".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostTagForVmId(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            } else if (idAndSubPath.size() == 3) {
+                String subPath = idAndSubPath.get(1);
+                String subId = idAndSubPath.get(2);
+                if ("diskattachments".equals(subPath)) {
+                    if (!"DELETE".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "DELETE", outFormat);
+                    } else  {
+                        handleDeleteDiskAttachmentForVmId(id, subId, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("snapshots".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, DELETE", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetSnapshotById(subId, resp, outFormat, io);
+                    } else if ("DELETE".equalsIgnoreCase(method)) {
+                        handleDeleteSnapshotById(subId, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("backups".equals(subPath)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupById(subId, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET", outFormat);
+                    }
+                    return;
+                } else if ("checkpoints".equals(subPath)) {
+                    if ("DELETE".equalsIgnoreCase(method)) {
+                        handleDeleteCheckpoint(id, subId, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "DELETE", outFormat);
+                    }
+                    return;
+                }
+            } else if (idAndSubPath.size() == 4) {
+                String subPath = idAndSubPath.get(1);
+                String subId = idAndSubPath.get(2);
+                String action = idAndSubPath.get(3);
+                if ("snapshots".equals(subPath) && "restore".equals(action)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleRestoreSnapshotById(subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("backups".equals(subPath) && "disks".equals(action)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupDisksById(subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET", outFormat);
+                    }
+                    return;
+                } else if ("backups".equals(subPath) && "finalize".equals(action)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleFinalizeBackupById(id, subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Vm> result = serverAdapter.listAllInstances(query.followContains("tags"),
+                    query.followContains("disk_attachments.disk"),
+                    query.followContains("nics.reporteddevices"),
+                    query.isAllContent(),
+                    query.getOffset(),
+                    query.getLimit());
+            NamedList<Vm> response = NamedList.of("vm", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                              Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Vm request = io.getMapper().jsonMapper().readValue(data, Vm.class);
+            Vm response = serverAdapter.createInstance(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            Vm response = serverAdapter.getInstance(id,
+                    query.followContains("tags"),
+                    query.followContains("disk_attachments.disk"),
+                    query.followContains("nics.reporteddevices"),
+                    query.isAllContent());
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleUpdateById(final String id, final HttpServletRequest req, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                    final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Vm request = io.getMapper().jsonMapper().readValue(data, Vm.class);
+            Vm response = serverAdapter.updateInstance(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        boolean deleteVolumes = Boolean.FALSE.toString().equals(req.getParameter("detach_only"));
+        try {
+            VmAction vm = serverAdapter.deleteInstance(id, deleteVolumes, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleStartVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.startInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleStopVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.stopInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleShutdownVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.shutdownInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetDiskAttachmentsByVmId(final String id, final HttpServletResponse resp,
+                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<DiskAttachment> disks = serverAdapter.listDiskAttachmentsByInstanceUuid(id);
+            NamedList<DiskAttachment> response = NamedList.of("disk_attachment", disks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskAttachmentForVmId(final String id, final HttpServletRequest req,
+             final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            DiskAttachment request = io.getMapper().jsonMapper().readValue(data, DiskAttachment.class);
+            DiskAttachment response = serverAdapter.attachInstanceDisk(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetNicsByVmId(final String id, final HttpServletResponse resp,
+                   final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Nic> nics = serverAdapter.listNicsByInstanceUuid(id);
+            NamedList<Nic> response = NamedList.of("nic", nics);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostNicForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Nic request = io.getMapper().jsonMapper().readValue(data, Nic.class);
+            Nic response = serverAdapter.attachInstanceNic(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetSnapshotsByVmId(final String id, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Snapshot> snapshots = serverAdapter.listSnapshotsByInstanceUuid(id);
+            NamedList<Snapshot> response = NamedList.of("snapshot", snapshots);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostSnapshotForVmId(final String id, final HttpServletRequest req,
+                 final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Snapshot request = io.getMapper().jsonMapper().readValue(data, Snapshot.class);
+            Snapshot response = serverAdapter.createInstanceSnapshot(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteDiskAttachmentForVmId(final String vmId, final String diskId,
+             final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean delete = Boolean.FALSE.toString().equals(req.getParameter("detach_only"));
+        try {
+            serverAdapter.detachInstanceDisk(vmId, diskId);
+            if (delete) {
+                serverAdapter.deleteDisk(diskId);
+            }
+            Map<String, String> response = Map.of("status", "complete");
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetSnapshotById(final String id, final HttpServletResponse resp,
+                 final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            Snapshot response = serverAdapter.getSnapshot(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteSnapshotById(final String id, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            ResourceAction action = serverAdapter.deleteSnapshot(id, async);
+            if (action != null) {
+                io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, action, outFormat);
+            } else {
+                io.getWriter().write(resp, HttpServletResponse.SC_OK, null, outFormat);
+            }
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleRestoreSnapshotById(final String id, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            ResourceAction response = serverAdapter.revertInstanceToSnapshot(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupsByVmId(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Backup> backups = serverAdapter.listBackupsByInstanceUuid(id);
+            NamedList<Backup> response = NamedList.of("backup", backups);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostBackupForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Backup request = io.getMapper().jsonMapper().readValue(data, Backup.class);
+            Backup response = serverAdapter.createInstanceBackup(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupById(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            Backup response = serverAdapter.getBackup(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupDisksById(final String id, final HttpServletRequest req,
+            final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            List<Disk> disks = serverAdapter.listDisksByBackupUuid(id);
+            NamedList<Disk> response = NamedList.of("disk", disks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleFinalizeBackupById(final String vmId, final String backupId, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            Backup backup = serverAdapter.finalizeBackup(vmId, backupId);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, backup, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetCheckpointsByVmId(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Checkpoint> checkpoints = serverAdapter.listCheckpointsByInstanceUuid(id);
+            NamedList<Checkpoint> response = NamedList.of("checkpoints", checkpoints);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteCheckpoint(final String vmId, final String checkpointId,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            serverAdapter.deleteCheckpoint(vmId, checkpointId);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, null, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostTagForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Tag request = io.getMapper().jsonMapper().readValue(data, Tag.class);
+            Tag response = serverAdapter.createInstanceTag(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java
new file mode 100644
index 000000000000..fbfc0c9a92dd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class VnicProfilesRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/vnicprofiles";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<VnicProfile> result = serverAdapter.listAllVnicProfiles(query.getOffset(), query.getLimit());
+            NamedList<VnicProfile> response = NamedList.of("vnic_profile", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            VnicProfile response = serverAdapter.getVnicProfile(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java
new file mode 100644
index 000000000000..e1fbfc82e7aa
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java
@@ -0,0 +1,90 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.JobsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+
+public class AsyncJobJoinVOToJobConverter {
+
+    public static Job toJob(AsyncJobJoinVO vo) {
+        Job job = new Job();
+        final String basePath = VeeamControlService.ContextPath.value();
+        job.setId(vo.getUuid());
+        job.setHref(basePath + JobsRouteHandler.BASE_ROUTE + "/" + vo.getUuid());
+        job.setAutoCleared(Boolean.TRUE.toString());
+        job.setExternal(Boolean.TRUE.toString());
+        job.setLastUpdated(System.currentTimeMillis());
+        job.setStartTime(vo.getCreated().getTime());
+        JobInfo.Status status = JobInfo.Status.values()[vo.getStatus()];
+        Long endTime = System.currentTimeMillis();
+        if (status == JobInfo.Status.SUCCEEDED) {
+            job.setStatus("finished");
+            job.setEndTime(System.currentTimeMillis());
+        } else if (status == JobInfo.Status.FAILED) {
+            job.setStatus(status.name().toLowerCase());
+        } else if (status == JobInfo.Status.CANCELLED) {
+            job.setStatus("aborted");
+        } else {
+            job.setStatus("started");
+            endTime = null;
+        }
+        if (endTime != null) {
+            job.setEndTime(endTime);
+        }
+        job.setOwner(Ref.of(basePath + "/api/users/" + vo.getUserUuid(), vo.getUserUuid()));
+        job.setDescription("Something");
+        job.setLink(Collections.emptyList());
+        return job;
+    }
+
+    public static List<Job> toJobList(List<AsyncJobJoinVO> vos) {
+        return vos.stream().map(AsyncJobJoinVOToJobConverter::toJob).collect(Collectors.toList());
+    }
+
+    protected static void fillAction(final ResourceAction action, final AsyncJobJoinVO vo) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        action.setJob(Ref.of(basePath + JobsRouteHandler.BASE_ROUTE + "/" + vo.getUuid(), vo.getUuid()));
+        action.setStatus("complete");
+    }
+
+    public static VmAction toVmAction(final AsyncJobJoinVO vo, final UserVmJoinVO vm) {
+        VmAction action = new VmAction();
+        fillAction(action, vo);
+        action.setVm(UserVmJoinVOToVmConverter.toVm(vm, null, null, null, null, null, null, null, false));
+        return action;
+    }
+
+    public static ResourceAction toAction(final AsyncJobJoinVO vo) {
+        VmAction action = new VmAction();
+        fillAction(action, vo);
+        return action;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java
new file mode 100644
index 000000000000..04bac31a3d6f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.vm.UserVmVO;
+
+public class BackupVOToBackupConverter {
+
+    public static Backup toBackup(final BackupVO backupVO, final Function<Long, UserVmVO> vmResolver,
+              final Function<Long, HostJoinVO> hostResolver, final Function<BackupVO, List<Disk>> disksResolver) {
+        Backup backup = new Backup();
+        final String basePath = VeeamControlService.ContextPath.value();
+        backup.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/backups/" + backupVO.getUuid());
+        backup.setId(backupVO.getUuid());
+        backup.setName(backupVO.getName());
+        backup.setDescription(backupVO.getDescription());
+        backup.setCreationDate(backupVO.getDate().getTime());
+        backup.setPhase(mapStatusToPhase(backupVO.getStatus()));
+        if (backupVO.getFromCheckpointId() != null) {
+            backup.setFromCheckpointId(backupVO.getFromCheckpointId());
+        }
+        if (backupVO.getToCheckpointId() != null) {
+            backup.setToCheckpointId(backupVO.getToCheckpointId());
+        }
+        if (vmResolver != null) {
+            final UserVmVO vmVO = vmResolver.apply(backupVO.getVmId());
+            if (vmVO != null) {
+                backup.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmVO.getUuid(), vmVO.getUuid()));
+            }
+        }
+        if (backupVO.getHostId() != null && hostResolver != null) {
+            final HostJoinVO hostVO = hostResolver.apply(backupVO.getHostId());
+            if (hostVO != null) {
+                backup.setHost(Host.of(basePath + ApiRouteHandler.BASE_ROUTE + "/" + hostVO.getUuid(), hostVO.getUuid()));
+            }
+        }
+        if (disksResolver != null) {
+            List<Disk> disks = disksResolver.apply(backupVO);
+            backup.setDisks(NamedList.of("disks", disks));
+        }
+        return backup;
+    }
+
+    public static List<Backup> toBackupList(final List<BackupVO> backupVOs, final Function<Long, UserVmVO> vmResolver,
+                final Function<Long, HostJoinVO> hostResolver) {
+        return backupVOs
+                .stream()
+                .map(backupVO -> toBackup(backupVO, vmResolver, hostResolver, null))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapStatusToPhase(final BackupVO.Status status) {
+        switch (status) {
+            case Allocated:
+            case Queued:
+                return "initializing";
+            case BackingUp:
+                return "starting";
+            case ReadyForImageTransfer:
+                return "ready";
+            case FinalizingImageTransfer:
+                return "finalizing";
+            case Restoring:
+            case BackedUp:
+                return "succeeded";
+        }
+        return "failed";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java
new file mode 100644
index 000000000000..42b2233393da
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java
@@ -0,0 +1,155 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ClustersRouteHandler;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Version;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.dc.ClusterVO;
+import com.cloud.utils.UuidUtils;
+
+public class ClusterVOToClusterConverter {
+    public static Cluster toCluster(final ClusterVO vo, final Function<Long, DataCenterJoinVO> dataCenterResolver) {
+        final Cluster c = new Cluster();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String clusterId = vo.getUuid();
+        c.setId(clusterId);
+        c.setHref(basePath + ClustersRouteHandler.BASE_ROUTE + "/" + clusterId);
+
+        c.setName(vo.getName());
+
+        c.setBallooningEnabled("true");
+        c.setBiosType(Vm.Bios.getDefault().getType());
+        c.setFipsMode("disabled");
+        c.setFirewallType("firewalld");
+        c.setGlusterService("false");
+        c.setHaReservation("false");
+        c.setSwitchType("legacy");
+        c.setThreadsAsCores("false");
+        c.setTrustedService("false");
+        c.setTunnelMigration("false");
+        c.setUpgradeInProgress("false");
+        c.setUpgradePercentComplete("0");
+        c.setVirtService("true");
+        c.setVncEncryption("false");
+
+        // --- cpu (best-effort defaults)
+        final Cpu cpu = new Cpu();
+        cpu.setArchitecture(vo.getArch().getType());
+        cpu.setType(vo.getArch().getType()); // replace if you can detect host cpu model
+        c.setCpu(cpu);
+
+        final Version ver = Version.fromPackageAndCSVersion(false);
+        c.setVersion(ver);
+
+        // --- ksm / memory policy (defaults)
+        c.setKsm(new Cluster.Ksm());
+        c.getKsm().enabled = "true";
+        c.getKsm().mergeAcrossNodes = "true";
+
+        c.setMemoryPolicy(new Cluster.MemoryPolicy());
+        c.getMemoryPolicy().overCommit = new Cluster.OverCommit();
+        c.getMemoryPolicy().overCommit.percent = "100";
+        c.getMemoryPolicy().transparentHugepages = new Cluster.TransparentHugepages();
+        c.getMemoryPolicy().transparentHugepages.enabled = "true";
+
+        // --- migration defaults
+        c.setMigration(new Cluster.Migration());
+        c.getMigration().autoConverge = "inherit";
+        c.getMigration().bandwidth = new Cluster.Bandwidth();
+        c.getMigration().bandwidth.assignmentMethod = "auto";
+        c.getMigration().compressed = "inherit";
+        c.getMigration().encrypted = "inherit";
+        c.getMigration().parallelMigrationsPolicy = "disabled";
+        // policy ref (dummy but valid shape)
+        c.getMigration().policy = Ref.of(basePath + "/migrationpolicies/" + stableUuid("migrationpolicy:default"),
+                stableUuid("migrationpolicy:default")
+        );
+
+        // --- rng sources
+        c.setRequiredRngSources(new Cluster.RequiredRngSources());
+        c.getRequiredRngSources().requiredRngSource = Collections.singletonList("urandom");
+
+        // --- error handling
+        c.setErrorHandling(new Cluster.ErrorHandling());
+        c.getErrorHandling().onError = "migrate";
+
+        // --- fencing policy defaults
+        c.setFencingPolicy(new Cluster.FencingPolicy());
+        c.getFencingPolicy().enabled = "true";
+        c.getFencingPolicy().skipIfConnectivityBroken = new Cluster.SkipIfConnectivityBroken();
+        c.getFencingPolicy().skipIfConnectivityBroken.enabled = "false";
+        c.getFencingPolicy().skipIfConnectivityBroken.threshold = "50";
+        c.getFencingPolicy().skipIfGlusterBricksUp = "false";
+        c.getFencingPolicy().skipIfGlusterQuorumNotMet = "false";
+        c.getFencingPolicy().skipIfSdActive = new Cluster.SkipIfSdActive();
+        c.getFencingPolicy().skipIfSdActive.enabled = "false";
+
+        // --- scheduling policy props (optional; dummy ok)
+        c.setCustomSchedulingPolicyProperties(new Cluster.CustomSchedulingPolicyProperties());
+        final Cluster.Property p1 = new Cluster.Property(); p1.name = "HighUtilization"; p1.value = "80";
+        final Cluster.Property p2 = new Cluster.Property(); p2.name = "CpuOverCommitDurationMinutes"; p2.value = "2";
+        c.getCustomSchedulingPolicyProperties().property = List.of(p1, p2);
+
+        // --- data_center ref mapping (CloudStack cluster -> pod -> zone)
+        if (dataCenterResolver != null) {
+            final DataCenterJoinVO zone = dataCenterResolver.apply(vo.getDataCenterId());
+            if (zone != null) {
+                c.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + zone.getUuid(), zone.getUuid()));
+            }
+        }
+
+        // --- mac pool & scheduling policy refs (dummy but consistent)
+        c.setMacPool(Ref.of(basePath + "/macpools/" + stableUuid("macpool:default"),
+                stableUuid("macpool:default")));
+        c.setSchedulingPolicy(Ref.of(basePath + "/schedulingpolicies/" + stableUuid("schedpolicy:default"),
+                stableUuid("schedpolicy:default")));
+
+        // --- related links (optional)
+        c.setLink(List.of(
+                Link.of("networks", c.getHref() + "/networks")
+        ));
+
+        return c;
+    }
+
+    public static List<Cluster> toClusterList(final List<ClusterVO> voList,
+            final Function<Long, DataCenterJoinVO> dataCenterResolver) {
+        return voList.stream()
+                .map(vo -> toCluster(vo, dataCenterResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static String stableUuid(final String key) {
+        // deterministic UUID, so the same ClusterVO maps to same "ovirt id" every time
+        return UuidUtils.nameUUIDFromBytes(key.getBytes()).toString();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java
new file mode 100644
index 000000000000..58ceb730d69c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java
@@ -0,0 +1,76 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.SupportedVersions;
+import org.apache.cloudstack.veeam.api.dto.Version;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.org.Grouping;
+
+public class DataCenterJoinVOToDataCenterConverter {
+    public static DataCenter toDataCenter(final DataCenterJoinVO zone) {
+        final String id = zone.getUuid();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String href = basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + id;
+
+        final DataCenter dc = new DataCenter();
+
+        // ---- Identity ----
+        dc.setId(id);
+        dc.setHref(href);
+        dc.setName(zone.getName());
+        dc.setDescription(zone.getDescription());
+
+        // ---- State ----
+        dc.setStatus(Grouping.AllocationState.Enabled.equals(zone.getAllocationState()) ? "up" : "down");
+        dc.setLocal("false");
+        dc.setQuotaMode("disabled");
+
+        // ---- Versions ----
+        final Version ver = Version.fromPackageAndCSVersion(false);
+        dc.setVersion(ver);
+        dc.setSupportedVersions(new SupportedVersions(List.of(ver)));
+
+        // ---- mac_pool (static placeholder) ----
+        dc.setMacPool(Ref.of(basePath + "/macpools/default", "default"));
+
+        // ---- Related links ----
+
+        dc.link = Stream.of("cluster", "networks", "storagedomains")
+                .map(rel -> Link.of(rel, href + "/" + rel))
+                .collect(Collectors.toList());
+
+        return dc;
+    }
+
+    public static List<DataCenter> toDCList(final List<DataCenterJoinVO> srcList) {
+        return srcList.stream()
+                .map(DataCenterJoinVOToDataCenterConverter::toDataCenter)
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java
new file mode 100644
index 000000000000..da5aadac5f0e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java
@@ -0,0 +1,103 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ClustersRouteHandler;
+import org.apache.cloudstack.veeam.api.HostsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Topology;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.host.Status;
+import com.cloud.resource.ResourceState;
+
+public class HostJoinVOToHostConverter {
+
+    /**
+     * Convert CloudStack HostJoinVO -> oVirt-like Host.
+     *
+     */
+    public static Host toHost(final HostJoinVO vo) {
+        final Host h = new Host();
+
+        final String hostUuid = vo.getUuid();
+
+        h.setId(hostUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        h.setHref(basePath + HostsRouteHandler.BASE_ROUTE + "/" + hostUuid);
+
+        final String name = vo.getName() != null ? vo.getName() : ("host-" + hostUuid);
+        h.setName(name);
+
+        String addr = vo.getPrivateIpAddress();
+        h.setAddress(addr);
+
+        h.setStatus(mapStatus(vo));
+        h.setExternalStatus("ok");
+
+        // --- cluster ---
+        final String clusterUuid = vo.getClusterUuid();
+        h.setCluster(Ref.of(basePath + ClustersRouteHandler.BASE_ROUTE + "/" + clusterUuid, clusterUuid));
+
+        // --- CPU ---
+        final Cpu cpu = new Cpu();
+        cpu.setSpeed(String.valueOf(Math.toIntExact(vo.getSpeed())));
+        final Topology topo = new Topology(vo.getCpuSockets(), vo.getCpus(), 1);
+        cpu.setTopology(topo);
+        h.setCpu(cpu);
+
+        // --- Memory ---
+        h.setMemory(String.valueOf(vo.getTotalMemory()));
+        h.setMaxSchedulingMemory(String.valueOf(Math.max(0, vo.getTotalMemory() - vo.getMemUsedCapacity())));
+
+        h.setType("ovirt_node");
+        h.setAutoNumaStatus("unknown");
+        h.setKdumpStatus("disabled");
+        h.setNumaSupported("false");
+        h.setReinstallationRequired("false");
+        h.setUpdateAvailable("false");
+
+
+        h.setActions(null);
+        h.setLink(Collections.emptyList());
+
+        return h;
+    }
+
+    public static List<Host> toHostList(final List<HostJoinVO> vos) {
+        return vos.stream().map(HostJoinVOToHostConverter::toHost).collect(Collectors.toList());
+    }
+
+    private static String mapStatus(final HostJoinVO vo) {
+        if (vo.isInMaintenanceStates()) {
+            return "maintenance";
+        }
+        if (Status.Up.equals(vo.getStatus()) &&
+                ResourceState.Enabled.equals(vo.getResourceState())) {
+            return "up";
+        }
+        return "down";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java
new file mode 100644
index 000000000000..8b6b9eb92e4f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java
@@ -0,0 +1,89 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DisksRouteHandler;
+import org.apache.cloudstack.veeam.api.HostsRouteHandler;
+import org.apache.cloudstack.veeam.api.ImageTransfersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+
+public class ImageTransferVOToImageTransferConverter {
+    public static ImageTransfer toImageTransfer(ImageTransferVO vo, final Function<Long, HostJoinVO> hostResolver,
+            final Function<Long, VolumeJoinVO> volumeResolver) {
+        ImageTransfer imageTransfer = new ImageTransfer();
+        final String basePath = VeeamControlService.ContextPath.value();
+        imageTransfer.setId(vo.getUuid());
+        imageTransfer.setHref(basePath + ImageTransfersRouteHandler.BASE_ROUTE + "/" + vo.getUuid());
+        imageTransfer.setActive(Boolean.toString(org.apache.cloudstack.backup.ImageTransfer.Phase.transferring.equals(vo.getPhase())));
+        imageTransfer.setDirection(vo.getDirection().name());
+        imageTransfer.setFormat("cow");
+        imageTransfer.setInactivityTimeout(Integer.toString(3600));
+        imageTransfer.setPhase(vo.getPhase().name());
+        if (org.apache.cloudstack.backup.ImageTransfer.Phase.finished.equals(vo.getPhase())) {
+            imageTransfer.setPhase("finished_success");
+        } else if (org.apache.cloudstack.backup.ImageTransfer.Phase.failed.equals(vo.getPhase())) {
+            imageTransfer.setPhase("finished_failed");
+        }
+        imageTransfer.setShallow(Boolean.toString(false));
+        imageTransfer.setTimeoutPolicy("legacy");
+        imageTransfer.setTransferUrl(vo.getTransferUrl());
+        imageTransfer.setTransferred(Long.toString(0));
+        if (hostResolver != null) {
+            HostJoinVO hostVo = hostResolver.apply(vo.getHostId());
+            if (hostVo != null) {
+                imageTransfer.setHost(Ref.of(basePath + HostsRouteHandler.BASE_ROUTE + "/" + hostVo.getUuid(), hostVo.getUuid()));
+            }
+        }
+        if (volumeResolver != null) {
+            VolumeJoinVO volumeVo = volumeResolver.apply(vo.getVolumeId());
+            if (volumeVo != null) {
+                imageTransfer.setDisk(Ref.of(basePath + DisksRouteHandler.BASE_ROUTE + "/" + volumeVo.getUuid(), volumeVo.getUuid()));
+                imageTransfer.setImage(Ref.of(null, volumeVo.getUuid()));
+            }
+        }
+        final List<Link> links = new ArrayList<>();
+        links.add(getLink(imageTransfer, "cancel"));
+        links.add(getLink(imageTransfer, "finalize"));
+        imageTransfer.setActions(NamedList.of("link", links));
+        return imageTransfer;
+    }
+
+    public static List<ImageTransfer> toImageTransferList(List<? extends ImageTransferVO> vos,
+            final Function<Long, HostJoinVO> hostResolver,
+            final Function<Long, VolumeJoinVO> volumeResolver) {
+        return vos.stream().map(vo -> toImageTransfer(vo, hostResolver, volumeResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static Link getLink(ImageTransfer it, String rel) {
+        return Link.of(rel, it.getHref() + "/" + rel);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java
new file mode 100644
index 000000000000..82198997e7db
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.NetworksRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToNetworkConverter {
+    public static Network toNetwork(final NetworkVO vo, final Function<Long, DataCenterJoinVO> dcResolver) {
+        final Network dto = new Network();
+
+        final String networkUuid = vo.getUuid();
+        dto.setId(networkUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        dto.setHref(basePath + NetworksRouteHandler.BASE_ROUTE + "/" + networkUuid);
+
+        String name = vo.getName() != null ? vo.getName() : vo.getTrafficType().name() + "-" + networkUuid;
+        dto.setName(name);
+        dto.setDescription(vo.getDisplayText());
+        dto.setComment("");
+
+        dto.setMtu(String.valueOf(vo.getPrivateMtu() != null ? vo.getPrivateMtu() : 0));
+        dto.setPortIsolation("false");
+        dto.setStp("false");
+
+        dto.setUsages(NamedList.of("usage", List.of("vm")));
+
+        // Best-effort mapping for vdsm_name
+        dto.setVdsmName(dto.getName());
+
+        if (dcResolver != null) {
+            final DataCenterJoinVO dc = dcResolver.apply(vo.getDataCenterId());
+            if (dc != null) {
+                final String dcUuid = dc.getUuid();
+                if (dcUuid != null && !dcUuid.isEmpty()) {
+                    dto.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + dcUuid, dcUuid));
+                }
+            }
+        }
+
+        dto.setLink(Collections.emptyList());
+
+        return dto;
+    }
+
+    public static List<Network> toNetworkList(final List<? extends NetworkVO> vos,
+            final Function<Long, DataCenterJoinVO> dcResolver) {
+        return vos.stream()
+                .map(vo -> toNetwork(vo, dcResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java
new file mode 100644
index 000000000000..af10d586c89a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java
@@ -0,0 +1,65 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.NetworksRouteHandler;
+import org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToVnicProfileConverter {
+    public static VnicProfile toVnicProfile(final NetworkVO vo, final Function<Long, DataCenterJoinVO> dcResolver) {
+        final VnicProfile vnicProfile = new VnicProfile();
+
+        final String networkUuid = vo.getUuid();
+        vnicProfile.setId(networkUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        vnicProfile.setHref(basePath + VnicProfilesRouteHandler.BASE_ROUTE + "/" + networkUuid);
+        vnicProfile.setId(networkUuid);
+        String name = vo.getName() != null ? vo.getName() : vo.getTrafficType().name() + "-" + networkUuid;
+        vnicProfile.setName(name);
+        vnicProfile.setNetwork(Ref.of(basePath + NetworksRouteHandler.BASE_ROUTE + "/" + networkUuid, networkUuid));
+        vnicProfile.setDescription(vo.getDisplayText());
+
+        if (dcResolver != null) {
+            final DataCenterJoinVO dc = dcResolver.apply(vo.getDataCenterId());
+            if (dc != null) {
+                final String dcUuid = dc.getUuid();
+                if (dcUuid != null && !dcUuid.isEmpty()) {
+                    vnicProfile.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + dcUuid, dcUuid));
+                }
+            }
+        }
+        return vnicProfile;
+    }
+
+    public static List<VnicProfile> toVnicProfileList(final List<NetworkVO> vos, final Function<Long, DataCenterJoinVO> dcResolver) {
+        return vos.stream()
+                .map(vo -> toVnicProfile(vo, dcResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java
new file mode 100644
index 000000000000..3af2f7c31396
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Ip;
+import org.apache.cloudstack.veeam.api.dto.Mac;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.ReportedDevice;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.vm.NicVO;
+
+public class NicVOToNicConverter {
+    private static final String DEFAULT_INTERFACE_TYPE = "virtio";
+    private static final String DEFAULT_REPORTED_DEVICE_NAME = "eth0";
+
+    public static Nic toNic(final NicVO vo, final String vmUuid, final Function<Long, NetworkVO> networkResolver) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Nic nic = new Nic();
+        nic.setId(vo.getUuid());
+        nic.setName(vo.getReserver());
+        Mac mac = new Mac();
+        mac.setAddress(vo.getMacAddress());
+        nic.setMac(mac);
+        nic.setLinked(Boolean.TRUE.toString());
+        nic.setPlugged(Boolean.TRUE.toString());
+        nic.setSynced(Boolean.TRUE.toString());
+        if (StringUtils.isNotBlank(vmUuid)) {
+            Vm vm = Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid, vmUuid);
+            nic.setVm(vm);
+            nic.setHref(vm.getHref() + "/nics/" + vo.getUuid());
+        }
+        nic.setInterfaceType(DEFAULT_INTERFACE_TYPE);
+        ReportedDevice device = getReportedDevice(vo, mac, nic.getVm());
+        nic.setReportedDevices(NamedList.of("reported_device", List.of(device)));
+        if (networkResolver != null) {
+            final NetworkVO network = networkResolver.apply(vo.getNetworkId());
+            if (network != null) {
+                nic.setVnicProfile(Ref.of(basePath + VnicProfilesRouteHandler.BASE_ROUTE + "/" + network.getUuid(), network.getUuid()));
+            }
+        }
+        return nic;
+    }
+
+    @NotNull
+    private static ReportedDevice getReportedDevice(NicVO vo, Mac mac, Vm vm) {
+        ReportedDevice device = new ReportedDevice();
+        device.setType("network");
+        device.setId(vo.getUuid());
+        device.setName(DEFAULT_REPORTED_DEVICE_NAME);
+        device.setDescription(String.format("%s device", vo.getReserver()));
+        device.setMac(mac);
+        if (ObjectUtils.anyNotNull(vo.getIPv4Address(), vo.getIPv6Address())) {
+            List<Ip> ips = getIps(vo);
+            device.setIps(NamedList.of("ip", ips));
+        }
+        device.setHref(vm.getHref() + "/reporteddevices/" + vo.getUuid());
+        device.setVm(vm);
+        return device;
+    }
+
+    @NotNull
+    private static List<Ip> getIps(NicVO vo) {
+        List<Ip> ips = new ArrayList<>();
+        if (vo.getIPv4Address() != null) {
+            Ip ip = new Ip();
+            ip.setAddress(vo.getIPv4Address());
+            ip.setGateway(vo.getIPv4Gateway());
+            ip.setVersion("v4");
+            ips.add(ip);
+        }
+        if (vo.getIPv6Address() != null) {
+            Ip ip6 = new Ip();
+            ip6.setAddress(vo.getIPv6Address());
+            ip6.setGateway(vo.getIPv6Gateway());
+            ip6.setVersion("v6");
+            ips.add(ip6);
+        }
+        return ips;
+    }
+
+    public static List<Nic> toNicList(final List<NicVO> vos, final String vmUuid, final Function<Long, NetworkVO> networkResolver) {
+        return vos.stream()
+                .map(vo -> toNic(vo, vmUuid, networkResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java
new file mode 100644
index 000000000000..38d67a778378
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.TagsRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+
+import com.cloud.server.ResourceTag;
+import com.cloud.tags.ResourceTagVO;
+
+public class ResourceTagVOToTagConverter {
+
+    public static Ref getRootTagRef() {
+        String basePath = VeeamControlService.ContextPath.value();
+        return Ref.of(basePath + TagsRouteHandler.BASE_ROUTE + "/" + BaseDto.ZERO_UUID, BaseDto.ZERO_UUID);
+    }
+
+    public static Tag getRootTag() {
+        Tag tag = new Tag();
+        tag.setId(BaseDto.ZERO_UUID);
+        tag.setName("root");
+        tag.setHref(getRootTagRef().getHref());
+        return tag;
+    }
+
+    public static Tag toTag(ResourceTagVO vo) {
+        String basePath = VeeamControlService.ContextPath.value();
+        Tag tag = new Tag();
+        String id = vo.getValue();
+        tag.setId(id);
+        tag.setName(vo.getValue());
+        tag.setDescription(String.format("Tag %s with value: %s", vo.getKey(), vo.getValue()));
+        tag.setHref(basePath + TagsRouteHandler.BASE_ROUTE + "/" + id);
+        if (ResourceTag.ResourceObjectType.UserVm.equals(vo.getResourceType())) {
+            tag.setVm(Ref.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vo.getResourceUuid(),
+                    vo.getResourceUuid()));
+        }
+        tag.setParent(getRootTagRef());
+        return tag;
+    }
+
+    public static Tag toTag(String id) {
+        String basePath = VeeamControlService.ContextPath.value();
+        Tag tag = new Tag();
+        tag.setId(id);
+        tag.setName(id);
+        tag.setDescription(String.format("Tag: %s", id));
+        tag.setHref(basePath + TagsRouteHandler.BASE_ROUTE + "/" + id);
+        tag.setParent(getRootTagRef());
+        return tag;
+    }
+
+    public static List<Tag> toTags(List<ResourceTagVO> vos) {
+        return vos.stream().map(ResourceTagVOToTagConverter::toTag).collect(Collectors.toList());
+    }
+
+    public static List<Tag> toTagsFromValues(List<String> values) {
+        return values.stream().map(ResourceTagVOToTagConverter::toTag).collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java
new file mode 100644
index 000000000000..2b8f65052528
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java
@@ -0,0 +1,244 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Storage;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+
+import com.cloud.api.query.vo.ImageStoreJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+
+public class StoreVOToStorageDomainConverter {
+
+    /** Primary storage -> oVirt storage_domain (type=data) */
+    public static StorageDomain toStorageDomain(final StoragePoolJoinVO pool) {
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String id = pool.getUuid();
+
+        StorageDomain sd = new StorageDomain();
+        sd.setId(id);
+        final String href = href(basePath, ApiRouteHandler.BASE_ROUTE + "/storagedomains/" + id);
+        sd.setHref(href);
+
+        sd.setName(pool.getName());
+
+        // oVirt sample returns numbers as strings
+        sd.setAvailable(Long.toString(Math.max(0, pool.getCapacityBytes() - pool.getUsedBytes())));
+        sd.setUsed(Long.toString(pool.getUsedBytes()));
+        sd.setCommitted(Long.toString(pool.getCapacityBytes()));
+
+        sd.setType("data");
+        sd.setStatus(mapPoolStatus(pool));   // "active"/"inactive"/"maintenance" (approx)
+        sd.setMaster("true");                // if you don’t have a concept, choose stable default
+        sd.setBackup("false");
+
+        sd.setBlockSize("512");              // stable default unless you can compute it
+        sd.setExternalStatus("ok");
+        sd.setStorageFormat("v5");
+
+        sd.setDiscardAfterDelete("false");
+        sd.setWipeAfterDelete("false");
+        sd.setSupportsDiscard("false");
+        sd.setSupportsDiscardZeroesData("false");
+
+        sd.setWarningLowSpaceIndicator("10");
+        sd.setCriticalSpaceActionBlocker("5");
+
+        // Nested storage (try to extract if available)
+        sd.setStorage(buildPrimaryStorage(pool));
+
+        // dc attachment
+        String dcId = pool.getZoneUuid();
+        DataCenter dc = new DataCenter();
+        dc.setHref(href(basePath, DataCentersRouteHandler.BASE_ROUTE + "/" + dcId));
+        dc.setId(dcId);
+        sd.setDataCenters(NamedList.of("data_center", List.of(dc)));
+
+        sd.setLink(defaultStorageDomainLinks(href, true, /*includeTemplates*/ true));
+
+        return sd;
+    }
+
+    public static List<StorageDomain> toStorageDomainListFromPools(final List<StoragePoolJoinVO> pools) {
+        return pools.stream().map(StoreVOToStorageDomainConverter::toStorageDomain).collect(Collectors.toList());
+    }
+
+    /** Secondary/Image store -> oVirt storage_domain (type=image) */
+    public static StorageDomain toStorageDomain(final ImageStoreJoinVO store) {
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String id = store.getUuid();
+
+        StorageDomain sd = new StorageDomain();
+        sd.setId(id);
+        final String href = href(basePath, ApiRouteHandler.BASE_ROUTE + "/storagedomains/" + id);
+        sd.setHref(href);
+
+        sd.setName(store.getName());
+
+        // Many image repos don’t have these values readily; keep as "0" or omit (null)
+        sd.setCommitted("0");
+        sd.setAvailable(null); // oVirt’s glance example omitted available/used
+        sd.setUsed(null);
+
+        sd.setType("image");
+        sd.setStatus("unattached"); // matches your sample for glance-like repo
+        sd.setMaster("false");
+        sd.setBackup("false");
+
+        sd.setBlockSize("512");
+        sd.setExternalStatus("ok");
+        sd.setStorageFormat("v1");
+
+        sd.setDiscardAfterDelete("false");
+        sd.setWipeAfterDelete("false");
+        sd.setSupportsDiscard("false");
+        sd.setSupportsDiscardZeroesData("false");
+
+        sd.setWarningLowSpaceIndicator("0");
+        sd.setCriticalSpaceActionBlocker("0");
+
+        sd.setStorage(buildImageStoreStorage(store));
+
+        // Optionally include dc attachment (your first object had it; second didn’t)
+        String dcId = store.getZoneUuid();
+        DataCenter dc = new DataCenter();
+        dc.setHref(href(basePath, DataCentersRouteHandler.BASE_ROUTE + "/" + dcId));
+        dc.setId(dcId);
+        sd.setDataCenters(NamedList.of("data_center", List.of(dc)));
+
+        sd.setLink(defaultStorageDomainLinks(href, false, /*includeTemplates*/ false));
+
+        return sd;
+    }
+
+    public static List<StorageDomain> toStorageDomainListFromStores(final List<ImageStoreJoinVO> stores) {
+        return stores.stream().map(StoreVOToStorageDomainConverter::toStorageDomain).collect(Collectors.toList());
+    }
+
+    // ----------- Helpers -----------
+
+    private static Storage buildPrimaryStorage(StoragePoolJoinVO pool) {
+        Storage st = new Storage();
+        st.setType(mapPrimaryStorageType(pool));
+
+        // If you can parse details/url, fill these. If not, keep empty strings like oVirt.
+        // For NFS pools in CloudStack, URL is often like: nfs://10.0.32.4/path or 10.0.32.4:/path
+        String url = null;
+        try {
+            url = pool.getHostAddress(); // sometimes exists in VO; if not, ignore
+        } catch (Exception ignored) { }
+
+        if ("nfs".equals(st.getType())) {
+            // best-effort placeholders
+            st.setAddress("");        // fill if you can parse
+            st.setPath("");           // fill if you can parse
+            st.setMountOptions("");
+            st.setNfsVersion("auto");
+        }
+        return st;
+    }
+
+    private static Storage buildImageStoreStorage(ImageStoreJoinVO store) {
+        Storage st = new Storage();
+
+        // Match your sample: glance store => type=glance
+        // If you want "nfs" for secondary, map based on provider/protocol instead.
+        st.setType(mapImageStorageType(store));
+
+        if ("nfs".equals(st.getType())) {
+            st.setAddress("");
+            st.setPath("");
+            st.setMountOptions("");
+            st.setNfsVersion("auto");
+        }
+        return st;
+    }
+
+    private static List<Link> defaultStorageDomainLinks(String basePath, boolean includeDisks, boolean includeTemplates) {
+        // Mirrors the rels you pasted; keep stable order.
+        // You can add/remove based on what endpoints you actually implement.
+        List<Link> common = new java.util.ArrayList<>();
+        common.add(Link.of("diskprofiles", href(basePath, "/diskprofiles")));
+        if (includeDisks) {
+            common.add(Link.of("disks", href(basePath, "/disks")));
+            common.add(Link.of("storageconnections", href(basePath, "/storageconnections")));
+        }
+        common.add(Link.of("permissions", href(basePath, "/permissions")));
+        if (includeTemplates) {
+            common.add(Link.of("templates", href(basePath, "/templates")));
+            common.add(Link.of("vms", href(basePath, "/vms")));
+        } else {
+            common.add(Link.of("images", href(basePath, "/images")));
+        }
+        common.add(Link.of("disksnapshots", href(basePath, "/disksnapshots")));
+        return common;
+    }
+
+    private static String mapPoolStatus(StoragePoolJoinVO pool) {
+        // This is approximate; adjust if you have better signals.
+        try {
+            Object status = pool.getStatus(); // often StoragePoolStatus enum
+            if (status != null) {
+                String s = status.toString().toLowerCase();
+                if (s.contains("up") || s.contains("enabled")) return "active";
+                if (s.contains("maintenance")) return "maintenance";
+            }
+        } catch (Exception ignored) { }
+        return "inactive";
+    }
+
+    private static String mapPrimaryStorageType(StoragePoolJoinVO pool) {
+        try {
+            Object t = pool.getPoolType(); // often StoragePoolType enum
+            if (t != null) {
+                String s = t.toString().toLowerCase();
+                if (s.contains("networkfilesystem") || s.contains("nfs") || s.contains("sharedmountpoint")) return "nfs";
+                if (s.contains("iscsi")) return "iscsi";
+                if (s.contains("filesystem")) return "localfs";
+                if (s.contains("rbd") || s.contains("ceph")) return "cinder"; // not perfect; pick stable
+            }
+        } catch (Exception ignored) { }
+        return "unknown";
+    }
+
+    private static String mapImageStorageType(ImageStoreJoinVO store) {
+        // If your secondary store is S3/NFS/etc, you may want different mapping.
+        // For your oVirt sample, "glance" is used for an image repo.
+        try {
+            String provider = store.getProviderName(); // may exist
+            if (provider != null && provider.toLowerCase().contains("glance")) return "glance";
+        } catch (Exception ignored) { }
+        return "glance";
+    }
+
+    private static String href(String baseUrl, String path) {
+        if (baseUrl.endsWith("/")) baseUrl = baseUrl.substring(0, baseUrl.length() - 1);
+        return baseUrl + path;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java
new file mode 100644
index 000000000000..dc3fe17a3d07
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java
@@ -0,0 +1,270 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Arrays;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.storage.sharedfs.SharedFS;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Os;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Topology;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.network.security.SecurityGroupVO;
+import com.cloud.vm.VirtualMachine;
+
+public final class UserVmJoinVOToVmConverter {
+
+    private UserVmJoinVOToVmConverter() {
+    }
+
+    /**
+     * Convert CloudStack UserVmJoinVO -> oVirt-like Vm DTO.
+     *
+     */
+    public static Vm toVm(final UserVmJoinVO src,
+                          final Function<Long, HostJoinVO> hostResolver,
+                          final Function<Long, Map<String, String>> detailsResolver,
+                          final Function<Long, List<Tag>> tagsResolver,
+                          final Function<Long, List<DiskAttachment>> disksResolver,
+                          final Function<UserVmJoinVO, List<Nic>> nicsResolver,
+                          final Function<UserVmJoinVO, SharedFS> sharedFsResolver,
+                          final Function<Long, List<SecurityGroupVO>> securityGroupsResolver,
+                          final boolean allContent) {
+        if (src == null) {
+            return null;
+        }
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Vm dst = new Vm();
+
+        dst.setId(src.getUuid());
+        dst.setName(StringUtils.firstNonBlank(src.getName(), src.getInstanceName()));
+        // CloudStack doesn't really have "description" for VM; displayName is closest
+        dst.setDescription(src.getDisplayName());
+        dst.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/" + src.getUuid());
+        dst.setStatus(mapStatus(src.getState()));
+        dst.setCreationTime(src.getCreated().getTime());
+        final Date lastUpdated = src.getLastUpdated() != null ? src.getLastUpdated() : src.getCreated();
+        if ("down".equals(dst.getStatus())) {
+            dst.setStopTime(lastUpdated.getTime());
+        }
+        if ("up".equals(dst.getStatus())) {
+            dst.setStartTime(lastUpdated.getTime());
+        }
+        final Ref template = buildRef(
+                basePath + ApiRouteHandler.BASE_ROUTE,
+                "templates",
+                src.getTemplateUuid()
+        );
+        dst.setTemplate(template);
+        dst.setOriginalTemplate(template);
+        if (StringUtils.isNotBlank(src.getHostUuid())) {
+            dst.setHost(buildRef(
+                    basePath + ApiRouteHandler.BASE_ROUTE,
+                    "hosts",
+                    src.getHostUuid()));
+        }
+        if (hostResolver != null) {
+            Long hostId = (src.getHostId() == null || src.getHostId() == 0) ? src.getLastHostId() : src.getHostId();
+            HostJoinVO hostVo = hostResolver.apply(hostId);
+            if (hostVo != null) {
+                dst.setHost(buildRef(
+                        basePath + ApiRouteHandler.BASE_ROUTE,
+                        "hosts",
+                        hostVo.getUuid()));
+                dst.setCluster(buildRef(
+                        basePath + ApiRouteHandler.BASE_ROUTE,
+                        "clusters",
+                        hostVo.getClusterUuid()));
+            }
+        }
+
+        String memory = String.valueOf(src.getRamSize() * 1024L * 1024L);
+        dst.setMemory(memory);
+        Vm.MemoryPolicy memoryPolicy = new Vm.MemoryPolicy();
+        memoryPolicy.setGuaranteed(memory);
+        memoryPolicy.setMax(memory);
+        memoryPolicy.setBallooning("false");
+        dst.setMemoryPolicy(memoryPolicy);
+        Cpu cpu = new Cpu();
+        cpu.setArchitecture(src.getArch());
+        cpu.setTopology(new Topology(src.getCpu(), 1, 1));
+        dst.setCpu(cpu);
+        Os os = new Os();
+        os.setType(Os.inferTypeFromOsName(src.getGuestOsDisplayName()));
+        Os.Boot boot = new Os.Boot();
+        boot.setDevices(NamedList.of("device", List.of("hd")));
+        os.setBoot(boot);
+        dst.setOs(os);
+        Vm.Bios bios = Vm.Bios.getDefault();
+        Map<String, String> details = null;
+        if (detailsResolver != null) {
+            details = detailsResolver.apply(src.getId());
+            Vm.Bios.updateBios(bios, MapUtils.getString(details, ApiConstants.BootType.UEFI.toString()));
+        }
+        dst.setBios(bios);
+        dst.setType("desktop");
+        dst.setOrigin("ovirt");
+        dst.setStateless("false");
+
+        if (disksResolver != null) {
+            List<DiskAttachment> diskAttachments = disksResolver.apply(src.getId());
+            dst.setDiskAttachments(NamedList.of("disk_attachment", diskAttachments));
+        }
+
+        if (nicsResolver != null) {
+            List<Nic> nics = nicsResolver.apply(src);
+            dst.setNics(NamedList.of("nic", nics));
+        }
+
+        dst.setActions(NamedList.of("link", List.of(
+                BaseDto.getActionLink("start", dst.getHref()),
+                BaseDto.getActionLink("stop", dst.getHref()),
+                BaseDto.getActionLink("shutdown", dst.getHref())
+        )));
+        dst.setLink(List.of(
+                BaseDto.getActionLink("diskattachments", dst.getHref()),
+                BaseDto.getActionLink("nics", dst.getHref()),
+                BaseDto.getActionLink("reporteddevices", dst.getHref()),
+                BaseDto.getActionLink("snapshots", dst.getHref())
+        ));
+        if (tagsResolver != null) {
+            List<Tag> tags = tagsResolver.apply(src.getId());
+            dst.setTags(NamedList.of("tag", tags));
+        }
+        dst.setCpuProfile(Ref.of(
+                basePath + ApiRouteHandler.BASE_ROUTE + "/cpuprofiles/" + src.getServiceOfferingUuid(),
+                src.getServiceOfferingUuid()));
+
+        dst.setInstanceId(src.getUuid());
+        dst.setInstanceName(src.getInstanceName());
+        dst.setInstanceGroupId(src.getInstanceGroupUuid());
+        dst.setAccountId(src.getAccountUuid());
+        dst.setAffinityGroupId(src.getAffinityGroupUuid());
+        dst.setUserDataId(src.getUserDataUuid());
+        dst.setDetails(details);
+        dst.setSshKeyPairNames(src.getKeypairNames());
+        dst.setGuestOsId(src.getGuestOsUuid());
+        dst.setGuestOsName(src.getGuestOsDisplayName());
+        dst.setInstanceType(src.getUserVmType());
+        updateSharedFSDetailsIfNeeded(src, sharedFsResolver, dst);
+        updateSecurityGroupsIfNeeded(src, securityGroupsResolver, dst);
+
+        // Keep at end
+        if (allContent) {
+            dst.setInitialization(getOvfInitialization(dst, src));
+        }
+
+        return dst;
+    }
+
+    private static void updateSecurityGroupsIfNeeded(UserVmJoinVO src, Function<Long, List<SecurityGroupVO>> securityGroupsResolver, Vm dst) {
+        if (securityGroupsResolver == null) {
+            return;
+        }
+        List<SecurityGroupVO> securityGroups = securityGroupsResolver.apply(src.getId());
+        if (CollectionUtils.isEmpty(securityGroups)) {
+            return;
+        }
+        dst.setSecurityGroupIds(securityGroups.stream()
+                .map(SecurityGroupVO::getUuid)
+                .collect(Collectors.toList()));
+    }
+
+    private static void updateSharedFSDetailsIfNeeded(UserVmJoinVO src, Function<UserVmJoinVO, SharedFS> sharedFsResolver, Vm dst) {
+        if (sharedFsResolver == null || dst.getDiskAttachments() == null) {
+            return;
+        }
+        SharedFS sharedFS = sharedFsResolver.apply(src);
+        if (sharedFS == null) {
+            return;
+        }
+        Optional<DiskAttachment> disk = dst.getDiskAttachments().getItems()
+                .stream()
+                .filter(d -> d.getInternalId() == sharedFS.getVolumeId())
+                .findFirst();
+        disk.ifPresent(diskAttachment -> {
+            dst.setSharedFSId(sharedFS.getUuid());
+            dst.setSharedFsVolumeName(diskAttachment.getLogicalName());
+        });
+    }
+
+    private static Vm.Initialization getOvfInitialization(Vm vm, UserVmJoinVO vo) {
+        final Vm.Initialization.Configuration configuration = new Vm.Initialization.Configuration();
+        configuration.setType("ovf");
+        configuration.setData(OvfXmlUtil.toXml(vm, vo));
+
+        final Vm.Initialization initialization = new Vm.Initialization();
+        initialization.setConfiguration(configuration);
+        return initialization;
+    }
+
+    public static List<Vm> toVmList(final List<UserVmJoinVO> srcList,
+                                    final Function<Long, HostJoinVO> hostResolver,
+                                    final Function<Long, Map<String, String>> detailsResolver,
+                                    final Function<Long, List<Tag>> tagsResolver,
+                                    final Function<Long, List<DiskAttachment>> disksResolver,
+                                    final Function<UserVmJoinVO, List<Nic>> nicsResolver,
+                                    final Function<UserVmJoinVO, SharedFS> sharedFsResolver,
+                                    final Function<Long, List<SecurityGroupVO>> securityGroupsResolver,
+                                    final boolean allContent) {
+        return srcList.stream()
+                .map(v -> toVm(v, hostResolver, detailsResolver, tagsResolver, disksResolver,
+                        nicsResolver, sharedFsResolver, securityGroupsResolver, allContent))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapStatus(final VirtualMachine.State state) {
+        if (Arrays.asList(
+                VirtualMachine.State.Running,
+                VirtualMachine.State.Migrating,
+                VirtualMachine.State.Restoring).contains(state)) {
+            return "up";
+        }
+        return "down";
+    }
+
+    private static Ref buildRef(final String baseHref, final String suffix, final String id) {
+        if (StringUtils.isBlank(id)) {
+            return null;
+        }
+        return Ref.of((baseHref != null) ? (baseHref + "/" + suffix + "/" + id) : null, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java
new file mode 100644
index 000000000000..7f64b6b7d4aa
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.time.Instant;
+
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.NumbersUtil;
+
+public class UserVmVOToCheckpointConverter {
+
+    public static Checkpoint toCheckpoint(String checkpointId, String createTimeStr) {
+        if (StringUtils.isEmpty(checkpointId)) {
+            return null;
+        }
+        Checkpoint checkpoint = new Checkpoint();
+        checkpoint.setId(checkpointId);
+        checkpoint.setName(checkpointId);
+        long createTimeSeconds = createTimeStr != null ? NumbersUtil.parseLong(createTimeStr, 0L) : 0L;
+        if (createTimeSeconds > 0) {
+            checkpoint.setCreationDate(String.valueOf(Instant.ofEpochSecond(createTimeSeconds).toEpochMilli()));
+        } else {
+            checkpoint.setCreationDate(String.valueOf(System.currentTimeMillis()));
+        }
+        checkpoint.setState("created");
+        return checkpoint;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java
new file mode 100644
index 000000000000..4dbc71505d79
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java
@@ -0,0 +1,54 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+
+public class VmSnapshotVOToSnapshotConverter {
+    public static Snapshot toSnapshot(final VMSnapshotVO vmSnapshotVO, String vmUuid) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Snapshot snapshot = new Snapshot();
+        snapshot.setId(vmSnapshotVO.getUuid());
+        snapshot.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid + "/snapshots/" + vmSnapshotVO.getUuid());
+        snapshot.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid, vmUuid));
+        snapshot.setDescription(vmSnapshotVO.getDescription());
+        snapshot.setSnapshotType("active");
+        snapshot.setDate(vmSnapshotVO.getCreated().getTime());
+        snapshot.setPersistMemorystate(String.valueOf(VMSnapshotVO.Type.DiskAndMemory.equals(vmSnapshotVO.getType())));
+        snapshot.setSnapshotStatus(VMSnapshot.State.Ready.equals(vmSnapshotVO.getState()) ? "ok" : "locked");
+        snapshot.setActions(NamedList.of("link", List.of(BaseDto.getActionLink("restore", snapshot.getHref()))));
+        return snapshot;
+    }
+
+    public static List<Snapshot> toSnapshotList(final List<VMSnapshotVO> vmSnapshotVOList, final String vmUuid) {
+        return vmSnapshotVOList.stream()
+                .map(v -> toSnapshot(v, vmUuid))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java
new file mode 100644
index 000000000000..ea1a6d6fbf1e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java
@@ -0,0 +1,198 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.DisksRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+
+public class VolumeJoinVOToDiskConverter {
+    public static Disk toDisk(final VolumeJoinVO vol, final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        final Disk disk = new Disk();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String apiBasePath = basePath + ApiRouteHandler.BASE_ROUTE;
+        final String diskId = vol.getUuid();
+        final String diskHref = basePath + DisksRouteHandler.BASE_ROUTE + "/" + diskId;
+
+        disk.setId(diskId);
+        disk.setHref(diskHref);
+        disk.setBootable(String.valueOf(Volume.Type.ROOT.equals(vol.getVolumeType())));
+
+        // Names
+        disk.setName(vol.getName());
+        disk.setAlias(vol.getName());
+        disk.setDescription(vol.getName());
+
+        // Sizes (bytes)
+        final long size = vol.getSize();
+        final long actualSize = vol.getVolumeStoreSize();
+
+        disk.setProvisionedSize(String.valueOf(size));
+        disk.setActualSize(String.valueOf(actualSize));
+        disk.setTotalSize(String.valueOf(size));
+        Long physicalSize = null;
+        if (physicalSizeResolver != null) {
+            physicalSize = physicalSizeResolver.apply(vol);
+        }
+        if (physicalSize != null) {
+            disk.setActualSize(String.valueOf(physicalSize));
+        }
+
+        // Disk format
+        disk.setFormat(mapFormat(vol.getFormat()));
+        disk.setQcowVersion("qcow2_v3");
+
+        // Content & storage
+        disk.setContentType("data");
+        disk.setStorageType("image");
+        disk.setSparse("true");
+        disk.setShareable("false");
+
+        // Status
+        disk.setStatus(mapStatus(vol.getState()));
+
+        // Backup-related flags (safe defaults)
+        disk.setBackup("none");
+        disk.setPropagateErrors("false");
+        disk.setWipeAfterDelete("false");
+
+        // Image ID (best-effort)
+        disk.setImageId(vol.getPath()); // acceptable placeholder
+
+        // Disk profile (optional)
+        disk.setDiskProfile(Ref.of(
+                apiBasePath + "/diskprofiles/" + vol.getDiskOfferingUuid(),
+                String.valueOf(vol.getDiskOfferingUuid())
+        ));
+
+        // Storage domains
+        if (vol.getPoolUuid() != null) {
+            StorageDomain sd = new StorageDomain();
+            sd.setHref(apiBasePath + "/storagedomains/" + vol.getPoolUuid());
+            sd.setId(vol.getPoolUuid());
+            disk.setStorageDomains(NamedList.of("storage_domain", List.of(sd)));
+        }
+
+        // Links
+        disk.setLink(List.of(
+                Link.of("disksnapshots", diskHref + "/disksnapshots")
+        ));
+
+        return disk;
+    }
+
+    public static List<Disk> toDiskList(final List<VolumeJoinVO> srcList,
+                        final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        return srcList.stream()
+                .map(vo -> toDisk(vo, physicalSizeResolver))
+                .collect(Collectors.toList());
+    }
+
+    public static List<Disk> toDiskListFromVolumeInfos(final List<Backup.VolumeInfo> volumeInfos) {
+        List<Disk> disks = new ArrayList<>();
+        for (Backup.VolumeInfo volumeInfo : volumeInfos) {
+            Disk disk = new Disk();
+            disk.setId(volumeInfo.getUuid());
+            disk.setName(volumeInfo.getUuid());
+            disk.setProvisionedSize(String.valueOf(volumeInfo.getSize()));
+            disk.setActualSize(String.valueOf(volumeInfo.getSize()));
+            disk.setTotalSize(String.valueOf(volumeInfo.getSize()));
+            disk.setBootable(String.valueOf(Volume.Type.ROOT.equals(volumeInfo.getType())));
+            disks.add(disk);
+        }
+        return disks;
+    }
+
+    public static  DiskAttachment toDiskAttachment(final VolumeJoinVO vol,
+                           final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        final DiskAttachment da = new DiskAttachment();
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String diskAttachmentId = vol.getUuid();
+        da.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vol.getVmUuid(), vol.getVmUuid()));
+
+        da.setId(diskAttachmentId);
+        da.setHref(da.getVm().getHref() + "/diskattachments/" + diskAttachmentId);;
+
+        // Links
+        da.setDisk(toDisk(vol, physicalSizeResolver));
+
+        // Properties
+        da.setActive("true");
+        da.setBootable(String.valueOf(Volume.Type.ROOT.equals(vol.getVolumeType())));
+        da.setIface("virtio_scsi");
+        da.setLogicalName(vol.getName());
+        da.setReadOnly("false");
+        da.setPassDiscard("false");
+
+        da.setInternalId(vol.getId());
+
+        return da;
+    }
+
+    public static List<DiskAttachment> toDiskAttachmentList(final List<VolumeJoinVO> srcList,
+                            final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        return srcList.stream()
+                .map(vo -> toDiskAttachment(vo, physicalSizeResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapFormat(final Storage.ImageFormat format) {
+        if (format == null) {
+            return "cow";
+        }
+        switch (format) {
+            case RAW:
+                return "raw";
+            case QCOW2:
+            default:
+                return "cow";
+        }
+    }
+
+    private static String mapStatus(final Volume.State state) {
+        if (state == null) {
+            return "ok";
+        }
+        switch (state) {
+            case Ready:
+            case Allocated:
+                return "ok";
+            default:
+                return "locked";
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java
new file mode 100644
index 000000000000..93ae93b26d72
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java
@@ -0,0 +1,104 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+/**
+ * Root response for GET /ovirt-engine/api
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Api {
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private EmptyElement engineBackup;
+    private ProductInfo productInfo;
+    private SpecialObjects specialObjects;
+    private ApiSummary summary;
+    private Long time;
+    private Ref authenticatedUser;
+    private Ref effectiveUser;
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    public EmptyElement getEngineBackup() {
+        return engineBackup;
+    }
+
+    public void setEngineBackup(EmptyElement engineBackup) {
+        this.engineBackup = engineBackup;
+    }
+
+    public ProductInfo getProductInfo() {
+        return productInfo;
+    }
+
+    public void setProductInfo(ProductInfo productInfo) {
+        this.productInfo = productInfo;
+    }
+
+    public SpecialObjects getSpecialObjects() {
+        return specialObjects;
+    }
+
+    public void setSpecialObjects(SpecialObjects specialObjects) {
+        this.specialObjects = specialObjects;
+    }
+
+    public ApiSummary getSummary() {
+        return summary;
+    }
+
+    public void setSummary(ApiSummary summary) {
+        this.summary = summary;
+    }
+
+    public Long getTime() {
+        return time;
+    }
+
+    public void setTime(Long time) {
+        this.time = time;
+    }
+
+    public Ref getAuthenticatedUser() {
+        return authenticatedUser;
+    }
+
+    public void setAuthenticatedUser(Ref authenticatedUser) {
+        this.authenticatedUser = authenticatedUser;
+    }
+
+    public Ref getEffectiveUser() {
+        return effectiveUser;
+    }
+
+    public void setEffectiveUser(Ref effectiveUser) {
+        this.effectiveUser = effectiveUser;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java
new file mode 100644
index 000000000000..a81c2a1d2745
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class ApiSummary {
+
+    private SummaryCount hosts;
+    private SummaryCount storageDomains;
+    private SummaryCount users;
+    private SummaryCount vms;
+
+    public SummaryCount getHosts() {
+        return hosts;
+    }
+
+    public void setHosts(SummaryCount hosts) {
+        this.hosts = hosts;
+    }
+
+    public SummaryCount getStorageDomains() {
+        return storageDomains;
+    }
+
+    public void setStorageDomains(SummaryCount storageDomains) {
+        this.storageDomains = storageDomains;
+    }
+
+    public SummaryCount getUsers() {
+        return users;
+    }
+
+    public void setUsers(SummaryCount users) {
+        this.users = users;
+    }
+
+    public SummaryCount getVms() {
+        return vms;
+    }
+
+    public void setVms(SummaryCount vms) {
+        this.vms = vms;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java
new file mode 100644
index 000000000000..b337541bf5ca
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java
@@ -0,0 +1,103 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Backup extends BaseDto {
+
+    private String name;
+    private String description;
+    private Long creationDate;
+    private Vm vm;
+    private Host host;
+    private String phase;
+    private String fromCheckpointId;
+    private String toCheckpointId;
+    private NamedList<Disk> disks;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Long getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Long creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public Host getHost() {
+        return host;
+    }
+
+    public void setHost(Host host) {
+        this.host = host;
+    }
+
+    public String getPhase() {
+        return phase;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    public NamedList<Disk> getDisks() {
+        return disks;
+    }
+
+    public void setDisks(NamedList<Disk> disks) {
+        this.disks = disks;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java
new file mode 100644
index 000000000000..0b260a5cdcd7
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class BaseDto {
+
+    public static final String ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+
+    private String href;
+    private String id;
+
+    public String getHref() {
+        return href;
+    }
+
+    public void setHref(String href) {
+        this.href = href;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public static Link getActionLink(final String action, final String baseHref) {
+        return Link.of(action, baseHref + "/" + action);
+    }
+
+    protected static <T extends BaseDto> T withHrefAndId(T dto, String href, String id) {
+        dto.setHref(href);
+        dto.setId(id);
+        return dto;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java
new file mode 100644
index 000000000000..12e99159bfc9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java
@@ -0,0 +1,42 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Certificate {
+    private String organization;
+    private String subject;
+
+    public String getOrganization() {
+        return organization;
+    }
+
+    public void setOrganization(String organization) {
+        this.organization = organization;
+    }
+
+    public String getSubject() {
+        return subject;
+    }
+
+    public void setSubject(String subject) {
+        this.subject = subject;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java
new file mode 100644
index 000000000000..763875535904
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java
@@ -0,0 +1,76 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Checkpoint extends BaseDto {
+
+    private String name;
+    private String description;
+    private String creationDate;
+    private Vm vm;
+    private String state;
+    private String parentId;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(String creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public String getState() {
+        return state;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+
+    public String getParentId() {
+        return parentId;
+    }
+
+    public void setParentId(String parentId) {
+        this.parentId = parentId;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java
new file mode 100644
index 000000000000..db0cd8be6eab
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java
@@ -0,0 +1,408 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "cluster")
+public final class Cluster extends BaseDto {
+
+    private String name;
+    private String description;
+    private String comment;
+    private String ballooningEnabled;
+    private String biosType;
+    private Cpu cpu;
+    private CustomSchedulingPolicyProperties customSchedulingPolicyProperties;
+    private ErrorHandling errorHandling;
+    private FencingPolicy fencingPolicy;
+    private String fipsMode; // "disabled"
+    private String firewallType; // "firewalld"
+    private String glusterService;
+    private String haReservation;
+    private Ksm ksm;
+    private String logMaxMemoryUsedThreshold;
+    private String logMaxMemoryUsedThresholdType;
+    private MemoryPolicy memoryPolicy;
+    private Migration migration;
+    private RequiredRngSources requiredRngSources;
+    private String switchType;
+    private String threadsAsCores;
+    private String trustedService;
+    private String tunnelMigration;
+    private String upgradeInProgress;
+    private String upgradePercentComplete;
+    private Version version;
+    private String virtService;
+    private String vncEncryption;
+    private Ref dataCenter;
+    private Ref macPool;
+    private Ref schedulingPolicy;
+    private NamedList<Link> actions;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getBallooningEnabled() {
+        return ballooningEnabled;
+    }
+
+    public void setBallooningEnabled(String ballooningEnabled) {
+        this.ballooningEnabled = ballooningEnabled;
+    }
+
+    public String getBiosType() {
+        return biosType;
+    }
+
+    public void setBiosType(String biosType) {
+        this.biosType = biosType;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public CustomSchedulingPolicyProperties getCustomSchedulingPolicyProperties() {
+        return customSchedulingPolicyProperties;
+    }
+
+    public void setCustomSchedulingPolicyProperties(CustomSchedulingPolicyProperties customSchedulingPolicyProperties) {
+        this.customSchedulingPolicyProperties = customSchedulingPolicyProperties;
+    }
+
+    public ErrorHandling getErrorHandling() {
+        return errorHandling;
+    }
+
+    public void setErrorHandling(ErrorHandling errorHandling) {
+        this.errorHandling = errorHandling;
+    }
+
+    public FencingPolicy getFencingPolicy() {
+        return fencingPolicy;
+    }
+
+    public void setFencingPolicy(FencingPolicy fencingPolicy) {
+        this.fencingPolicy = fencingPolicy;
+    }
+
+    public String getFipsMode() {
+        return fipsMode;
+    }
+
+    public void setFipsMode(String fipsMode) {
+        this.fipsMode = fipsMode;
+    }
+
+    public String getFirewallType() {
+        return firewallType;
+    }
+
+    public void setFirewallType(String firewallType) {
+        this.firewallType = firewallType;
+    }
+
+    public String getGlusterService() {
+        return glusterService;
+    }
+
+    public void setGlusterService(String glusterService) {
+        this.glusterService = glusterService;
+    }
+
+    public String getHaReservation() {
+        return haReservation;
+    }
+
+    public void setHaReservation(String haReservation) {
+        this.haReservation = haReservation;
+    }
+
+    public Ksm getKsm() {
+        return ksm;
+    }
+
+    public void setKsm(Ksm ksm) {
+        this.ksm = ksm;
+    }
+
+    public String getLogMaxMemoryUsedThreshold() {
+        return logMaxMemoryUsedThreshold;
+    }
+
+    public void setLogMaxMemoryUsedThreshold(String logMaxMemoryUsedThreshold) {
+        this.logMaxMemoryUsedThreshold = logMaxMemoryUsedThreshold;
+    }
+
+    public String getLogMaxMemoryUsedThresholdType() {
+        return logMaxMemoryUsedThresholdType;
+    }
+
+    public void setLogMaxMemoryUsedThresholdType(String logMaxMemoryUsedThresholdType) {
+        this.logMaxMemoryUsedThresholdType = logMaxMemoryUsedThresholdType;
+    }
+
+    public MemoryPolicy getMemoryPolicy() {
+        return memoryPolicy;
+    }
+
+    public void setMemoryPolicy(MemoryPolicy memoryPolicy) {
+        this.memoryPolicy = memoryPolicy;
+    }
+
+    public Migration getMigration() {
+        return migration;
+    }
+
+    public void setMigration(Migration migration) {
+        this.migration = migration;
+    }
+
+    public RequiredRngSources getRequiredRngSources() {
+        return requiredRngSources;
+    }
+
+    public void setRequiredRngSources(RequiredRngSources requiredRngSources) {
+        this.requiredRngSources = requiredRngSources;
+    }
+
+    public String getSwitchType() {
+        return switchType;
+    }
+
+    public void setSwitchType(String switchType) {
+        this.switchType = switchType;
+    }
+
+    public String getThreadsAsCores() {
+        return threadsAsCores;
+    }
+
+    public void setThreadsAsCores(String threadsAsCores) {
+        this.threadsAsCores = threadsAsCores;
+    }
+
+    public String getTrustedService() {
+        return trustedService;
+    }
+
+    public void setTrustedService(String trustedService) {
+        this.trustedService = trustedService;
+    }
+
+    public String getTunnelMigration() {
+        return tunnelMigration;
+    }
+
+    public void setTunnelMigration(String tunnelMigration) {
+        this.tunnelMigration = tunnelMigration;
+    }
+
+    public String getUpgradeInProgress() {
+        return upgradeInProgress;
+    }
+
+    public void setUpgradeInProgress(String upgradeInProgress) {
+        this.upgradeInProgress = upgradeInProgress;
+    }
+
+    public String getUpgradePercentComplete() {
+        return upgradePercentComplete;
+    }
+
+    public void setUpgradePercentComplete(String upgradePercentComplete) {
+        this.upgradePercentComplete = upgradePercentComplete;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public String getVirtService() {
+        return virtService;
+    }
+
+    public void setVirtService(String virtService) {
+        this.virtService = virtService;
+    }
+
+    public String getVncEncryption() {
+        return vncEncryption;
+    }
+
+    public void setVncEncryption(String vncEncryption) {
+        this.vncEncryption = vncEncryption;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public Ref getMacPool() {
+        return macPool;
+    }
+
+    public void setMacPool(Ref macPool) {
+        this.macPool = macPool;
+    }
+
+    public Ref getSchedulingPolicy() {
+        return schedulingPolicy;
+    }
+
+    public void setSchedulingPolicy(Ref schedulingPolicy) {
+        this.schedulingPolicy = schedulingPolicy;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class CustomSchedulingPolicyProperties {
+        @JacksonXmlElementWrapper(useWrapping = false)
+        public List<Property> property;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Property {
+        public String name;
+        public String value;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class ErrorHandling {
+        public String onError; // "migrate"
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class FencingPolicy {
+        public String enabled;
+        public SkipIfConnectivityBroken skipIfConnectivityBroken;
+        public String skipIfGlusterBricksUp;
+        public String skipIfGlusterQuorumNotMet;
+        public SkipIfSdActive skipIfSdActive;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class SkipIfConnectivityBroken {
+        public String enabled;
+        public String threshold;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class SkipIfSdActive {
+        public String enabled;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Ksm {
+        public String enabled;
+        public String mergeAcrossNodes;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class MemoryPolicy {
+        public OverCommit overCommit;
+        public TransparentHugepages transparentHugepages;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class OverCommit {
+        public String percent;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class TransparentHugepages {
+        public String enabled;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Migration {
+        public String autoConverge;
+        public Bandwidth bandwidth;
+        public String compressed;
+        public String encrypted;
+        public String parallelMigrationsPolicy;
+        public Ref policy;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Bandwidth {
+        public String assignmentMethod;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class RequiredRngSources {
+        @JacksonXmlElementWrapper(useWrapping = false)
+        public List<String> requiredRngSource;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java
new file mode 100644
index 000000000000..3dce4931c848
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java
@@ -0,0 +1,69 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Cpu {
+    private String name;
+    private String speed;
+    private String architecture;
+    private String type;
+    private Topology topology;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getSpeed() {
+        return speed;
+    }
+
+    public void setSpeed(String speed) {
+        this.speed = speed;
+    }
+
+    public String getArchitecture() {
+        return architecture;
+    }
+
+    public void setArchitecture(String architecture) {
+        this.architecture = architecture;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Topology getTopology() {
+        return topology;
+    }
+
+    public void setTopology(Topology topology) {
+        this.topology = topology;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java
new file mode 100644
index 000000000000..52f6a6c279f1
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "data_center")
+public final class DataCenter extends BaseDto {
+    private String local;
+    private String quotaMode;
+    private String status;
+    private String storageFormat;
+    private SupportedVersions supportedVersions;
+    private Version version;
+    private Ref macPool;
+    private NamedList<Link> actions;
+    private String name;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    public List<Link> link;
+
+    public String getLocal() {
+        return local;
+    }
+
+    public void setLocal(String local) {
+        this.local = local;
+    }
+
+    public String getQuotaMode() {
+        return quotaMode;
+    }
+
+    public void setQuotaMode(String quotaMode) {
+        this.quotaMode = quotaMode;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStorageFormat() {
+        return storageFormat;
+    }
+
+    public void setStorageFormat(String storageFormat) {
+        this.storageFormat = storageFormat;
+    }
+
+    public SupportedVersions getSupportedVersions() {
+        return supportedVersions;
+    }
+
+    public void setSupportedVersions(SupportedVersions supportedVersions) {
+        this.supportedVersions = supportedVersions;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public Ref getMacPool() {
+        return macPool;
+    }
+
+    public void setMacPool(Ref macPool) {
+        this.macPool = macPool;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java
new file mode 100644
index 000000000000..c9a19794c189
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java
@@ -0,0 +1,247 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "disk")
+public final class Disk extends BaseDto {
+
+    private String bootable;
+    private String actualSize;
+    private String alias;
+    private String backup;
+    private String contentType;
+    private String format;
+    private String imageId;
+    private String propagateErrors;
+    private String initialSize;
+    private String provisionedSize;
+    private String qcowVersion;
+    private String shareable;
+    private String sparse;
+    private String status;
+    private String storageType;
+    private String totalSize;
+    private String wipeAfterDelete;
+    private Ref diskProfile;
+    private Ref quota;
+    private NamedList<StorageDomain> storageDomains;
+    private NamedList<Link> actions;
+    private String name;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getBootable() {
+        return bootable;
+    }
+
+    public void setBootable(String bootable) {
+        this.bootable = bootable;
+    }
+
+    public String getActualSize() {
+        return actualSize;
+    }
+
+    public void setActualSize(String actualSize) {
+        this.actualSize = actualSize;
+    }
+
+    public String getAlias() {
+        return alias;
+    }
+
+    public void setAlias(String alias) {
+        this.alias = alias;
+    }
+
+    public String getBackup() {
+        return backup;
+    }
+
+    public void setBackup(String backup) {
+        this.backup = backup;
+    }
+
+    public String getContentType() {
+        return contentType;
+    }
+
+    public void setContentType(String contentType) {
+        this.contentType = contentType;
+    }
+
+    public String getFormat() {
+        return format;
+    }
+
+    public void setFormat(String format) {
+        this.format = format;
+    }
+
+    public String getImageId() {
+        return imageId;
+    }
+
+    public void setImageId(String imageId) {
+        this.imageId = imageId;
+    }
+
+    public String getPropagateErrors() {
+        return propagateErrors;
+    }
+
+    public void setPropagateErrors(String propagateErrors) {
+        this.propagateErrors = propagateErrors;
+    }
+
+    public String getInitialSize() {
+        return initialSize;
+    }
+
+    public void setInitialSize(String initialSize) {
+        this.initialSize = initialSize;
+    }
+
+    public String getProvisionedSize() {
+        return provisionedSize;
+    }
+
+    public void setProvisionedSize(String provisionedSize) {
+        this.provisionedSize = provisionedSize;
+    }
+
+    public String getQcowVersion() {
+        return qcowVersion;
+    }
+
+    public void setQcowVersion(String qcowVersion) {
+        this.qcowVersion = qcowVersion;
+    }
+
+    public String getShareable() {
+        return shareable;
+    }
+
+    public void setShareable(String shareable) {
+        this.shareable = shareable;
+    }
+
+    public String getSparse() {
+        return sparse;
+    }
+
+    public void setSparse(String sparse) {
+        this.sparse = sparse;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStorageType() {
+        return storageType;
+    }
+
+    public void setStorageType(String storageType) {
+        this.storageType = storageType;
+    }
+
+    public String getTotalSize() {
+        return totalSize;
+    }
+
+    public void setTotalSize(String totalSize) {
+        this.totalSize = totalSize;
+    }
+
+    public String getWipeAfterDelete() {
+        return wipeAfterDelete;
+    }
+
+    public void setWipeAfterDelete(String wipeAfterDelete) {
+        this.wipeAfterDelete = wipeAfterDelete;
+    }
+
+    public Ref getDiskProfile() {
+        return diskProfile;
+    }
+
+    public void setDiskProfile(Ref diskProfile) {
+        this.diskProfile = diskProfile;
+    }
+
+    public Ref getQuota() {
+        return quota;
+    }
+
+    public void setQuota(Ref quota) {
+        this.quota = quota;
+    }
+
+    public NamedList<StorageDomain> getStorageDomains() {
+        return storageDomains;
+    }
+
+    public void setStorageDomains(NamedList<StorageDomain> storageDomains) {
+        this.storageDomains = storageDomains;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java
new file mode 100644
index 000000000000..6b3518dc8e79
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java
@@ -0,0 +1,124 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class DiskAttachment extends BaseDto {
+
+    private String active;
+    private String bootable;
+    @JsonProperty("interface")
+    private String iface; // virtio_scsi etc
+    private String logicalName;
+    private String passDiscard;
+    private String readOnly;
+    private String usesScsiReservation;
+    private Disk disk;
+    private Vm vm;
+
+    // Internal properties
+    private long internalId;
+
+    public DiskAttachment() {
+    }
+
+    public String getActive() {
+        return active;
+    }
+
+    public void setActive(String active) {
+        this.active = active;
+    }
+
+    public String getBootable() {
+        return bootable;
+    }
+
+    public void setBootable(String bootable) {
+        this.bootable = bootable;
+    }
+
+    public String getIface() {
+        return iface;
+    }
+
+    public void setIface(String iface) {
+        this.iface = iface;
+    }
+
+    public String getLogicalName() {
+        return logicalName;
+    }
+
+    public void setLogicalName(String logicalName) {
+        this.logicalName = logicalName;
+    }
+
+    public String getPassDiscard() {
+        return passDiscard;
+    }
+
+    public void setPassDiscard(String passDiscard) {
+        this.passDiscard = passDiscard;
+    }
+
+    public String getReadOnly() {
+        return readOnly;
+    }
+
+    public void setReadOnly(String readOnly) {
+        this.readOnly = readOnly;
+    }
+
+    public String getUsesScsiReservation() {
+        return usesScsiReservation;
+    }
+
+    public void setUsesScsiReservation(String usesScsiReservation) {
+        this.usesScsiReservation = usesScsiReservation;
+    }
+
+    public Disk getDisk() {
+        return disk;
+    }
+
+    public void setDisk(Disk disk) {
+        this.disk = disk;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    @JsonIgnore
+    public long getInternalId() {
+        return internalId;
+    }
+
+    public void setInternalId(long internalId) {
+        this.internalId = internalId;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java
new file mode 100644
index 000000000000..3c4111c55a31
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+
+@JsonSerialize(using = EmptyElementSerializer.class)
+public final class EmptyElement {
+    public EmptyElement() {
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java
new file mode 100644
index 000000000000..9a877d5e4b25
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java
@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+import java.io.IOException;
+
+/**
+ * Serializes as an "empty object".
+ * With Jackson XML this becomes an empty element: <engine_backup/>.
+ */
+public final class EmptyElementSerializer extends JsonSerializer<EmptyElement> {
+    @Override
+    public void serialize(EmptyElement value, JsonGenerator gen, SerializerProvider serializers) throws IOException {
+        gen.writeStartObject();
+        gen.writeEndObject();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java
new file mode 100644
index 000000000000..20989d8cbd70
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java
@@ -0,0 +1,39 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Fault {
+    private String reason; // "Not Found", "Bad Request", "Unauthorized"
+    private String detail; // full message
+
+    public Fault(final String reason, final String detail) {
+        this.reason = reason;
+        this.detail = detail;
+    }
+
+    public String getReason() {
+        return reason;
+    }
+
+    public String getDetail() {
+        return detail;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java
new file mode 100644
index 000000000000..73efba5eeb89
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java
@@ -0,0 +1,315 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Host extends BaseDto {
+
+    private String address;
+    private String autoNumaStatus;
+    private Certificate certificate;
+    private Cpu cpu;
+    private String externalStatus;
+    private HardwareInformation hardwareInformation;
+    private String kdumpStatus;
+    private Version libvirtVersion;
+    private String maxSchedulingMemory;
+    private String memory;
+    private String numaSupported;
+    private Os os;
+    private String port;
+    private String protocol;
+    private String reinstallationRequired;
+    private String status;
+    private ApiSummary summary;
+    private String type;
+    private String updateAvailable;
+    private Version version;
+    private String vgpuPlacement;
+    private Ref cluster;
+    private NamedList<Link> actions;
+    private String name;
+    private String comment;
+    private List<Link> link;
+
+    // getters/setters (generate via IDE)
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getAutoNumaStatus() {
+        return autoNumaStatus;
+    }
+
+    public void setAutoNumaStatus(String autoNumaStatus) {
+        this.autoNumaStatus = autoNumaStatus;
+    }
+
+    public Certificate getCertificate() {
+        return certificate;
+    }
+
+    public void setCertificate(Certificate certificate) {
+        this.certificate = certificate;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public String getExternalStatus() {
+        return externalStatus;
+    }
+
+    public void setExternalStatus(String externalStatus) {
+        this.externalStatus = externalStatus;
+    }
+
+    public HardwareInformation getHardwareInformation() {
+        return hardwareInformation;
+    }
+
+    public void setHardwareInformation(HardwareInformation hardwareInformation) {
+        this.hardwareInformation = hardwareInformation;
+    }
+
+    public String getKdumpStatus() {
+        return kdumpStatus;
+    }
+
+    public void setKdumpStatus(String kdumpStatus) {
+        this.kdumpStatus = kdumpStatus;
+    }
+
+    public Version getLibvirtVersion() {
+        return libvirtVersion;
+    }
+
+    public void setLibvirtVersion(Version libvirtVersion) {
+        this.libvirtVersion = libvirtVersion;
+    }
+
+    public String getMaxSchedulingMemory() {
+        return maxSchedulingMemory;
+    }
+
+    public void setMaxSchedulingMemory(String maxSchedulingMemory) {
+        this.maxSchedulingMemory = maxSchedulingMemory;
+    }
+
+    public String getMemory() {
+        return memory;
+    }
+
+    public void setMemory(String memory) {
+        this.memory = memory;
+    }
+
+    public String getNumaSupported() {
+        return numaSupported;
+    }
+
+    public void setNumaSupported(String numaSupported) {
+        this.numaSupported = numaSupported;
+    }
+
+    public Os getOs() {
+        return os;
+    }
+
+    public void setOs(Os os) {
+        this.os = os;
+    }
+
+    public String getPort() {
+        return port;
+    }
+
+    public void setPort(String port) {
+        this.port = port;
+    }
+
+    public String getProtocol() {
+        return protocol;
+    }
+
+    public void setProtocol(String protocol) {
+        this.protocol = protocol;
+    }
+
+    public String getReinstallationRequired() {
+        return reinstallationRequired;
+    }
+
+    public void setReinstallationRequired(String reinstallationRequired) {
+        this.reinstallationRequired = reinstallationRequired;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public ApiSummary getSummary() {
+        return summary;
+    }
+
+    public void setSummary(ApiSummary summary) {
+        this.summary = summary;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getUpdateAvailable() {
+        return updateAvailable;
+    }
+
+    public void setUpdateAvailable(String updateAvailable) {
+        this.updateAvailable = updateAvailable;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public String getVgpuPlacement() {
+        return vgpuPlacement;
+    }
+
+    public void setVgpuPlacement(String vgpuPlacement) {
+        this.vgpuPlacement = vgpuPlacement;
+    }
+
+    public Ref getCluster() {
+        return cluster;
+    }
+
+    public void setCluster(Ref cluster) {
+        this.cluster = cluster;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class HardwareInformation {
+        private String manufacturer;
+        private String productName;
+        private String serialNumber;
+        private String uuid;
+        private String version;
+
+        public String getManufacturer() {
+            return manufacturer;
+        }
+
+        public void setManufacturer(String manufacturer) {
+            this.manufacturer = manufacturer;
+        }
+
+        public String getProductName() {
+            return productName;
+        }
+
+        public void setProductName(String productName) {
+            this.productName = productName;
+        }
+
+        public String getSerialNumber() {
+            return serialNumber;
+        }
+
+        public void setSerialNumber(String serialNumber) {
+            this.serialNumber = serialNumber;
+        }
+
+        public String getUuid() {
+            return uuid;
+        }
+
+        public void setUuid(String uuid) {
+            this.uuid = uuid;
+        }
+
+        public String getVersion() {
+            return version;
+        }
+
+        public void setVersion(String version) {
+            this.version = version;
+        }
+    }
+
+    public static Host of(String href, String id) {
+        return withHrefAndId(new Host(), href, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java
new file mode 100644
index 000000000000..b0a26daa1049
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java
@@ -0,0 +1,167 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class ImageTransfer extends BaseDto {
+
+    private String active;
+    private String direction;
+    private String format;
+    private String inactivityTimeout;
+    private String phase;
+    private String proxyUrl;
+    private String shallow;
+    private String timeoutPolicy;
+    private String transferUrl;
+    private String transferred;
+    private Backup backup;
+    private Ref host;
+    private Ref image;
+    private Ref disk;
+    private NamedList<Link> actions;
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    public List<Link> link;
+
+    public String getActive() {
+        return active;
+    }
+
+    public void setActive(String active) {
+        this.active = active;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public void setDirection(String direction) {
+        this.direction = direction;
+    }
+
+    public String getFormat() {
+        return format;
+    }
+
+    public void setFormat(String format) {
+        this.format = format;
+    }
+
+    public String getInactivityTimeout() {
+        return inactivityTimeout;
+    }
+
+    public void setInactivityTimeout(String inactivityTimeout) {
+        this.inactivityTimeout = inactivityTimeout;
+    }
+
+    public String getPhase() {
+        return phase;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public String getProxyUrl() {
+        return proxyUrl;
+    }
+
+    public void setProxyUrl(String proxyUrl) {
+        this.proxyUrl = proxyUrl;
+    }
+
+    public String getShallow() {
+        return shallow;
+    }
+
+    public void setShallow(String shallow) {
+        this.shallow = shallow;
+    }
+
+    public String getTimeoutPolicy() {
+        return timeoutPolicy;
+    }
+
+    public void setTimeoutPolicy(String timeoutPolicy) {
+        this.timeoutPolicy = timeoutPolicy;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    public String getTransferred() {
+        return transferred;
+    }
+
+    public void setTransferred(String transferred) {
+        this.transferred = transferred;
+    }
+
+    public Backup getBackup() {
+        return backup;
+    }
+
+    public void setBackup(Backup backup) {
+        this.backup = backup;
+    }
+
+    public Ref getHost() {
+        return host;
+    }
+
+    public void setHost(Ref host) {
+        this.host = host;
+    }
+
+    public Ref getImage() {
+        return image;
+    }
+
+    public void setImage(Ref image) {
+        this.image = image;
+    }
+
+    public Ref getDisk() {
+        return disk;
+    }
+
+    public void setDisk(Ref disk) {
+        this.disk = disk;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java
new file mode 100644
index 000000000000..7afbc0710ffb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Ip {
+
+    private String address;
+    private String gateway;
+    private String netmask;
+    private String version;
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getGateway() {
+        return gateway;
+    }
+
+    public void setGateway(String gateway) {
+        this.gateway = gateway;
+    }
+
+    public String getNetmask() {
+        return netmask;
+    }
+
+    public void setNetmask(String netmask) {
+        this.netmask = netmask;
+    }
+
+    public String getVersion() {
+        return version;
+    }
+
+    public void setVersion(String version) {
+        this.version = version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java
new file mode 100644
index 000000000000..13b0e8a02fd1
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java
@@ -0,0 +1,117 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Job extends BaseDto {
+    private String autoCleared;
+    private String external;
+    private Long lastUpdated;
+    private Long startTime;
+    private Long endTime;
+    private String status;
+    private Ref owner;
+    private NamedList<Link> actions;
+    private String description;
+    private List<Link> link;
+
+    // getters and setters
+    public String getAutoCleared() {
+        return autoCleared;
+    }
+
+    public void setAutoCleared(String autoCleared) {
+        this.autoCleared = autoCleared;
+    }
+
+    public String getExternal() {
+        return external;
+    }
+
+    public void setExternal(String external) {
+        this.external = external;
+    }
+
+    public Long getLastUpdated() {
+        return lastUpdated;
+    }
+
+    public void setLastUpdated(Long lastUpdated) {
+        this.lastUpdated = lastUpdated;
+    }
+
+    public Long getStartTime() {
+        return startTime;
+    }
+
+    public void setStartTime(Long startTime) {
+        this.startTime = startTime;
+    }
+
+    public Long getEndTime() {
+        return endTime;
+    }
+
+    public void setEndTime(Long endTime) {
+        this.endTime = endTime;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public Ref getOwner() {
+        return owner;
+    }
+
+    public void setOwner(Ref owner) {
+        this.owner = owner;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java
new file mode 100644
index 000000000000..7d67820360f9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java
@@ -0,0 +1,49 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Link {
+    private String rel;
+    private String href;
+
+    public static Link of(final String rel, final String href) {
+        Link link = new Link();
+        link.setRel(rel);
+        link.setHref(href);
+        return link;
+    }
+
+    public String getRel() {
+        return rel;
+    }
+
+    public void setRel(String rel) {
+        this.rel = rel;
+    }
+
+    public String getHref() {
+        return href;
+    }
+
+    public void setHref(String href) {
+        this.href = href;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java
new file mode 100644
index 000000000000..02d908054608
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java
@@ -0,0 +1,34 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Mac {
+
+    private String address;
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java
new file mode 100644
index 000000000000..fb7c2aa664b3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
+public class NamedList<T> {
+    private final String name;
+    private final List<T> items;
+
+    private NamedList(String name, List<T> items) {
+        if (name == null || name.isEmpty()) {
+            throw new IllegalArgumentException("name must be non-empty");
+        }
+        this.name = name;
+        this.items = items == null ? Collections.emptyList() : items;
+    }
+
+    public static <T> NamedList<T> of(String name, List<T> items) {
+        return new NamedList<>(name, items);
+    }
+
+    @JsonAnyGetter
+    public Map<String, List<T>> asMap() {
+        return Collections.singletonMap(name, items);
+    }
+
+    @JsonCreator
+    public static <T> NamedList<T> fromMap(Map<String, List<T>> map) {
+        if (map == null || map.size() != 1) {
+            throw new IllegalArgumentException("Expected single-property object for NamedList");
+        }
+        Entry<String, List<T>> e = map.entrySet().iterator().next();
+        return new NamedList<>(e.getKey(), e.getValue());
+    }
+
+    @JsonIgnore
+    public List<T> getItems() {
+        return items;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java
new file mode 100644
index 000000000000..bb72a2ad323f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java
@@ -0,0 +1,126 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Network extends BaseDto {
+    private String mtu;           // oVirt prints as string
+    private String portIsolation; // "false"
+    private String stp;           // "false"
+    private NamedList<String> usages;     // { usage: ["vm"] }
+    private String vdsmName;
+
+    private Ref dataCenter;
+
+    private String name;
+    private String description;
+    private String comment;
+
+    @JsonProperty("link")
+    private List<Link> link;
+
+    public Network() {
+    }
+
+    // ---- getters / setters ----
+
+    public String getMtu() {
+        return mtu;
+    }
+
+    public void setMtu(final String mtu) {
+        this.mtu = mtu;
+    }
+
+    public String getPortIsolation() {
+        return portIsolation;
+    }
+
+    public void setPortIsolation(final String portIsolation) {
+        this.portIsolation = portIsolation;
+    }
+
+    public String getStp() {
+        return stp;
+    }
+
+    public void setStp(final String stp) {
+        this.stp = stp;
+    }
+
+    public NamedList<String> getUsages() {
+        return usages;
+    }
+
+    public void setUsages(final NamedList<String> usages) {
+        this.usages = usages;
+    }
+
+    public String getVdsmName() {
+        return vdsmName;
+    }
+
+    public void setVdsmName(final String vdsmName) {
+        this.vdsmName = vdsmName;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(final Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(final String comment) {
+        this.comment = comment;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java
new file mode 100644
index 000000000000..2f866abef7f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java
@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Nic extends BaseDto {
+
+    private String name;
+    private String description;
+    @JacksonXmlProperty(localName = "interface")
+    @JsonProperty("interface")
+    private String interfaceType;
+    private String linked;
+    private Mac mac;
+    private String plugged;
+    public String synced;
+    private Ref vnicProfile;
+    private Vm vm;
+    private NamedList<ReportedDevice> reportedDevices;
+
+    public Nic() {
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public String getInterfaceType() {
+        return interfaceType;
+    }
+
+    public void setInterfaceType(String interfaceType) {
+        this.interfaceType = interfaceType;
+    }
+
+    public String getLinked() {
+        return linked;
+    }
+
+    public void setLinked(String linked) {
+        this.linked = linked;
+    }
+
+    public Mac getMac() {
+        return mac;
+    }
+
+    public void setMac(Mac mac) {
+        this.mac = mac;
+    }
+
+    public String getPlugged() {
+        return plugged;
+    }
+
+    public void setPlugged(String plugged) {
+        this.plugged = plugged;
+    }
+
+    public String getSynced() {
+        return synced;
+    }
+
+    public void setSynced(String synced) {
+        this.synced = synced;
+    }
+
+    public Ref getVnicProfile() {
+        return vnicProfile;
+    }
+
+    public void setVnicProfile(Ref vnicProfile) {
+        this.vnicProfile = vnicProfile;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public NamedList<ReportedDevice> getReportedDevices() {
+        return reportedDevices;
+    }
+
+    public void setReportedDevices(NamedList<ReportedDevice> reportedDevices) {
+        this.reportedDevices = reportedDevices;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java
new file mode 100644
index 000000000000..be0f71c56bf8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java
@@ -0,0 +1,114 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Os {
+    private String type;
+    private String version;
+    private Boot boot;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Boot getBoot() {
+        return boot;
+    }
+
+    public void setBoot(Boot boot) {
+        this.boot = boot;
+    }
+
+    public final static class Boot {
+        private NamedList<String> devices;
+
+        public NamedList<String> getDevices() {
+            return devices;
+        }
+
+        public void setDevices(NamedList<String> devices) {
+            this.devices = devices;
+        }
+    }
+
+    /**
+     * Infers the oVirt guest OS identifier expected by Veeam from the operating system name.
+     * This allows Veeam to correctly recognize Windows virtual machines and enable features
+     * such as file-level restore.
+     *<p>
+     * Identifier values are derived from the
+     * <a href="https://github.com/oVirt/ovirt-engine/blob/master/packaging/conf/osinfo-defaults.properties">
+     * oVirt OS defaults
+     * </a>.
+     *</p>
+     *
+     * @param name normalized operating system name
+     * @return the matching oVirt Windows OS identifier
+     */
+    public static String getWindowsOsKey(final String name) {
+        if (name.contains("2025")) {
+            return "windows_2025";
+        }
+
+        if (name.contains("2022")) {
+            return "windows_2022";
+        }
+
+        if (name.contains("11")) {
+            return "windows_11";
+        }
+
+        if (name.contains("2019")) {
+            return "windows_2019x64";
+        }
+
+        if (name.contains("2016")) {
+            return "windows_2016x64";
+        }
+
+        if (name.contains("10") && name.contains("64")) {
+            return "windows_10x64";
+        }
+
+        return "windows_10";
+    }
+
+    public static String inferTypeFromOsName(String name) {
+        if (StringUtils.isBlank(name)) {
+            return "other";
+        }
+        String normalized = name.trim().toLowerCase();
+        if (normalized.contains("windows")) {
+            return getWindowsOsKey(normalized);
+        }
+        if (normalized.contains("linux") || normalized.contains("ubuntu") || normalized.contains("debian") ||
+                normalized.contains("centos") || normalized.contains("red hat") || normalized.contains("suse")) {
+            return "linux";
+        }
+        return "other";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java
new file mode 100644
index 000000000000..5de3647ebeda
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java
@@ -0,0 +1,1138 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.text.SimpleDateFormat;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TimeZone;
+import java.util.UUID;
+
+import javax.xml.XMLConstants;
+import javax.xml.namespace.NamespaceContext;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpressionException;
+import javax.xml.xpath.XPathFactory;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.w3c.dom.Document;
+import org.w3c.dom.NamedNodeMap;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+import org.xml.sax.SAXException;
+
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.utils.Pair;
+
+public class OvfXmlUtil {
+
+    private static final String NS_OVF = "http://schemas.dmtf.org/ovf/envelope/1/";
+    private static final String NS_RASD = "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData";
+    private static final String NS_VSSD = "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData";
+    private static final String NS_XSI = "http://www.w3.org/2001/XMLSchema-instance";
+
+    private static final String ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+    private static final TimeZone UTC = TimeZone.getTimeZone("Etc/GMT");
+
+    private static final ThreadLocal<SimpleDateFormat> OVIRT_DTF = ThreadLocal.withInitial(() -> {
+        final SimpleDateFormat sdf = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.ROOT);
+        sdf.setTimeZone(UTC);
+        return sdf;
+    });
+    private static final org.slf4j.Logger log = LoggerFactory.getLogger(OvfXmlUtil.class);
+
+    protected enum MemoryAllocationUnit {
+        Bytes("byte", 1),
+        Kilobytes("byte * 2^10", 1024),
+        Megabytes("byte * 2^20", 1024 * 1024),
+        Gigabytes("byte * 2^30", 1024 * 1024 * 1024);
+
+        final String allocationUnitsToken;
+        final long bytesMultiplier;
+
+        MemoryAllocationUnit(String allocationUnitsToken, long bytesMultiplier) {
+            this.allocationUnitsToken = allocationUnitsToken;
+            this.bytesMultiplier = bytesMultiplier;
+        }
+
+        public String getAllocationUnitsToken() {
+            return allocationUnitsToken;
+        }
+
+        public long getBytesMultiplier() {
+            return bytesMultiplier;
+        }
+
+        public static MemoryAllocationUnit fromString(String value) {
+            for (MemoryAllocationUnit unit : MemoryAllocationUnit.values()) {
+                if (StringUtils.isNotBlank(value) &&
+                        (unit.getAllocationUnitsToken().equalsIgnoreCase(value) || unit.name().equalsIgnoreCase(value))) {
+                    return unit;
+                }
+            }
+            return null;
+        }
+    }
+
+    public static String toXml(final Vm vm, final UserVmJoinVO vo) {
+        final String vmId = vm.getId();
+        final String vmName = vm.getName();
+        final String vmDesc = defaultString(vm.getDescription());
+
+        final long creationMillis = vm.getCreationTime();
+        final String creationDate = formatDate(creationMillis);
+        final String exportDate = formatDate(System.currentTimeMillis());
+        final String stopTime = vm.getStopTime() != null ? formatDate(vm.getStopTime()) : creationDate;
+        final String bootTime = vm.getStartTime() != null ? formatDate(vm.getStartTime()) : creationDate;
+
+        // Memory: Vm.memory is bytes (string)
+        final long memBytes = parseLong(vm.getMemory(), MemoryAllocationUnit.Gigabytes.getBytesMultiplier());
+        final long memMb = Math.max(128, memBytes / MemoryAllocationUnit.Megabytes.getBytesMultiplier());
+
+        // CPU: topology cores/sockets/threads. We default sockets=1 threads=1.
+        final int vcpu = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getCores()));
+        final int sockets = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getSockets()));
+        final int threads = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getThreads()));
+        final int cpuPerSocket = Math.max(1, vcpu / sockets);
+        final int maxVcpu = vcpu;
+
+        // Template
+        final Ref template = vm.getTemplate();
+        final String templateId = template != null && StringUtils.isNotBlank(template.getId()) ? template.getId() : ZERO_UUID;
+        final String templateName = template != null ? defaultString(template.getId()) : "Blank";
+
+        // Snapshot id (stable per VM id)
+        final String snapshotId = UUID.nameUUIDFromBytes(("ovf-snap-" + vmId).getBytes(StandardCharsets.UTF_8)).toString();
+
+        final List<Nic> nics = nics(vm);
+
+        final StringBuilder sb = new StringBuilder(16_384);
+        sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+        sb.append("<ovf:Envelope ");
+        sb.append("xmlns:ovf=\"").append(NS_OVF).append("\" ");
+        sb.append("xmlns:rasd=\"").append(NS_RASD).append("\" ");
+        sb.append("xmlns:vssd=\"").append(NS_VSSD).append("\" ");
+        sb.append("xmlns:xsi=\"").append(NS_XSI).append("\" ovf:version=\"4.4.0.0\">");
+
+        // --- References (from disks) ---
+        sb.append("<References>");
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final String diskId = da.getDisk().getId();
+            final String storageDomainId = firstStorageDomainId(da.getDisk());
+            final String href = storageDomainId + "/" + diskId;
+            sb.append("<File ovf:href=\"").append(escapeAttr(href))
+                    .append("\" ovf:id=\"").append(escapeAttr(diskId))
+                    .append("\" ovf:size=\"4096\" ovf:description=\"Active VM\" ovf:disk_storage_type=\"IMAGE\" ovf:cinder_volume_type=\"\"></File>");
+        }
+        sb.append("</References>");
+
+        // --- NetworkSection ---
+        sb.append("<NetworkSection>");
+        sb.append("<Info>List of networks</Info>");
+        // oVirt often lists networks, but can also be empty. We'll include known names if we can.
+        for (Nic nic : nics(vm)) {
+            if (nic == null) {
+                continue;
+            }
+            final String netName = inferNetworkName(nic);
+            if (StringUtils.isBlank(netName)) {
+                continue;
+            }
+            sb.append("<Network ovf:name=\"").append(escapeAttr(netName)).append("\">");
+            sb.append("<Description>").append(escapeText(defaultString(nic.getDescription()))).append("</Description>");
+            sb.append("</Network>");
+        }
+        sb.append("</NetworkSection>");
+
+        // --- DiskSection ---
+        sb.append("<Section xsi:type=\"ovf:DiskSection_Type\">");
+        sb.append("<Info>List of Virtual Disks</Info>");
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final Disk d = da.getDisk();
+            final String diskId = d.getId();
+            final String storageDomainId = firstStorageDomainId(d);
+            final String href = storageDomainId + "/" + diskId;
+            final long provBytes = parseLong(d.getProvisionedSize(), 0);
+            final long actualBytes = parseLong(d.getActualSize(), 0);
+            final long provGiB = bytesToGibCeil(provBytes);
+            final long actualGiB = bytesToGibCeil(actualBytes);
+            final String diskInterface = mapDiskInterface(da.getIface());
+
+            sb.append("<Disk");
+            sb.append(" ovf:diskId=\"").append(escapeAttr(diskId)).append("\"");
+            sb.append(" ovf:size=\"").append(provGiB > 0 ? provGiB : 1).append("\"");
+            sb.append(" ovf:actual_size=\"").append(actualGiB > 0 ? actualGiB : 1).append("\"");
+            sb.append(" ovf:vm_snapshot_id=\"").append(escapeAttr(snapshotId)).append("\"");
+            sb.append(" ovf:parentRef=\"\"");
+            sb.append(" ovf:fileRef=\"").append(escapeAttr(href)).append("\"");
+            sb.append(" ovf:format=\"").append(escapeAttr(mapOvfDiskFormat(d.getFormat(), d.getSparse()))).append("\"");
+            sb.append(" ovf:volume-format=\"").append(escapeAttr(mapVolumeFormat(d.getFormat()))).append("\"");
+            sb.append(" ovf:volume-type=\"").append(escapeAttr(mapVolumeType(d.getSparse()))).append("\"");
+            sb.append(" ovf:disk-interface=\"").append(escapeAttr(diskInterface)).append("\"");
+            sb.append(" ovf:read-only=\"").append(escapeAttr(booleanString(da.getReadOnly(), "false"))).append("\"");
+            sb.append(" ovf:shareable=\"").append(escapeAttr(booleanString(d.getShareable(), "false"))).append("\"");
+            sb.append(" ovf:boot=\"").append(escapeAttr(booleanString(da.getBootable(), "false"))).append("\"");
+            sb.append(" ovf:pass-discard=\"").append(escapeAttr(booleanString(da.getPassDiscard(), "false"))).append("\"");
+            sb.append(" ovf:incremental-backup=\"false\"");
+            sb.append(" ovf:disk-alias=\"").append(escapeAttr(defaultString(d.getAlias()))).append("\"");
+            sb.append(" ovf:disk-description=\"").append(escapeAttr(defaultString(d.getDescription()))).append("\"");
+            sb.append(" ovf:wipe-after-delete=\"").append(escapeAttr(booleanString(d.getWipeAfterDelete(), "false"))).append("\"");
+            sb.append("></Disk>");
+        }
+        sb.append("</Section>");
+
+        addCloudStackMetadata(vm, vo, sb);
+
+        // --- Content / VirtualSystem ---
+        sb.append("<Content ovf:id=\"out\" xsi:type=\"ovf:VirtualSystem_Type\">");
+        sb.append("<Name>").append(escapeText(vmName)).append("</Name>");
+        sb.append("<Description>").append(escapeText(vmDesc)).append("</Description>");
+        sb.append("<Comment></Comment>");
+        sb.append("<CreationDate>").append(creationDate).append("</CreationDate>");
+        sb.append("<ExportDate>").append(exportDate).append("</ExportDate>");
+        sb.append("<DeleteProtected>false</DeleteProtected>");
+        sb.append("<SsoMethod>guest_agent</SsoMethod>");
+        sb.append("<IsSmartcardEnabled>false</IsSmartcardEnabled>");
+        sb.append("<NumOfIoThreads>1</NumOfIoThreads>");
+        sb.append("<TimeZone>Etc/GMT</TimeZone>");
+        sb.append("<default_boot_sequence>0</default_boot_sequence>");
+        sb.append("<Generation>11</Generation>");
+        sb.append("<ClusterCompatibilityVersion>4.8</ClusterCompatibilityVersion>");
+        sb.append("<VmType>1</VmType>");
+        sb.append("<ResumeBehavior>AUTO_RESUME</ResumeBehavior>");
+        sb.append("<MinAllocatedMem>").append(memMb).append("</MinAllocatedMem>");
+        sb.append("<IsStateless>").append(escapeText(booleanString(vm.getStateless(), "false"))).append("</IsStateless>");
+        sb.append("<IsRunAndPause>false</IsRunAndPause>");
+        sb.append("<AutoStartup>false</AutoStartup>");
+        sb.append("<Priority>0</Priority>");
+        sb.append("<CreatedByUserId>").append(vo.getAccountUuid()).append("</CreatedByUserId>");
+        sb.append("<MigrationSupport>0</MigrationSupport>");
+        sb.append("<IsBootMenuEnabled>").append(escapeText(booleanString(vm.getBios() != null && vm.getBios().getBootMenu() != null ? vm.getBios().getBootMenu().getEnabled() : null, "false"))).append("</IsBootMenuEnabled>");
+        sb.append("<IsSpiceFileTransferEnabled>true</IsSpiceFileTransferEnabled>");
+        sb.append("<IsSpiceCopyPasteEnabled>true</IsSpiceCopyPasteEnabled>");
+        sb.append("<AllowConsoleReconnect>false</AllowConsoleReconnect>");
+        sb.append("<ConsoleDisconnectAction>LOCK_SCREEN</ConsoleDisconnectAction>");
+        sb.append("<ConsoleDisconnectActionDelay>0</ConsoleDisconnectActionDelay>");
+        sb.append("<CustomEmulatedMachine></CustomEmulatedMachine>");
+        sb.append("<BiosType>").append(vm.getBios() != null ? vm.getBios().getTypeOrdinal() : 1).append("</BiosType>");
+        sb.append("<CustomCpuName></CustomCpuName>");
+        sb.append("<PredefinedProperties></PredefinedProperties>");
+        sb.append("<UserDefinedProperties></UserDefinedProperties>");
+        sb.append("<MaxMemorySizeMb>").append(memMb).append("</MaxMemorySizeMb>");
+        sb.append("<MultiQueuesEnabled>true</MultiQueuesEnabled>");
+        sb.append("<VirtioScsiMultiQueuesEnabled>false</VirtioScsiMultiQueuesEnabled>");
+        sb.append("<UseHostCpu>false</UseHostCpu>");
+        sb.append("<BalloonEnabled>").append(mapBalloonEnabled(vm)).append("</BalloonEnabled>");
+        sb.append("<CpuPinningPolicy>0</CpuPinningPolicy>");
+        sb.append("<ClusterName></ClusterName>");
+        sb.append("<TemplateId>").append(escapeText(templateId)).append("</TemplateId>");
+        sb.append("<TemplateName>").append(escapeText(templateName)).append("</TemplateName>");
+        sb.append("<IsInitilized>true</IsInitilized>");
+        sb.append("<Origin>3</Origin>");
+        sb.append("<quota_id>").append(ZERO_UUID).append("</quota_id>");
+        sb.append("<DefaultDisplayType>2</DefaultDisplayType>");
+        sb.append("<TrustedService>false</TrustedService>");
+        sb.append("<OriginalTemplateId>").append(escapeText(templateId)).append("</OriginalTemplateId>");
+        sb.append("<OriginalTemplateName>").append(escapeText(templateName)).append("</OriginalTemplateName>");
+        sb.append("<UseLatestVersion>false</UseLatestVersion>");
+        sb.append("<StopTime>").append(stopTime).append("</StopTime>");
+        sb.append("<BootTime>").append(bootTime).append("</BootTime>");
+        sb.append("<Downtime>0</Downtime>");
+
+        // --- Operating system section ---
+        sb.append("<Section ovf:id=\"").append(escapeAttr(vmId)).append("\" ovf:required=\"false\" xsi:type=\"ovf:OperatingSystemSection_Type\">");
+        sb.append("<Info>Guest Operating System</Info>");
+        sb.append("<Description>").append(escapeText(inferOsDescription(vm))).append("</Description>");
+        sb.append("</Section>");
+
+        // --- Virtual hardware section ---
+        sb.append("<Section xsi:type=\"ovf:VirtualHardwareSection_Type\">");
+        sb.append("<Info>").append(vcpu).append(" CPU, ").append(memMb).append(" Memory</Info>");
+        sb.append("<System>");
+        sb.append("<vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType>");
+        sb.append("</System>");
+
+        // CPU
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>").append(vcpu).append(" virtual cpu</rasd:Caption>");
+        sb.append("<rasd:Description>Number of virtual CPU</rasd:Description>");
+        sb.append("<rasd:InstanceId>1</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>3</rasd:ResourceType>");
+        sb.append("<rasd:num_of_sockets>").append(sockets).append("</rasd:num_of_sockets>");
+        sb.append("<rasd:cpu_per_socket>").append(cpuPerSocket).append("</rasd:cpu_per_socket>");
+        sb.append("<rasd:threads_per_cpu>").append(threads).append("</rasd:threads_per_cpu>");
+        sb.append("<rasd:max_num_of_vcpus>").append(maxVcpu).append("</rasd:max_num_of_vcpus>");
+        sb.append("<rasd:VirtualQuantity>").append(vcpu).append("</rasd:VirtualQuantity>");
+        sb.append("</Item>");
+
+        // Memory
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>").append(memMb).append(" MB of memory</rasd:Caption>");
+        sb.append("<rasd:Description>Memory Size</rasd:Description>");
+        sb.append("<rasd:InstanceId>2</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>4</rasd:ResourceType>");
+        sb.append("<rasd:AllocationUnits>").append(MemoryAllocationUnit.Megabytes.getAllocationUnitsToken()).append("</rasd:AllocationUnits>");
+        sb.append("<rasd:VirtualQuantity>").append(memMb).append("</rasd:VirtualQuantity>");
+        sb.append("</Item>");
+
+        // Disks as Items
+        int diskUnit = 0;
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final Disk d = da.getDisk();
+            final String diskId = d.getId();
+            final String storageDomainId = firstStorageDomainId(d);
+            final String href = storageDomainId + "/" + diskId;
+
+            sb.append("<Item>");
+            sb.append("<rasd:Caption>").append(escapeText(defaultString(d.getAlias()))).append("</rasd:Caption>");
+            sb.append("<rasd:InstanceId>").append(escapeText(diskId)).append("</rasd:InstanceId>");
+            sb.append("<rasd:ResourceType>17</rasd:ResourceType>");
+            sb.append("<rasd:HostResource>").append(escapeText(href)).append("</rasd:HostResource>");
+            sb.append("<rasd:Parent>").append(ZERO_UUID).append("</rasd:Parent>");
+            sb.append("<rasd:Template>").append(escapeText(templateId)).append("</rasd:Template>");
+            sb.append("<rasd:ApplicationList></rasd:ApplicationList>");
+            sb.append("<rasd:StorageId>").append(escapeText(storageDomainId)).append("</rasd:StorageId>");
+            sb.append("<rasd:StoragePoolId>").append(ZERO_UUID).append("</rasd:StoragePoolId>");
+            sb.append("<rasd:CreationDate>").append(creationDate).append("</rasd:CreationDate>");
+            sb.append("<rasd:LastModified>").append(exportDate).append("</rasd:LastModified>");
+            sb.append("<rasd:last_modified_date>").append(exportDate).append("</rasd:last_modified_date>");
+            sb.append("<Type>disk</Type>");
+            sb.append("<Device>disk</Device>");
+            sb.append("<rasd:Address>").append(escapeText("{type=drive, bus=0, controller=0, target=0, unit=" + diskUnit + "}")).append("</rasd:Address>");
+            sb.append("<BootOrder>").append("true".equalsIgnoreCase(da.getBootable()) ? 1 : 0).append("</BootOrder>");
+            sb.append("<IsPlugged>true</IsPlugged>");
+            sb.append("<IsReadOnly>").append("true".equalsIgnoreCase(da.getReadOnly())).append("</IsReadOnly>");
+            sb.append("<Alias>").append(escapeText("ua-" + href)).append("</Alias>");
+            sb.append("</Item>");
+            diskUnit++;
+        }
+
+        // NICs as Items
+        int nicSlot = 0;
+        for (Nic nic : nics) {
+            if (nic == null) {
+                continue;
+            }
+            final String nicId = firstNonBlank(nic.getId(), UUID.nameUUIDFromBytes(("nic-" + vmId + "-" + nicSlot).getBytes(StandardCharsets.UTF_8)).toString());
+            final String nicName = firstNonBlank(nic.getName(), "nic" + (nicSlot + 1));
+            final String mac = nic.getMac() != null ? defaultString(nic.getMac().getAddress()) : "";
+            final String elementName = nic.getVnicProfile() != null ? defaultString(nic.getVnicProfile().getId()) : nicName;
+
+            sb.append("<Item>");
+            sb.append("<rasd:Caption>Ethernet adapter - ").append(nic.getName()).append("</rasd:Caption>");
+            sb.append("<rasd:InstanceId>").append(escapeText(nicId)).append("</rasd:InstanceId>");
+            sb.append("<rasd:ResourceType>10</rasd:ResourceType>");
+            sb.append("<rasd:OtherResourceType></rasd:OtherResourceType>");
+            sb.append("<rasd:ResourceSubType>").append(mapNicResourceSubType(nic.getInterfaceType())).append("</rasd:ResourceSubType>");
+            sb.append("<rasd:Connection>").append(escapeText(defaultString(inferNetworkName(nic)))).append("</rasd:Connection>");
+            sb.append("<rasd:Linked>").append(escapeText(booleanString(nic.getLinked(), "true"))).append("</rasd:Linked>");
+            sb.append("<rasd:Name>").append(escapeText(nicName)).append("</rasd:Name>");
+            sb.append("<rasd:ElementName>").append(escapeText(elementName)).append("</rasd:ElementName>");
+            sb.append("<rasd:MACAddress>").append(escapeText(mac)).append("</rasd:MACAddress>");
+            sb.append("<rasd:speed>10000</rasd:speed>");
+            sb.append("<Type>interface</Type>");
+            sb.append("<Device>bridge</Device>");
+            sb.append("<rasd:Address>").append(escapeText("{type=pci, slot=0x" + String.format("%02x", nicSlot) + ", bus=0x01, domain=0x0000, function=0x0}")).append("</rasd:Address>");
+            sb.append("<BootOrder>0</BootOrder>");
+            sb.append("<IsPlugged>").append(escapeText(booleanString(nic.getPlugged(), "true"))).append("</IsPlugged>");
+            sb.append("<IsReadOnly>false</IsReadOnly>");
+            sb.append("<Alias>").append(escapeText("ua-" + nicId)).append("</Alias>");
+            sb.append("</Item>");
+            nicSlot++;
+        }
+
+        // A few common devices that some consumers expect to exist (kept minimal)
+        // USB controller
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>USB Controller</rasd:Caption>");
+        sb.append("<rasd:InstanceId>3</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>23</rasd:ResourceType>");
+        sb.append("<rasd:UsbPolicy>DISABLED</rasd:UsbPolicy>");
+        sb.append("</Item>");
+
+        // RNG device
+        sb.append("<Item>");
+        sb.append("<rasd:ResourceType>0</rasd:ResourceType>");
+        sb.append("<rasd:InstanceId>").append(UUID.nameUUIDFromBytes(("rng-" + vmId).getBytes(StandardCharsets.UTF_8))).append("</rasd:InstanceId>");
+        sb.append("<Type>rng</Type>");
+        sb.append("<Device>virtio</Device>");
+        sb.append("<rasd:Address>{type=pci, slot=0x00, bus=0x06, domain=0x0000, function=0x0}</rasd:Address>");
+        sb.append("<BootOrder>0</BootOrder>");
+        sb.append("<IsPlugged>true</IsPlugged>");
+        sb.append("<IsReadOnly>false</IsReadOnly>");
+        sb.append("<Alias></Alias>");
+        sb.append("<SpecParams><source>urandom</source></SpecParams>");
+        sb.append("</Item>");
+
+        sb.append("</Section>");
+        sb.append("</Content>");
+        sb.append("</ovf:Envelope>");
+
+        return sb.toString();
+    }
+
+    private static void addCloudStackMetadata(Vm vm, UserVmJoinVO vo, StringBuilder sb) {
+        if (vo != null) {
+            // -- Add a section for CloudStack-specific metadata that some consumers might look for (e.g. for import back into CloudStack) ---
+            // Add CloudStack-specific metadata section
+            sb.append("<Section xsi:type=\"ovf:CloudStackMetadata_Type\">");
+            sb.append("<Info>CloudStack specific metadata</Info>");
+            sb.append("<CloudStack>");
+            sb.append("<InstanceId>").append(vm.getInstanceId()).append("</InstanceId>");
+            sb.append("<InstanceName>").append(vm.getInstanceName()).append("</InstanceName>");
+            sb.append("<InstanceGroupId>").append(vm.getInstanceGroupId()).append("</InstanceGroupId>");
+            sb.append("<AccountId>").append(vo.getAccountUuid()).append("</AccountId>");
+            sb.append("<DomainId>").append(vo.getDomainUuid()).append("</DomainId>");
+            sb.append("<ProjectId>").append(escapeText(vo.getProjectUuid())).append("</ProjectId>");
+            if (vm.getCpuProfile() != null && StringUtils.isNotBlank(vm.getCpuProfile().getId())) {
+                sb.append("<ServiceOfferingId>").append(vm.getCpuProfile().getId()).append("</ServiceOfferingId>");
+            }
+            sb.append("<DataDiskOfferingIdMap>");
+            for (DiskAttachment da : diskAttachments(vm)) {
+                if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                    continue;
+                }
+                final Disk d = da.getDisk();
+                sb.append("<Entry>");
+                sb.append("<DiskId>").append(escapeText(d.getId())).append("</DiskId>");
+                sb.append("<OfferingId>").append(d.getDiskProfile().getId()).append("</OfferingId>");
+                sb.append("</Entry>");
+            }
+            sb.append("</DataDiskOfferingIdMap>");
+            if (MapUtils.isNotEmpty(vm.getDetails())) {
+                sb.append("<Details>");
+                for (Map.Entry<String, String> entry : vm.getDetails().entrySet()) {
+                    sb.append("<Detail>");
+                    sb.append("<Key>").append(escapeText(entry.getKey())).append("</Key>");
+                    sb.append("<Value>").append(escapeText(entry.getValue())).append("</Value>");
+                    sb.append("</Detail>");
+                }
+                sb.append("</Details>");
+            }
+            if (vo.getUserDataId() != null) {
+                sb.append("<UserDataId>").append(escapeText(vo.getUserDataUuid())).append("</UserDataId>");
+            }
+            if (vo.getAffinityGroupId() != null) {
+                sb.append("<AffinityGroupId>").append(escapeText(vo.getAffinityGroupUuid())).append("</AffinityGroupId>");
+            }
+            if (vm.getNics() != null && CollectionUtils.isNotEmpty(vm.getNics().getItems())) {
+                sb.append("<Nics>");
+                for (Nic nic : nics(vm)) {
+                    if (nic == null || StringUtils.isBlank(nic.getId())) {
+                        continue;
+                    }
+                    String networkId = nicNetworkId(nic);
+                    if (networkId == null) {
+                        continue;
+                    }
+                    sb.append("<Nic>");
+                    sb.append("<Id>").append(escapeText(nic.getId())).append("</Id>");
+                    sb.append("<NetworkId>").append(escapeText(networkId)).append("</NetworkId>");
+                    sb.append("<MACAddress>").append(escapeText(nicMac(nic))).append("</MACAddress>");
+                    sb.append("<Ip4Address>").append(escapeText(nicIp(nic, "v4"))).append("</Ip4Address>");
+                    sb.append("<Ip6Address>").append(escapeText(nicIp(nic, "v6"))).append("</Ip6Address>");
+                    sb.append("</Nic>");
+                }
+                sb.append("</Nics>");
+            }
+            if (StringUtils.isNotBlank(vm.getSshKeyPairNames())) {
+                sb.append("<SshKeyPairs>").append(escapeText(vm.getSshKeyPairNames())).append("</SshKeyPairs>");
+            }
+            if (StringUtils.isNotBlank(vm.getGuestOsId())) {
+                sb.append("<GuestOsId>").append(escapeText(vm.getGuestOsId())).append("</GuestOsId>");
+            }
+            if (StringUtils.isNotBlank(vm.getGuestOsName())) {
+                sb.append("<GuestOsName>").append(escapeText(vm.getGuestOsName())).append("</GuestOsName>");
+            }
+            if (StringUtils.isNotBlank(vm.getInstanceType())) {
+                sb.append("<Type>").append(escapeText(vm.getInstanceType())).append("</Type>");
+            }
+            if (StringUtils.isNoneBlank(vm.getSharedFSId(), vm.getSharedFsVolumeName())) {
+                sb.append("<SharedFSId>").append(escapeText(vm.getSharedFSId())).append("</SharedFSId>");
+                sb.append("<SharedFSVolumeName>").append(escapeText(vm.getSharedFsVolumeName())).append("</SharedFSVolumeName>");
+            }
+            if (CollectionUtils.isNotEmpty(vm.getSecurityGroupIds())) {
+                sb.append("<SecurityGroupIds>").append(escapeText(StringUtils.join(vm.getSecurityGroupIds(), ","))).append("</SecurityGroupIds>");
+            }
+            sb.append("</CloudStack>");
+            sb.append("</Section>");
+        }
+    }
+
+    protected static String getVmConfigurationData(Vm vm) {
+        Vm.Initialization initialization = vm.getInitialization();
+        if (initialization == null) {
+            return null;
+        }
+        Vm.Initialization.Configuration configuration = initialization.getConfiguration();
+        if (configuration == null) {
+            return null;
+        }
+        if (!"ovf".equalsIgnoreCase(configuration.getType())) {
+            return null;
+        }
+        return configuration.getData();
+    }
+
+    public static void updateFromConfiguration(Vm vm) {
+        String configurationData = getVmConfigurationData(vm);
+        OvfXmlUtil.updateFromXml(vm, configurationData);
+    }
+
+    public static String getConfigMetadataXml(Vm vm, Logger logger) {
+        String configurationData = getVmConfigurationData(vm);
+        if (StringUtils.isBlank(configurationData)) {
+            return null;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(configurationData.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Persist only the CloudStack metadata section from the source OVF.
+            Node metadataSection = (Node) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                    doc,
+                    XPathConstants.NODE
+            );
+
+            if (metadataSection == null) {
+                return null;
+            }
+
+            // Wrap section payload so it remains standalone XML with namespace declarations.
+            StringBuilder sb = new StringBuilder(2048);
+            sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+            sb.append("<Sections")
+              .append(" xmlns:rasd=\"").append(NS_RASD).append("\"")
+              .append(" xmlns:ovf=\"").append(NS_OVF).append("\"")
+              .append(" xmlns:xsi=\"").append(NS_XSI).append("\"")
+              .append(">");
+            sb.append(nodeToString(metadataSection));
+            sb.append("</Sections>");
+
+            return sb.toString();
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException  e) {
+            logger.error("Failed to parse VM configuration data for VM id {}: {}", vm.getId(), e.getMessage());
+            return null;
+        }
+    }
+
+    public static Pair<String, String> getVmNicDetailFromStoredConfig(String xmlConfig, String networkId, Logger logger) {
+        if (StringUtils.isAnyBlank(xmlConfig, networkId)) {
+            return new Pair<>(null, null);
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(xmlConfig.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Preferred format: CloudStack metadata section with CloudStack/Nics/Nic records.
+            NodeList nicNodes = (NodeList) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']/*[local-name()='CloudStack']/*[local-name()='Nics']/*[local-name()='Nic']",
+                    doc,
+                    XPathConstants.NODESET
+            );
+            if (nicNodes != null && nicNodes.getLength() > 0) {
+                for (int i = 0; i < nicNodes.getLength(); i++) {
+                    Node nicNode = nicNodes.item(i);
+                    String nicNetworkId = xpathString(xpath, nicNode, "./*[local-name()='NetworkId']/text()");
+                    if (StringUtils.equals(nicNetworkId, networkId)) {
+                        return new Pair<>(
+                                xpathString(xpath, nicNode, "./*[local-name()='MACAddress' or local-name()='MACAddress']/text()"),
+                                xpathString(xpath, nicNode, "./*[local-name()='Ip4Address' or local-name()='Ip4Address']/text()")
+                        );
+                    }
+                }
+            }
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException e) {
+            logger.error("Failed to parse VM configuration XML to retrieve details for NIC for network ID {}: {}",
+                    networkId, e.getMessage());
+        }
+        return new Pair<>(null, null);
+    }
+
+    public static Vm parseVmRestoreConfig(String xmlConfig, Logger logger) {
+        Vm vm = new Vm();
+        if (StringUtils.isBlank(xmlConfig)) {
+            logger.error("No XML configuration provided for VM restore");
+            return vm;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(xmlConfig.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+            Node metadataSection = (Node) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                    doc,
+                    XPathConstants.NODE
+            );
+            updateFromXmlCloudStackMetadataSection(vm, metadataSection, xpath);
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException e) {
+            logger.error("Failed to parse VM configuration XML for restore: {}", e.getMessage());
+        }
+        return vm;
+    }
+
+    private static String nodeToString(Node node) {
+        try {
+            // Implementation using string manipulation
+            StringBuilder sb = new StringBuilder();
+            serializeNodeToString(node, sb);
+            return sb.toString();
+        } catch (Exception e) {
+            return "";
+        }
+    }
+
+    private static void serializeNodeToString(Node node, StringBuilder sb) {
+        if (node == null) {
+            return;
+        }
+
+        short nodeType = node.getNodeType();
+        switch (nodeType) {
+            case Node.ELEMENT_NODE:
+                sb.append("<").append(node.getNodeName());
+                NamedNodeMap attrs = node.getAttributes();
+                if (attrs != null) {
+                    for (int i = 0; i < attrs.getLength(); i++) {
+                        Node attr = attrs.item(i);
+                        sb.append(" ").append(attr.getNodeName()).append("=\"")
+                                .append(escapeAttr(attr.getNodeValue())).append("\"");
+                    }
+                }
+                sb.append(">");
+                NodeList children = node.getChildNodes();
+                for (int i = 0; i < children.getLength(); i++) {
+                    serializeNodeToString(children.item(i), sb);
+                }
+                sb.append("</").append(node.getNodeName()).append(">");
+                break;
+            case Node.TEXT_NODE:
+                String text = node.getNodeValue();
+                if (StringUtils.isNotBlank(text)) {
+                    sb.append(escapeText(text));
+                }
+                break;
+            case Node.CDATA_SECTION_NODE:
+                sb.append("<![CDATA[").append(node.getNodeValue()).append("]]>");
+                break;
+            default:
+                break;
+        }
+    }
+
+    protected static void updateFromXml(Vm vm, String ovfXml) {
+        if (vm == null || StringUtils.isBlank(ovfXml)) {
+            return;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(ovfXml.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Register namespace context for XPath
+            xpath.setNamespaceContext(new OvfNamespaceContext());
+
+
+            Node contentNode = (Node) xpath.evaluate(
+                    "//*[local-name()='Content']",
+                    doc,
+                    XPathConstants.NODE
+            );
+            updateFromXmlContentNode(vm, contentNode, xpath);
+
+            Node hwSection = (Node) xpath.evaluate(
+                "//*[local-name()='Section' and @*[local-name()='type']='ovf:VirtualHardwareSection_Type']",
+                doc,
+                XPathConstants.NODE
+            );
+            updateFromXmlHardwareSection(vm, hwSection, xpath);
+
+            Node metadataSection = (Node) xpath.evaluate(
+                "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                doc,
+                XPathConstants.NODE
+            );
+            updateFromXmlCloudStackMetadataSection(vm, metadataSection, xpath);
+        } catch (Exception e) {
+            // Ignore parsing errors and keep original VM configuration
+        }
+    }
+
+    private static void updateFromXmlContentNode(Vm vm, Node contentNode, XPath xpath) {
+        if (contentNode == null) {
+            return;
+        }
+        String userId = xpathString(xpath, contentNode, "./*[local-name()='CreatedByUserId']/text()");
+        if (StringUtils.isNotBlank(userId)) {
+            vm.setAccountId(userId);
+        }
+        String templateId = xpathString(xpath, contentNode, "./*[local-name()='TemplateId']/text()");
+        if (StringUtils.isNotBlank(templateId)) {
+            vm.setTemplate(Ref.of("", templateId));
+        }
+        String biosType = xpathString(xpath, contentNode, "./*[local-name()='BiosType']/text()");
+        Vm.Bios bios = Vm.Bios.getBiosFromOrdinal(biosType);
+        vm.setBios(bios);
+    }
+
+    private static void updateFromXmlHardwareSection(Vm vm, Node hwSection, XPath xpath) throws XPathExpressionException {
+        if (hwSection == null) {
+            return;
+        }
+        // Memory
+        NodeList memItems = (NodeList) xpath.evaluate(
+            ".//*[local-name()='Item'][*[local-name()='ResourceType' and text()='4']]",
+                hwSection,
+            XPathConstants.NODESET
+        );
+        if (memItems != null && memItems.getLength() > 0) {
+            Node memItem = memItems.item(0);
+            String memStr = childText(memItem, "VirtualQuantity");
+            String memAllocationUnitsStr = childText(memItem, "AllocationUnits");
+            updateVmMemory(vm, memStr, memAllocationUnitsStr);
+        }
+
+        // CPU
+        NodeList cpuItems = (NodeList) xpath.evaluate(
+            ".//*[local-name()='Item'][*[local-name()='ResourceType' and text()='3']]",
+                hwSection,
+            XPathConstants.NODESET
+        );
+        if (cpuItems != null && cpuItems.getLength() > 0) {
+            Node cpuItem = cpuItems.item(0);
+            String socketsStr = childText(cpuItem, "num_of_sockets");
+            String coresStr = childText(cpuItem, "cpu_per_socket");
+            String threadsStr = childText(cpuItem, "threads_per_cpu");
+
+            if (vm.getCpu() == null) {
+                vm.setCpu(new Cpu());
+            }
+            if (vm.getCpu().getTopology() == null) {
+                vm.getCpu().setTopology(new Topology());
+            }
+
+            if (StringUtils.isNotBlank(socketsStr)) {
+                vm.getCpu().getTopology().setSockets(socketsStr);
+            }
+            if (StringUtils.isNotBlank(coresStr)) {
+                vm.getCpu().getTopology().setCores(coresStr);
+            }
+            if (StringUtils.isNotBlank(threadsStr)) {
+                vm.getCpu().getTopology().setThreads(threadsStr);
+            }
+        }
+    }
+
+    private static void updateVmMemory(Vm vm, String memStr, String memAllocationUnitsStr) {
+        if (StringUtils.isAnyBlank(memStr, memAllocationUnitsStr)) {
+            return;
+        }
+        MemoryAllocationUnit memoryAllocationUnit = MemoryAllocationUnit.fromString(memAllocationUnitsStr);
+        if (memoryAllocationUnit == null) {
+            return;
+        }
+        long memory = parseLong(memStr, 0);
+        if (memory == 0) {
+            return;
+        }
+        vm.setMemory(String.valueOf(memory * memoryAllocationUnit.getBytesMultiplier()));
+    }
+
+    private static void updateFromXmlCloudStackMetadataSection(Vm vm, Node metadataSection, XPath xpath) {
+        if (metadataSection == null) {
+            return;
+        }
+        String instanceId = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceId']/text()");
+        if (StringUtils.isNotBlank(instanceId) && vm.isSameLocationRestore()) {
+            vm.setInstanceId(instanceId);
+        }
+        String instanceName = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceName']/text()");
+        if (StringUtils.isNotBlank(instanceName) && vm.isSameLocationRestore()) {
+            vm.setInstanceName(instanceName);
+        }
+        String instanceGroupId = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceGroupId']/text()");
+        if (StringUtils.isNotBlank(instanceGroupId)) {
+            vm.setInstanceGroupId(instanceGroupId);
+        }
+        String serviceOfferingId = xpathString(xpath, metadataSection, ".//*[local-name()='ServiceOfferingId']/text()");
+        if (StringUtils.isNotBlank(serviceOfferingId)) {
+            vm.setCpuProfile(Ref.of("", serviceOfferingId));
+        }
+        String affinityGroupId = xpathString(xpath, metadataSection, ".//*[local-name()='AffinityGroupId']/text()");
+        if (StringUtils.isNotBlank(affinityGroupId)) {
+            vm.setAffinityGroupId(affinityGroupId);
+        }
+        String userDataId = xpathString(xpath, metadataSection, ".//*[local-name()='UserDataId']/text()");
+        if (StringUtils.isNotBlank(userDataId)) {
+            vm.setUserDataId(userDataId);
+        }
+        String sshKeyPairs = xpathString(xpath, metadataSection, ".//*[local-name()='SshKeyPairs']/text()");
+        if (StringUtils.isNotBlank(sshKeyPairs)) {
+            vm.setSshKeyPairNames(sshKeyPairs);
+        }
+        String guestOsId = xpathString(xpath, metadataSection, ".//*[local-name()='GuestOsId']/text()");
+        if (StringUtils.isNotBlank(guestOsId)) {
+            vm.setGuestOsId(guestOsId);
+        }
+        String guestOsName = xpathString(xpath, metadataSection, ".//*[local-name()='GuestOsName']/text()");
+        if (StringUtils.isNotBlank(guestOsName)) {
+            vm.setGuestOsName(guestOsName);
+        }
+        String instanceType = xpathString(xpath, metadataSection, ".//*[local-name()='Type']/text()");
+        if (StringUtils.isNotBlank(instanceType)) {
+            vm.setInstanceType(instanceType);
+        }
+        String sharedFSId = xpathString(xpath, metadataSection, ".//*[local-name()='SharedFSId']/text()");
+        if (StringUtils.isNotBlank(sharedFSId)) {
+            vm.setSharedFSId(sharedFSId);
+        }
+        String sharedFSVolumeName = xpathString(xpath, metadataSection, ".//*[local-name()='SharedFSVolumeName']/text()");
+        if (StringUtils.isNotBlank(sharedFSVolumeName)) {
+            vm.setSharedFsVolumeName(sharedFSVolumeName);
+        }
+        String securityGroupIds = xpathString(xpath, metadataSection, ".//*[local-name()='SecurityGroupIds']/text()");
+        if (StringUtils.isNotBlank(securityGroupIds)) {
+            vm.setSecurityGroupIds(Arrays.asList(StringUtils.split(securityGroupIds, ",")));
+        }
+        final Map<String, String> details = new HashMap<>();
+        try {
+            NodeList detailNodes = (NodeList) xpath.evaluate(
+                    ".//*[local-name()='Details']/*[local-name()='Detail']",
+                    metadataSection,
+                    XPathConstants.NODESET
+            );
+
+            for (int i = 0; i < detailNodes.getLength(); i++) {
+                Node detailNode = detailNodes.item(i);
+                String key = xpathString(xpath, detailNode, "./*[local-name()='Key']/text()");
+                if (StringUtils.isBlank(key)) {
+                    continue;
+                }
+                String value = xpathString(xpath, detailNode, "./*[local-name()='Value']/text()");
+                details.put(key, defaultString(value));
+            }
+        } catch (XPathExpressionException ignored) {
+        }
+        if (!details.isEmpty()) {
+            vm.setDetails(details);
+        }
+    }
+
+    private static String xpathString(XPath xpath, Node node, String expression) {
+        if (node == null) {
+            return null;
+        }
+        try {
+            String value = (String) xpath.evaluate(expression, node, XPathConstants.STRING);
+            return StringUtils.isBlank(value) ? null : value.trim();
+        } catch (XPathExpressionException e) {
+            return null;
+        }
+    }
+
+    private static String childText(Node parent, String localName) {
+        if (parent == null || StringUtils.isBlank(localName)) {
+            return null;
+        }
+        NodeList children = parent.getChildNodes();
+        for (int i = 0; i < children.getLength(); i++) {
+            Node child = children.item(i);
+            if (child.getNodeType() != Node.ELEMENT_NODE) {
+                continue;
+            }
+            String ln = child.getLocalName();
+            if (StringUtils.isBlank(ln)) {
+                ln = child.getNodeName();
+            }
+            if (localName.equalsIgnoreCase(ln)) {
+                return StringUtils.trim(child.getTextContent());
+            }
+        }
+        return null;
+    }
+
+    private static List<DiskAttachment> diskAttachments(Vm vm) {
+        if (vm.getDiskAttachments() == null) {
+            return List.of();
+        }
+        return vm.getDiskAttachments().getItems();
+    }
+
+    private static List<Nic> nics(Vm vm) {
+        if (vm.getNics() == null) {
+            return List.of();
+        }
+        return vm.getNics().getItems();
+    }
+
+    private static String nicNetworkId(Nic nic) {
+        if (nic == null || nic.getVnicProfile() == null || StringUtils.isEmpty(nic.getVnicProfile().getId())) {
+            return null;
+        }
+        return nic.getVnicProfile().getId();
+    }
+
+    private static ReportedDevice getNicReportedDevice(Nic nic) {
+        if (nic == null || nic.getReportedDevices() == null || CollectionUtils.isEmpty(nic.getReportedDevices().getItems())) {
+            return null;
+        }
+        return nic.getReportedDevices().getItems().get(0);
+    }
+
+    private static String nicMac(Nic nic) {
+        if (nic == null || nic.getMac() == null || StringUtils.isBlank(nic.getMac().getAddress())) {
+            return "";
+        }
+        return nic.getMac().getAddress();
+    }
+
+    private static String nicIp(Nic nic, String version) {
+        ReportedDevice device = getNicReportedDevice(nic);
+        if (device == null || device.getIps() == null || CollectionUtils.isEmpty(device.getIps().getItems())) {
+            return "";
+        }
+        for (Ip ip : device.getIps().getItems()) {
+            if (version.equalsIgnoreCase(ip.getVersion())) {
+                return ip.getAddress();
+            }
+        }
+        return "";
+    }
+
+    private static String inferOsDescription(Vm vm) {
+        if (vm.getOs() == null) {
+            return "other";
+        }
+        String t = vm.getOs().getType();
+        if (StringUtils.isBlank(t)) {
+            return "other";
+        }
+        if (t.toLowerCase(Locale.ROOT).contains("win")) {
+            return "windows";
+        }
+        if (t.toLowerCase(Locale.ROOT).contains("linux")) {
+            return "linux";
+        }
+        return t;
+    }
+
+    private static String inferNetworkName(Nic nic) {
+        return "Network-" + nic.getId();
+    }
+
+    private static String firstStorageDomainId(Disk d) {
+        if (ObjectUtils.allNotNull(d, d.getStorageDomains()) && CollectionUtils.isNotEmpty(d.getStorageDomains().getItems())) {
+            return d.getStorageDomains().getItems().get(0).getId();
+        }
+        return UUID.randomUUID().toString();
+    }
+
+    private static String mapDiskInterface(String iface) {
+        if (StringUtils.isBlank(iface)) {
+            return "VirtIO";
+        }
+        String v = iface.toLowerCase(Locale.ROOT);
+        if (v.contains("virtio") && v.contains("scsi")) {
+            return "VirtIO_SCSI";
+        }
+        if (v.contains("virtio")) {
+            return "VirtIO";
+        }
+        if (v.contains("ide")) {
+            return "IDE";
+        }
+        if (v.contains("sata")) {
+            return "SATA";
+        }
+        return iface;
+    }
+
+    private static String mapOvfDiskFormat(String format, String sparse) {
+        if ("true".equalsIgnoreCase(sparse)) {
+            return "http://www.vmware.com/specifications/vmdk.html#sparse";
+        }
+        return "http://www.vmware.com/specifications/vmdk.html#sparse";
+    }
+
+    private static String mapVolumeFormat(String format) {
+        if (StringUtils.isBlank(format)) {
+            return "RAW";
+        }
+        String f = format.toLowerCase(Locale.ROOT);
+        if (f.contains("cow") || f.contains("qcow")) {
+            return "COW";
+        }
+        if (f.contains("raw")) {
+            return "RAW";
+        }
+        return format.toUpperCase(Locale.ROOT);
+    }
+
+    private static String mapVolumeType(String sparse) {
+        return "true".equalsIgnoreCase(sparse) ? "Sparse" : "Preallocated";
+    }
+
+    private static String mapBalloonEnabled(Vm vm) {
+        if (vm.getMemoryPolicy() == null || vm.getMemoryPolicy().getBallooning() == null) {
+            return "true";
+        }
+        return Boolean.toString("true".equalsIgnoreCase(vm.getMemoryPolicy().getBallooning()));
+    }
+
+    private static int mapNicResourceSubType(String iface) {
+        if (StringUtils.isBlank(iface)) {
+            return 3;
+        }
+        String v = iface.toLowerCase(Locale.ROOT);
+        if (v.contains("virtio")) {
+            return 3;
+        }
+        return 3;
+    }
+
+    private static String booleanString(String v, String def) {
+        if (StringUtils.isBlank(v)) {
+            return def;
+        }
+        if ("true".equalsIgnoreCase(v)) {
+            return "true";
+        }
+        if ("false".equalsIgnoreCase(v)) {
+            return "false";
+        }
+        return def;
+    }
+
+    private static String firstNonBlank(String... vals) {
+        for (String v : vals) {
+            if (StringUtils.isNotBlank(v)) {
+                return v;
+            }
+        }
+        return "";
+    }
+
+    private static String defaultString(String s) {
+        return s == null ? "" : s;
+    }
+
+    private static long parseLong(String s, long def) {
+        if (StringUtils.isBlank(s)) {
+            return def;
+        }
+        try {
+            return Long.parseLong(s);
+        } catch (Exception ignored) {
+            return def;
+        }
+    }
+
+    private static long bytesToGibCeil(long bytes) {
+        if (bytes <= 0) {
+            return 0;
+        }
+        final long gib = MemoryAllocationUnit.Gigabytes.getBytesMultiplier();
+        return (bytes + gib - 1) / gib;
+    }
+
+    private static String formatDate(long epochMillis) {
+        return OVIRT_DTF.get().format(new Date(epochMillis));
+    }
+
+    private static String escapeText(String s) {
+        if (s == null) {
+            return "";
+        }
+        return s.replace("&", "&amp;")
+                .replace("<", "&lt;")
+                .replace(">", "&gt;")
+                .replace("\"", "&quot;")
+                .replace("'", "&apos;");
+    }
+
+    private static String escapeAttr(String s) {
+        return escapeText(s);
+    }
+
+    protected static class OvfNamespaceContext implements NamespaceContext {
+        @Override
+        public String getNamespaceURI(String prefix) {
+            if ("ovf".equals(prefix)) return NS_OVF;
+            if ("rasd".equals(prefix)) return NS_RASD;
+            if ("vssd".equals(prefix)) return NS_VSSD;
+            if ("xsi".equals(prefix)) return NS_XSI;
+            return XMLConstants.NULL_NS_URI;
+        }
+        @Override
+        public String getPrefix(String namespaceURI) {
+            return null;
+        }
+        @Override
+        public java.util.Iterator<String> getPrefixes(String namespaceURI) {
+            return null;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java
new file mode 100644
index 000000000000..7f696a309798
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java
@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class ProductInfo {
+
+    private String instanceId;
+    public String name;
+    public Version version;
+
+    public String getInstanceId() {
+        return instanceId;
+    }
+
+    public void setInstanceId(String instanceId) {
+        this.instanceId = instanceId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java
new file mode 100644
index 000000000000..4eefbde8ebf6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java
@@ -0,0 +1,31 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Ref extends BaseDto {
+
+    public static Ref of(final String href, final String id) {
+        Ref ref = new Ref();
+        ref.setHref(href);
+        ref.setId(id);
+        return ref;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java
new file mode 100644
index 000000000000..2e23f019f1a8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java
@@ -0,0 +1,84 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class ReportedDevice extends BaseDto {
+    private String comment;
+    private String description;
+    private NamedList<Ip> ips;
+    private Mac mac;
+    private String name;
+    private String type;
+    private Vm vm;
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public NamedList<Ip> getIps() {
+        return ips;
+    }
+
+    public void setIps(NamedList<Ip> ips) {
+        this.ips = ips;
+    }
+
+    public Mac getMac() {
+        return mac;
+    }
+
+    public void setMac(Mac mac) {
+        this.mac = mac;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java
new file mode 100644
index 000000000000..ed6c39240369
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java
@@ -0,0 +1,39 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class ResourceAction extends BaseDto {
+    private Ref job;
+    private String status;
+
+    public Ref getJob() {
+        return job;
+    }
+
+    public void setJob(Ref job) {
+        this.job = job;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java
new file mode 100644
index 000000000000..616e6317d90d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java
@@ -0,0 +1,105 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Snapshot extends BaseDto {
+
+    // epoch millis
+    private Long date;
+    private String persistMemorystate;
+    private String snapshotStatus;
+    private String snapshotType;
+    private NamedList<Link> actions;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private Vm vm;
+
+    public Snapshot() {
+    }
+
+    public Long getDate() {
+        return date;
+    }
+
+    public void setDate(final Long date) {
+        this.date = date;
+    }
+
+    public String getPersistMemorystate() {
+        return persistMemorystate;
+    }
+
+    public void setPersistMemorystate(final String persistMemorystate) {
+        this.persistMemorystate = persistMemorystate;
+    }
+
+    public String getSnapshotStatus() {
+        return snapshotStatus;
+    }
+
+    public void setSnapshotStatus(final String snapshotStatus) {
+        this.snapshotStatus = snapshotStatus;
+    }
+
+    public String getSnapshotType() {
+        return snapshotType;
+    }
+
+    public void setSnapshotType(final String snapshotType) {
+        this.snapshotType = snapshotType;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(final NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java
new file mode 100644
index 000000000000..0ed2297eaad9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java
@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SpecialObjects {
+
+    private Ref blankTemplate;
+    private Ref rootTag;
+
+    public Ref getBlankTemplate() {
+        return blankTemplate;
+    }
+
+    public void setBlankTemplate(Ref blankTemplate) {
+        this.blankTemplate = blankTemplate;
+    }
+
+    public Ref getRootTag() {
+        return rootTag;
+    }
+
+    public void setRootTag(Ref rootTag) {
+        this.rootTag = rootTag;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java
new file mode 100644
index 000000000000..4631df35ec67
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java
@@ -0,0 +1,70 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Storage {
+
+    private String type;
+    private String address;
+    private String path;
+    private String mountOptions;
+    private String nfsVersion;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getPath() {
+        return path;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    public String getMountOptions() {
+        return mountOptions;
+    }
+
+    public void setMountOptions(String mountOptions) {
+        this.mountOptions = mountOptions;
+    }
+
+    public String getNfsVersion() {
+        return nfsVersion;
+    }
+
+    public void setNfsVersion(String nfsVersion) {
+        this.nfsVersion = nfsVersion;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java
new file mode 100644
index 000000000000..fff9d5f75ce8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java
@@ -0,0 +1,236 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class StorageDomain extends BaseDto {
+
+    private String name;
+    private String description;
+    private String comment;
+    private String available;
+    private String used;
+    private String committed;
+    private String blockSize;
+    private String warningLowSpaceIndicator;
+    private String criticalSpaceActionBlocker;
+    private String status;          // e.g. "unattached" (optional in your first object)
+    private String type;            // data / image / iso / export
+    private String master;          // "true"/"false"
+    private String backup;          // "true"/"false"
+    private String externalStatus;  // "ok"
+    private String storageFormat;   // v5 / v1
+    private String discardAfterDelete;
+    private String wipeAfterDelete;
+    private String supportsDiscard;
+    private String supportsDiscardZeroesData;
+    private Storage storage;
+    private NamedList<DataCenter> dataCenters;
+    private NamedList<Link> actions;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getAvailable() {
+        return available;
+    }
+
+    public void setAvailable(String available) {
+        this.available = available;
+    }
+
+    public String getUsed() {
+        return used;
+    }
+
+    public void setUsed(String used) {
+        this.used = used;
+    }
+
+    public String getCommitted() {
+        return committed;
+    }
+
+    public void setCommitted(String committed) {
+        this.committed = committed;
+    }
+
+    public String getBlockSize() {
+        return blockSize;
+    }
+
+    public void setBlockSize(String blockSize) {
+        this.blockSize = blockSize;
+    }
+
+    public String getWarningLowSpaceIndicator() {
+        return warningLowSpaceIndicator;
+    }
+
+    public void setWarningLowSpaceIndicator(String warningLowSpaceIndicator) {
+        this.warningLowSpaceIndicator = warningLowSpaceIndicator;
+    }
+
+    public String getCriticalSpaceActionBlocker() {
+        return criticalSpaceActionBlocker;
+    }
+
+    public void setCriticalSpaceActionBlocker(String criticalSpaceActionBlocker) {
+        this.criticalSpaceActionBlocker = criticalSpaceActionBlocker;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getMaster() {
+        return master;
+    }
+
+    public void setMaster(String master) {
+        this.master = master;
+    }
+
+    public String getBackup() {
+        return backup;
+    }
+
+    public void setBackup(String backup) {
+        this.backup = backup;
+    }
+
+    public String getExternalStatus() {
+        return externalStatus;
+    }
+
+    public void setExternalStatus(String externalStatus) {
+        this.externalStatus = externalStatus;
+    }
+
+    public String getStorageFormat() {
+        return storageFormat;
+    }
+
+    public void setStorageFormat(String storageFormat) {
+        this.storageFormat = storageFormat;
+    }
+
+    public String getDiscardAfterDelete() {
+        return discardAfterDelete;
+    }
+
+    public void setDiscardAfterDelete(String discardAfterDelete) {
+        this.discardAfterDelete = discardAfterDelete;
+    }
+
+    public String getWipeAfterDelete() {
+        return wipeAfterDelete;
+    }
+
+    public void setWipeAfterDelete(String wipeAfterDelete) {
+        this.wipeAfterDelete = wipeAfterDelete;
+    }
+
+    public String getSupportsDiscard() {
+        return supportsDiscard;
+    }
+
+    public void setSupportsDiscard(String supportsDiscard) {
+        this.supportsDiscard = supportsDiscard;
+    }
+
+    public String getSupportsDiscardZeroesData() {
+        return supportsDiscardZeroesData;
+    }
+
+    public void setSupportsDiscardZeroesData(String supportsDiscardZeroesData) {
+        this.supportsDiscardZeroesData = supportsDiscardZeroesData;
+    }
+
+    public Storage getStorage() {
+        return storage;
+    }
+
+    public void setStorage(Storage storage) {
+        this.storage = storage;
+    }
+
+    public NamedList<DataCenter> getDataCenters() {
+        return dataCenters;
+    }
+
+    public void setDataCenters(NamedList<DataCenter> dataCenters) {
+        this.dataCenters = dataCenters;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java
new file mode 100644
index 000000000000..ac26619ff026
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java
@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SummaryCount {
+
+    private String active;
+    private String total;
+
+    public SummaryCount() {
+    }
+
+    public SummaryCount(Integer active, Integer total) {
+        this.active = String.valueOf(active);
+        this.total = String.valueOf(total);
+    }
+
+    public String getActive() {
+        return active;
+    }
+
+    public String getTotal() {
+        return total;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java
new file mode 100644
index 000000000000..26cfff65620e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java
@@ -0,0 +1,38 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SupportedVersions {
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Version> version;
+
+    public SupportedVersions(final List<Version> version) {
+        this.version = version;
+    }
+
+    public List<Version> getVersion() {
+        return version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java
new file mode 100644
index 000000000000..1a9493160b6e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Tag extends BaseDto {
+    private String name;
+    private String description;
+    private Ref parent;
+    private Ref vm;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Ref getParent() {
+        return parent;
+    }
+
+    public void setParent(Ref parent) {
+        this.parent = parent;
+    }
+
+    public Ref getVm() {
+        return vm;
+    }
+
+    public void setVm(Ref vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java
new file mode 100644
index 000000000000..fa20db9d658c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java
@@ -0,0 +1,60 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Topology {
+    public String sockets;
+    public String cores;
+    public String threads;
+
+    public Topology() {
+    }
+
+    public Topology(final Integer sockets, final Integer cores, final Integer threads) {
+        this.sockets = String.valueOf(sockets);
+        this.cores = String.valueOf(cores);
+        this.threads = String.valueOf(threads);
+    }
+
+    public String getSockets() {
+        return sockets;
+    }
+
+    public void setSockets(String sockets) {
+        this.sockets = sockets;
+    }
+
+    public String getCores() {
+        return cores;
+    }
+
+    public void setCores(String cores) {
+        this.cores = cores;
+    }
+
+    public String getThreads() {
+        return threads;
+    }
+
+    public void setThreads(String threads) {
+        this.threads = threads;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java
new file mode 100644
index 000000000000..7b7d80a0f16c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java
@@ -0,0 +1,94 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import org.apache.cloudstack.utils.CloudStackVersion;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.commons.lang3.StringUtils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Version {
+
+    private String build;
+    private String fullVersion;
+    private String major;
+    private String minor;
+    private String revision;
+
+    public Version() {
+    }
+
+    public String getBuild() {
+        return build;
+    }
+
+    public void setBuild(String build) {
+        this.build = build;
+    }
+
+    public String getFullVersion() {
+        return fullVersion;
+    }
+
+    public void setFullVersion(String fullVersion) {
+        this.fullVersion = fullVersion;
+    }
+
+    public String getMajor() {
+        return major;
+    }
+
+    public void setMajor(String major) {
+        this.major = major;
+    }
+
+    public String getMinor() {
+        return minor;
+    }
+
+    public void setMinor(String minor) {
+        this.minor = minor;
+    }
+
+    public String getRevision() {
+        return revision;
+    }
+
+    public void setRevision(String revision) {
+        this.revision = revision;
+    }
+
+    public static Version fromPackageAndCSVersion(boolean complete) {
+        Version version = new Version();
+        String packageVersion = VeeamControlService.getPackageVersion();
+        if (StringUtils.isNotBlank(packageVersion) && complete) {
+            version.setFullVersion(packageVersion);
+        }
+        CloudStackVersion csVersion = VeeamControlService.getCSVersion();
+        if (csVersion == null) {
+            return version;
+        }
+        version.setMajor(String.valueOf(csVersion.getMajorRelease()));
+        version.setMinor(String.valueOf(csVersion.getMinorRelease()));
+        version.setBuild(String.valueOf(csVersion.getPatchRelease()));
+        version.setRevision(String.valueOf(csVersion.getSecurityRelease()));
+        return version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java
new file mode 100644
index 000000000000..bde648d911f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java
@@ -0,0 +1,643 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiConstants;
+
+import com.cloud.utils.EnumUtils;
+import com.cloud.utils.Pair;
+import com.cloud.utils.StringUtils;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+/**
+ * VM DTO intentionally uses snake_case field names to match the required JSON.
+ * Configure Jackson globally with SNAKE_CASE or keep as-is.
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "vm")
+public final class Vm extends BaseDto {
+    private String name;
+    private String description;
+    private String status;        // "up", "down", ...
+    private String stopReason;   // empty string allowed
+    private Long creationTime;
+    private Long stopTime;       // epoch millis
+    private Long startTime;       // epoch millis
+    private Ref template;
+    private Ref originalTemplate;
+    private Ref cluster;
+    private Ref host;
+    private String memory;          // bytes
+    private MemoryPolicy memoryPolicy;
+    private Cpu cpu;
+    private Os os;
+    private Bios bios;
+    private String stateless;  // true|false
+    private String type;    // "server"
+    private String origin;  // "ovirt"
+    private NamedList<Link> actions;      // actions.link[]
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private NamedList<Tag> tags;
+    private NamedList<DiskAttachment> diskAttachments;
+    private NamedList<Nic> nics;
+    private Initialization initialization;
+
+    private Ref cpuProfile;
+
+    public EmptyElement io = new EmptyElement();
+    public EmptyElement migration = new EmptyElement();
+    public EmptyElement sso = new EmptyElement();
+    public EmptyElement usb = new EmptyElement();
+    public EmptyElement quota = new EmptyElement();
+    public EmptyElement highAvailability = new EmptyElement();
+    public EmptyElement largeIcon = new EmptyElement();
+    public EmptyElement smallIcon = new EmptyElement();
+    public EmptyElement placementPolicy = new EmptyElement();
+    public EmptyElement timeZone = new EmptyElement();
+    public EmptyElement display = new EmptyElement();
+
+    // CloudStack-specific fields
+    private String instanceId;
+    private String instanceName;
+    private String instanceGroupId;
+    private String accountId;
+    private String affinityGroupId;
+    private String userDataId;
+    private Map<String, String> details;
+    private String sshKeyPairNames;
+    private String guestOsId;
+    private String guestOsName;
+    private String instanceType;
+    private String sharedFSId;
+    private String sharedFsVolumeName;
+    private List<String> securityGroupIds;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStopReason() {
+        return stopReason;
+    }
+
+    public void setStopReason(String stopReason) {
+        this.stopReason = stopReason;
+    }
+
+    public Long getCreationTime() {
+        return creationTime;
+    }
+
+    public void setCreationTime(Long creationTime) {
+        this.creationTime = creationTime;
+    }
+
+    public Long getStopTime() {
+        return stopTime;
+    }
+
+    public void setStopTime(Long stopTime) {
+        this.stopTime = stopTime;
+    }
+
+    public Long getStartTime() {
+        return startTime;
+    }
+
+    public void setStartTime(Long startTime) {
+        this.startTime = startTime;
+    }
+
+    public Ref getTemplate() {
+        return template;
+    }
+
+    public void setTemplate(Ref template) {
+        this.template = template;
+    }
+
+    public Ref getOriginalTemplate() {
+        return originalTemplate;
+    }
+
+    public void setOriginalTemplate(Ref originalTemplate) {
+        this.originalTemplate = originalTemplate;
+    }
+
+    public Ref getCluster() {
+        return cluster;
+    }
+
+    public void setCluster(Ref cluster) {
+        this.cluster = cluster;
+    }
+
+    public Ref getHost() {
+        return host;
+    }
+
+    public void setHost(Ref host) {
+        this.host = host;
+    }
+
+    public String getMemory() {
+        return memory;
+    }
+
+    public void setMemory(String memory) {
+        this.memory = memory;
+    }
+
+    public MemoryPolicy getMemoryPolicy() {
+        return memoryPolicy;
+    }
+
+    public void setMemoryPolicy(MemoryPolicy memoryPolicy) {
+        this.memoryPolicy = memoryPolicy;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public Os getOs() {
+        return os;
+    }
+
+    public void setOs(Os os) {
+        this.os = os;
+    }
+
+    public Bios getBios() {
+        return bios;
+    }
+
+    public void setBios(Bios bios) {
+        this.bios = bios;
+    }
+
+    public String getStateless() {
+        return stateless;
+    }
+
+    public void setStateless(String stateless) {
+        this.stateless = stateless;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getOrigin() {
+        return origin;
+    }
+
+    public void setOrigin(String origin) {
+        this.origin = origin;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    public NamedList<Tag> getTags() {
+        return tags;
+    }
+
+    public void setTags(NamedList<Tag> tags) {
+        this.tags = tags;
+    }
+
+    public NamedList<DiskAttachment> getDiskAttachments() {
+        return diskAttachments;
+    }
+
+    public void setDiskAttachments(NamedList<DiskAttachment> diskAttachments) {
+        this.diskAttachments = diskAttachments;
+    }
+
+    public NamedList<Nic> getNics() {
+        return nics;
+    }
+
+    public void setNics(NamedList<Nic> nics) {
+        this.nics = nics;
+    }
+
+    public Initialization getInitialization() {
+        return initialization;
+    }
+
+    public void setInitialization(Initialization initialization) {
+        this.initialization = initialization;
+    }
+
+    public Ref getCpuProfile() {
+        return cpuProfile;
+    }
+
+    public void setCpuProfile(Ref cpuProfile) {
+        this.cpuProfile = cpuProfile;
+    }
+
+    @JsonIgnore
+    public String getInstanceId() {
+        return instanceId;
+    }
+
+    public void setInstanceId(String instanceId) {
+        this.instanceId = instanceId;
+    }
+
+    @JsonIgnore
+    public String getInstanceName() {
+        return instanceName;
+    }
+
+    public void setInstanceName(String instanceName) {
+        this.instanceName = instanceName;
+    }
+
+    @JsonIgnore
+    public String getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    public void setInstanceGroupId(String instanceGroupId) {
+        this.instanceGroupId = instanceGroupId;
+    }
+
+    @JsonIgnore
+    public String getAccountId() {
+        return accountId;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+
+    @JsonIgnore
+    public String getAffinityGroupId() {
+        return affinityGroupId;
+    }
+
+    public void setAffinityGroupId(String affinityGroupId) {
+        this.affinityGroupId = affinityGroupId;
+    }
+
+    @JsonIgnore
+    public String getUserDataId() {
+        return userDataId;
+    }
+
+    public void setUserDataId(String userDataId) {
+        this.userDataId = userDataId;
+    }
+
+    @JsonIgnore
+    public Map<String, String> getDetails() {
+        return details;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
+
+    @JsonIgnore
+    public String getSshKeyPairNames() {
+        return sshKeyPairNames;
+    }
+
+    public void setSshKeyPairNames(String sshKeyPairNames) {
+        this.sshKeyPairNames = sshKeyPairNames;
+    }
+
+    @JsonIgnore
+    public String getGuestOsId() {
+        return guestOsId;
+    }
+
+    public void setGuestOsId(String guestOsId) {
+        this.guestOsId = guestOsId;
+    }
+
+    @JsonIgnore
+    public String getGuestOsName() {
+        return guestOsName;
+    }
+
+    public void setGuestOsName(String guestOsName) {
+        this.guestOsName = guestOsName;
+    }
+
+    @JsonIgnore
+    public String getInstanceType() {
+        return instanceType;
+    }
+
+    public void setInstanceType(String instanceType) {
+        this.instanceType = instanceType;
+    }
+
+    @JsonIgnore
+    public String getSharedFSId() {
+        return sharedFSId;
+    }
+
+    public void setSharedFSId(String sharedFSId) {
+        this.sharedFSId = sharedFSId;
+    }
+
+    @JsonIgnore
+    public String getSharedFsVolumeName() {
+        return sharedFsVolumeName;
+    }
+
+    public void setSharedFsVolumeName(String sharedFsVolumeName) {
+        this.sharedFsVolumeName = sharedFsVolumeName;
+    }
+
+    @JsonIgnore
+    public List<String> getSecurityGroupIds() {
+        return securityGroupIds;
+    }
+
+    public void setSecurityGroupIds(List<String> securityGroupIds) {
+        this.securityGroupIds = securityGroupIds;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Bios {
+
+        public enum Type {
+            cluster_default,
+            i440fx_sea_bios,
+            q35_ovmf,
+            q35_sea_bios,
+            q35_secure_boot
+        }
+
+        private String type; // "uefi" or "bios" or whatever mapping you choose
+        private BootMenu bootMenu = new BootMenu();
+
+        public String getType() {
+            return type;
+        }
+
+        @JsonIgnore
+        public int getTypeOrdinal() {
+            Type enumType = EnumUtils.getEnum(Type.class, type, Type.q35_sea_bios);
+            return enumType.ordinal();
+        }
+
+        public void setType(String type) {
+            this.type = type;
+        }
+
+        public BootMenu getBootMenu() {
+            return bootMenu;
+        }
+
+        public void setBootMenu(BootMenu bootMenu) {
+            this.bootMenu = bootMenu;
+        }
+
+        @JsonInclude(JsonInclude.Include.NON_NULL)
+        public static class BootMenu {
+
+            private String enabled;
+
+            public String getEnabled() {
+                return enabled;
+            }
+
+            public void setEnabled(String enabled) {
+                this.enabled = enabled;
+            }
+        }
+
+        public static Bios getDefault() {
+            Bios bios = new Bios();
+            bios.setType(Type.q35_sea_bios.name());
+            BootMenu bootMenu = new BootMenu();
+            bootMenu.setEnabled("false");
+            bios.setBootMenu(bootMenu);
+            return bios;
+        }
+
+        public static void updateBios(Bios bios, String bootMode) {
+            if (StringUtils.isEmpty(bootMode)) {
+                return;
+            }
+            if (ApiConstants.BootMode.SECURE.toString().equals(bootMode)) {
+                bios.setType(Type.q35_secure_boot.name());
+                return;
+            }
+            bios.setType(Type.q35_ovmf.name());
+        }
+
+        public static Bios getBiosFromOrdinal(String bootTypeStr) {
+            Bios bios = getDefault();
+            if (StringUtils.isEmpty(bootTypeStr)) {
+                return bios;
+            }
+            int  type = 1;
+            try {
+                type = Integer.parseInt(bootTypeStr);
+            } catch (NumberFormatException e) {
+                return bios;
+            }
+
+            if (type == Type.q35_ovmf.ordinal()) {
+                bios.setType(Type.q35_ovmf.name());
+            } else if (type == Type.q35_secure_boot.ordinal()) {
+                bios.setType(Type.q35_secure_boot.name());
+            }
+            return bios;
+        }
+
+        public static Pair<ApiConstants.BootType, ApiConstants.BootMode> retrieveBootOptions(Bios bios) {
+            Pair<ApiConstants.BootType, ApiConstants.BootMode> defaultValue =
+                    new Pair<>(ApiConstants.BootType.BIOS, ApiConstants.BootMode.LEGACY);
+            if (bios == null || StringUtils.isEmpty(bios.getType())) {
+                return defaultValue;
+            }
+            if (Type.q35_secure_boot.name().equals(bios.getType())) {
+                return new Pair<>(ApiConstants.BootType.UEFI, ApiConstants.BootMode.SECURE);
+            }
+            if (Type.q35_ovmf.name().equals(bios.getType())) {
+                return new Pair<>(ApiConstants.BootType.UEFI, ApiConstants.BootMode.LEGACY);
+            }
+            return defaultValue;
+        }
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class MemoryPolicy {
+
+        private String guaranteed;
+        private String max;
+        private String ballooning;
+
+        public String getGuaranteed() {
+            return guaranteed;
+        }
+
+        public void setGuaranteed(String guaranteed) {
+            this.guaranteed = guaranteed;
+        }
+
+        public String getMax() {
+            return max;
+        }
+
+        public void setMax(String max) {
+            this.max = max;
+        }
+
+        public String getBallooning() {
+            return ballooning;
+        }
+
+        public void setBallooning(String ballooning) {
+            this.ballooning = ballooning;
+        }
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class Initialization {
+
+        private String customScript;
+        private Configuration configuration;
+        private Boolean regenerateIds;
+
+        public String getCustomScript() {
+            return customScript;
+        }
+
+        public void setCustomScript(String customScript) {
+            this.customScript = customScript;
+        }
+
+        public Configuration getConfiguration() {
+            return configuration;
+        }
+
+        public void setConfiguration(Configuration configuration) {
+            this.configuration = configuration;
+        }
+
+        public Boolean isRegenerateIds() {
+            return regenerateIds;
+        }
+
+        public void setRegenerateIds(boolean regenerateIds) {
+            this.regenerateIds = regenerateIds;
+        }
+
+        @JsonInclude(JsonInclude.Include.NON_NULL)
+        public static class Configuration {
+
+            private String data;
+            private String type;
+
+            public String getData() {
+                return data;
+            }
+
+            public void setData(String data) {
+                this.data = data;
+            }
+
+            public String getType() {
+                return type;
+            }
+
+            public void setType(String type) {
+                this.type = type;
+            }
+        }
+    }
+
+    /**
+     * Assumes that any request carrying a non-empty custom script represents a worker VM.
+     */
+    @JsonIgnore
+    public boolean isWorkerVm() {
+        return initialization != null && StringUtils.isNotEmpty(initialization.getCustomScript());
+    }
+
+    /**
+     * Whether restoring same VM. We need to preserve IDs in that case
+     */
+    @JsonIgnore
+    public boolean isSameLocationRestore() {
+        return initialization != null && !Boolean.TRUE.equals(initialization.isRegenerateIds());
+    }
+
+    public static Vm of(String href, String id) {
+        return withHrefAndId(new Vm(), href, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java
new file mode 100644
index 000000000000..2fb5d11d0789
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class VmAction extends ResourceAction {
+    private Vm vm;
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java
new file mode 100644
index 000000000000..efc42ed1c88a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+/**
+ * oVirt-like vNIC profile element.
+ * Every vNIC profile MUST reference exactly one network.
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class VnicProfile extends BaseDto {
+
+    private String name;
+    private String description;
+
+    private Ref network;
+    private Ref dataCenter;
+
+    private List<Link> link;
+
+    public VnicProfile() {
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public Ref getNetwork() {
+        return network;
+    }
+
+    public void setNetwork(final Ref network) {
+        this.network = network;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(final Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java
new file mode 100644
index 000000000000..f57edf76e04c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java
@@ -0,0 +1,158 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.request;
+
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+public class ListQuery {
+    boolean allContent;
+    Long max;
+    Long page;
+    Map<String, String> search;
+    List<String> follow;
+
+    public boolean isAllContent() {
+        return allContent;
+    }
+
+    public void setAllContent(boolean allContent) {
+        this.allContent = allContent;
+    }
+
+    public Long getMax() {
+        return max;
+    }
+
+    public void setMax(Long max) {
+        this.max = max;
+    }
+
+    public void setSearch(Map<String, String> search) {
+        this.search = search;
+    }
+
+    public void setFollow(String followStr) {
+        if (StringUtils.isBlank(followStr)) {
+            this.follow = null;
+            return;
+        }
+        this.follow = Arrays.stream(followStr.split(","))
+                .map(String::trim)
+                .filter(s -> !s.isEmpty())
+                .collect(Collectors.toList());
+    }
+
+    public Long getOffset() {
+        if (page == null || max == null) {
+            return null;
+        }
+        return Math.max(0,   (page - 1)) * max;
+    }
+
+    public Long getLimit() {
+        return max;
+    }
+
+    public boolean followContains(String part) {
+        if (CollectionUtils.isEmpty(follow)) {
+            return false;
+        }
+        return follow.contains(part);
+    }
+
+    public static ListQuery fromRequest(HttpServletRequest request) {
+        ListQuery query = new ListQuery();
+        if (MapUtils.isEmpty(request.getParameterMap())) {
+            return query;
+        }
+
+        String allContent = request.getParameter("all_content");
+        if (StringUtils.isNotBlank(allContent)) {
+            query.setAllContent(Boolean.parseBoolean(allContent));
+        }
+        String max = request.getParameter("max");
+        if (StringUtils.isNotBlank(max)) {
+            try {
+                query.setMax(Long.parseLong(max));
+            } catch (NumberFormatException e) {
+                // Ignore invalid max and keep default null value.
+            }
+        }
+        String follow = request.getParameter("follow");
+        query.setFollow(follow);
+        Map<String, String> searchItems = getSearchMap(request.getParameter("search"));
+        if (!searchItems.isEmpty()) {
+            try {
+                query.setMax(Long.parseLong(searchItems.get("page")));
+            } catch (NumberFormatException e) {
+                // Ignore invalid page and keep default null value.
+            }
+            query.setSearch(searchItems);
+        }
+
+        return query;
+    }
+
+    // Parse search clause. Only keep items which use simple '=' operator, and ignore others. For example:
+    //   name=myvm and status=up  --> {name=myvm, status=up}
+    //   name=myvm and status!=down --> {name=myvm} (ignore status!=down because it uses '!=' operator)
+    @NotNull
+    private static Map<String, String> getSearchMap(String searchClause) {
+        Map<String, String> searchItems = new LinkedHashMap<>();
+        if (StringUtils.isBlank(searchClause)) {
+            return searchItems;
+        }
+        String[] terms = searchClause.trim().split("(?i)\\s+and\\s+");
+        for (String term : terms) {
+            if (term == null) {
+                continue;
+            }
+            String trimmedTerm = term.trim();
+            if (trimmedTerm.isEmpty()) {
+                continue;
+            }
+
+            int eqIdx = trimmedTerm.indexOf('=');
+            if (eqIdx <= 0 || eqIdx != trimmedTerm.lastIndexOf('=')) {
+                continue;
+            }
+            char prev = trimmedTerm.charAt(eqIdx - 1);
+            if (prev == '!' || prev == '<' || prev == '>') {
+                continue;
+            }
+
+            String key = trimmedTerm.substring(0, eqIdx).trim();
+            String value = trimmedTerm.substring(eqIdx + 1).trim();
+            if (!key.isEmpty() && !value.isEmpty()) {
+                searchItems.put(key, value);
+            }
+        }
+        return searchItems;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java
new file mode 100644
index 000000000000..424a105525b2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.util.List;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.net.NetUtils;
+
+public class AllowedClientCidrsFilter implements Filter {
+
+    private static final Logger LOGGER = LogManager.getLogger(AllowedClientCidrsFilter.class);
+
+    private final VeeamControlService veeamControlService;
+
+    public AllowedClientCidrsFilter(VeeamControlService veeamControlService) {
+        this.veeamControlService = veeamControlService;
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) {
+        // no-op
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        if (!(request instanceof HttpServletRequest) || !(response instanceof HttpServletResponse)) {
+            chain.doFilter(request, response);
+            return;
+        }
+
+        final HttpServletRequest req = (HttpServletRequest) request;
+        final HttpServletResponse resp = (HttpServletResponse) response;
+
+        if (veeamControlService == null) {
+            LOGGER.error("Failed to inject VeeamControlService, rejecting request because allowed client CIDRs cannot be evaluated");
+            resp.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE, "Service Unavailable");
+            return;
+        }
+
+        final List<String> cidrList = veeamControlService.getAllowedClientCidrs();
+        if (CollectionUtils.isEmpty(cidrList)) {
+            chain.doFilter(request, response);
+            return;
+        }
+
+        final String remoteAddr = req.getRemoteAddr();
+        try {
+            final InetAddress clientIp = InetAddress.getByName(remoteAddr);
+            final boolean allowed = NetUtils.isIpInCidrList(clientIp, cidrList.toArray(new String[0]));
+            if (!allowed) {
+                LOGGER.warn("Rejected request from client IP {} not in allowed CIDRs {}", remoteAddr, cidrList);
+                resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden");
+                return;
+            }
+        } catch (Exception e) {
+            LOGGER.warn("Rejected request failed to parse client IP {}: {}", remoteAddr, e.getMessage());
+            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden");
+            return;
+        }
+
+        chain.doFilter(request, response);
+    }
+
+    @Override
+    public void destroy() {
+        // no-op
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java
new file mode 100644
index 000000000000..ed8552fb0c88
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java
@@ -0,0 +1,220 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Map;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.sso.SsoService;
+import org.apache.cloudstack.veeam.utils.DataUtil;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+public class BearerOrBasicAuthFilter implements Filter {
+    private static final ObjectMapper JSON_MAPPER = new ObjectMapper();
+
+    private final VeeamControlService veeamControlService;
+
+    public BearerOrBasicAuthFilter(VeeamControlService veeamControlService) {
+        this.veeamControlService = veeamControlService;
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) {
+    }
+
+    @Override
+    public void destroy() {
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        final HttpServletRequest req = (HttpServletRequest) request;
+        final HttpServletResponse resp = (HttpServletResponse) response;
+
+        final String auth = req.getHeader("Authorization");
+        if (auth != null && auth.regionMatches(true, 0, "Bearer ", 0, 7)) {
+            final String token = auth.substring(7).trim();
+            if (token.isEmpty()) {
+                unauthorized(req, resp, "invalid_token", "Missing Bearer token");
+                return;
+            }
+            if (!verifyJwtHs256(token)) {
+                unauthorized(req, resp, "invalid_token", "Invalid or expired token");
+                return;
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+
+        // Optional fallback: Basic (handy for manual testing).
+        if (auth != null && auth.regionMatches(true, 0, "Basic ", 0, 6)) {
+            if (!verifyBasic(auth.substring(6))) {
+                unauthorized(req, resp, "invalid_client", "Invalid Basic credentials");
+                return;
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+
+        unauthorized(req, resp, "invalid_token", "Missing Authorization");
+    }
+
+    private boolean verifyBasic(String b64) {
+        final String decoded;
+        try {
+            decoded = new String(Base64.getDecoder().decode(b64), StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+
+        final int idx = decoded.indexOf(':');
+        if (idx <= 0) return false;
+
+        final String user = decoded.substring(0, idx);
+        final String pass = decoded.substring(idx + 1);
+
+        return veeamControlService != null && veeamControlService.validateCredentials(user, pass);
+    }
+
+    /**
+     * Minimal JWT verification:
+     * - HS256 signature
+     * - "iss" matches
+     * - "exp" not expired
+     * - "scope" contains REQUIRED_SCOPES (space-separated)
+     */
+    private boolean verifyJwtHs256(String token) {
+        final String[] parts = token.split("\\.");
+        if (parts.length != 3) return false;
+
+        final String headerB64 = parts[0];
+        final String payloadB64 = parts[1];
+        final String sigB64 = parts[2];
+
+        final byte[] expectedSig;
+        try {
+            expectedSig = JwtUtil.hmacSha256((headerB64 + "." + payloadB64).getBytes(StandardCharsets.UTF_8),
+                    veeamControlService.getHmacSecret().getBytes(StandardCharsets.UTF_8));
+        } catch (Exception e) {
+            return false;
+        }
+
+        final byte[] providedSig;
+        try {
+            providedSig = Base64.getUrlDecoder().decode(sigB64);
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+
+        if (!DataUtil.constantTimeEquals(expectedSig, providedSig)) return false;
+
+        Map<String, Object> payloadMap;
+        try {
+            String payloadJson = new String(Base64.getUrlDecoder().decode(payloadB64), StandardCharsets.UTF_8);
+            payloadMap = JSON_MAPPER.readValue(
+                    payloadJson,
+                    new TypeReference<>() {
+                    }
+            );
+        } catch (IllegalArgumentException | JsonProcessingException e) {
+            return false;
+        }
+
+        final String iss = (String) payloadMap.get("iss");
+        final String scope = (String) payloadMap.get("scope");
+        final Object expObj = payloadMap.get("exp");
+        Long exp = null;
+        if (expObj instanceof Number) {
+            exp = ((Number) expObj).longValue();
+        } else if (expObj instanceof String) {
+            try {
+                exp = Long.parseLong((String) expObj);
+            } catch (NumberFormatException ignored) {
+            }
+        }
+
+        if (!JwtUtil.ISSUER.equals(iss)) {
+            return false;
+        }
+        if (exp == null || Instant.now().getEpochSecond() >= exp) {
+            return false;
+        }
+        return scope != null && hasRequiredScopes(scope);
+    }
+
+    private static boolean hasRequiredScopes(String scope) {
+        String[] scopes = scope.split("\\s+");
+        for (String required : SsoService.REQUIRED_SCOPES) {
+            if (!hasScope(scopes, required)) return false;
+        }
+        return true;
+    }
+
+    private static boolean hasScope(String[] scopes, String required) {
+        for (String scope : scopes) {
+            if (scope.equals(required)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static void unauthorized(HttpServletRequest req, HttpServletResponse resp,
+                                     String error, String desc) throws IOException {
+        resp.resetBuffer();
+        resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+
+        // Helpful for OAuth clients:
+        resp.setHeader("WWW-Authenticate",
+                "Bearer realm=\"Veeam Integration\", error=\"" + DataUtil.jsonEscape(error) +
+                        "\", error_description=\"" + DataUtil.jsonEscape(desc) + "\"");
+
+        final String accept = req.getHeader("Accept");
+        final boolean wantsJson = accept != null && accept.toLowerCase().contains("application/json");
+
+        resp.setCharacterEncoding("UTF-8");
+        if (wantsJson) {
+            resp.setContentType("application/json; charset=UTF-8");
+            resp.getWriter().write("{\"error\":\"" + DataUtil.jsonEscape(error) +
+                    "\",\"error_description\":\"" + DataUtil.jsonEscape(desc) + "\"}");
+        } else {
+            resp.setContentType("text/html; charset=UTF-8");
+            resp.getWriter().write("<html><head><title>Error</title></head><body>Unauthorized</body></html>");
+        }
+        resp.getWriter().flush();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java
new file mode 100644
index 000000000000..e3373d5edf58
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java
@@ -0,0 +1,106 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.services;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.ca.CAManager;
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class PkiResourceRouteHandler extends ManagerBase implements RouteHandler {
+    private static final String BASE_ROUTE = "/services/pki-resource";
+    private static final String RESOURCE_KEY = "resource";
+    private static final String RESOURCE_VALUE = "ca-certificate";
+    private static final String FORMAT_KEY = "format";
+    private static final String FORMAT_VALUE = "X509-PEM-CA";
+    private static final Charset OUTPUT_CHARSET = StandardCharsets.ISO_8859_1;
+
+    @Inject
+    CAManager caManager;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE) && "GET".equalsIgnoreCase(req.getMethod())) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(HttpServletRequest req, HttpServletResponse resp,
+                 Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            final String resource = req.getParameter(RESOURCE_KEY);
+            final String format = req.getParameter(FORMAT_KEY);
+
+            if (StringUtils.isNotBlank(resource) && !RESOURCE_VALUE.equals(resource)) {
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported resource");
+                return;
+            }
+
+            if (StringUtils.isNotBlank(format) && !FORMAT_VALUE.equals(format)) {
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported format");
+                return;
+            }
+
+            byte[] pemBytes = returnCACertificate();
+            if (pemBytes.length == 0) {
+                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "No certificate data available");
+                return;
+            }
+            resp.setStatus(HttpServletResponse.SC_OK);
+            resp.setHeader("Cache-Control", "no-store");
+            resp.setContentType("application/x-x509-ca-cert; charset=" + OUTPUT_CHARSET.name());
+            resp.setHeader("Content-Disposition",
+                    "attachment; filename=\"pki-resource.cer\"");
+            resp.setContentLength(pemBytes.length);
+
+            try (OutputStream os = resp.getOutputStream()) {
+                os.write(pemBytes);
+            }
+        } catch (IOException e) {
+            String msg = "Failed to retrieve server CA certificate";
+            logger.error(msg, e);
+            resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, msg);
+        }
+    }
+
+    private byte[] returnCACertificate() throws IOException {
+        String tlsCaCert = caManager.getCaCertificate(null);
+        return tlsCaCert.getBytes(OUTPUT_CHARSET);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java
new file mode 100644
index 000000000000..f68097ab1f89
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java
@@ -0,0 +1,136 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.sso;
+
+import java.io.IOException;
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class SsoService extends ManagerBase implements RouteHandler {
+    private static final String BASE_ROUTE = "/sso";
+    private static final long DEFAULT_TTL_SECONDS = 3600;
+    public static final List<String> REQUIRED_SCOPES = List.of("ovirt-app-admin", "ovirt-app-portal");
+
+    @Inject
+    VeeamControlService veeamControlService;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat,
+                       VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE + "/oauth/token")) {
+            handleToken(req, resp, outFormat, io);
+            return;
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleToken(HttpServletRequest req, HttpServletResponse resp,
+                               Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+
+        if (!"POST".equalsIgnoreCase(req.getMethod())) {
+            resp.setHeader("Allow", "POST");
+            io.getWriter().write(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED,
+                    Map.of("error", "method_not_allowed",
+                            "message", "token endpoint requires POST"), outFormat);
+            return;
+        }
+
+        final String grantType = trimToNull(req.getParameter("grant_type"));
+        final String scope = trimToNull(req.getParameter("scope"));
+        final String username = trimToNull(req.getParameter("username"));
+        final String password = trimToNull(req.getParameter("password"));
+
+        if (grantType == null) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "invalid_request",
+                            "error_description", "Missing parameter: grant_type"), outFormat);
+            return;
+        }
+        if (!"password".equals(grantType)) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "unsupported_grant_type",
+                            "error_description", "Only grant_type=password is supported"), outFormat);
+            return;
+        }
+        if (username == null || password == null) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "invalid_request",
+                            "error_description", "Missing username/password"), outFormat);
+            return;
+        }
+
+        if (!veeamControlService.validateCredentials(username, password)) {
+            io.getWriter().write(resp, HttpServletResponse.SC_UNAUTHORIZED,
+                    Map.of("error", "invalid_grant",
+                            "error_description", "Invalid credentials"), outFormat);
+            return;
+        }
+
+        final String effectiveScope = (scope == null) ? StringUtils.join(REQUIRED_SCOPES, " ") : scope;
+
+        final long ttl = DEFAULT_TTL_SECONDS;
+        long nowMillis = Instant.now().toEpochMilli();
+        long expMillis = nowMillis + ttl * 1000L;
+        final String token;
+        try {
+            token = JwtUtil.issueHs256Jwt(username, effectiveScope, ttl, veeamControlService.getHmacSecret());
+        } catch (Exception e) {
+            io.getWriter().write(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
+                    Map.of("error", "server_error",
+                            "error_description", "Failed to issue token"), outFormat);
+            return;
+        }
+
+        final Map<String, Object> payload = new HashMap<>();
+        payload.put("access_token", token);
+        payload.put("token_type", "bearer");
+        payload.put("expires_in", ttl);
+        payload.put("exp", expMillis);
+        payload.put("scope", effectiveScope);
+
+        io.getWriter().write(resp, HttpServletResponse.SC_OK, payload, outFormat);
+    }
+
+    private static String trimToNull(String s) {
+        if (s == null) return null;
+        s = s.trim();
+        return s.isEmpty() ? null : s;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java
new file mode 100644
index 000000000000..d1e76f766da9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java
@@ -0,0 +1,156 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.net.NetUtils;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+
+public final class CloudConfigUtil {
+
+    private static final String NETWORK_CONFIG_PATH = "network_config.yml";
+    private static final ObjectMapper YAML_MAPPER = new ObjectMapper(new YAMLFactory());
+
+    private CloudConfigUtil() {
+    }
+
+    public static Optional<String> extractIpv4Address(String userData) {
+        if (userData == null || userData.isBlank()) {
+            return Optional.empty();
+        }
+
+        String normalizedUserData = normalize(userData);
+
+        Map<String, Object> cloudConfig = parseYamlMap(normalizedUserData);
+        if (cloudConfig == null) {
+            return Optional.empty();
+        }
+
+        Object writeFilesObj = cloudConfig.get("write_files");
+        if (!(writeFilesObj instanceof List)) {
+            return Optional.empty();
+        }
+        List<?> writeFiles = (List<?>) writeFilesObj;
+
+        for (Object item : writeFiles) {
+            if (!(item instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> fileEntry = (Map<?, ?>) item;
+
+            Object pathObj = fileEntry.get("path");
+            Object contentObj = fileEntry.get("content");
+            String configPath = String.valueOf(pathObj);
+
+            if (StringUtils.isBlank(configPath) || !configPath.endsWith(NETWORK_CONFIG_PATH)) {
+                continue;
+            }
+
+            if (contentObj == null) {
+                return Optional.empty();
+            }
+
+            return extractIpv4FromNetworkConfig(String.valueOf(contentObj));
+        }
+
+        return Optional.empty();
+    }
+
+    private static Optional<String> extractIpv4FromNetworkConfig(String networkConfigYaml) {
+        Map<String, Object> networkConfig = parseYamlMap(networkConfigYaml);
+        if (networkConfig == null) {
+            return Optional.empty();
+        }
+
+        Object interfacesObj = networkConfig.get("interfaces");
+        if (!(interfacesObj instanceof List)) {
+            return Optional.empty();
+        }
+        List<?> interfaces = (List<?>) interfacesObj;
+
+        for (Object item : interfaces) {
+            if (!(item instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> iface = (Map<?, ?>) item;
+
+            Object ipv4Obj = iface.get("ipv4");
+            if (!(ipv4Obj instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> ipv4 = (Map<?, ?>) ipv4Obj;
+
+            Object enabledObj = ipv4.get("enabled");
+            if (Boolean.FALSE.equals(enabledObj)) {
+                continue;
+            }
+
+            Object dhcpObj = ipv4.get("dhcp");
+            if (Boolean.TRUE.equals(dhcpObj)) {
+                continue;
+            }
+
+            Object addressObj = ipv4.get("address");
+            if (!(addressObj instanceof List)) {
+                continue;
+            }
+            List<?> addresses = (List<?>) addressObj;
+
+            for (Object addressItem : addresses) {
+                if (!(addressItem instanceof Map)) {
+                    continue;
+                }
+                Map<?, ?> address = (Map<?, ?>) addressItem;
+
+                Object ipObj = address.get("ip");
+                if (ipObj != null && NetUtils.isIpv4(String.valueOf(ipObj))) {
+                    return Optional.of(String.valueOf(ipObj));
+                }
+            }
+        }
+
+        return Optional.empty();
+    }
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, Object> parseYamlMap(String yamlContent) {
+        try {
+            Object parsed = YAML_MAPPER.readValue(yamlContent, Object.class);
+            if (parsed instanceof Map) {
+                return (Map<String, Object>) parsed;
+            }
+        } catch (Exception ignored) {
+            // Invalid or unsupported YAML
+        }
+        return null;
+    }
+
+    private static String normalize(String data) {
+        return data
+                .replace("\\r\\n", "\n")
+                .replace("\\n", "\n")
+                .replace("\r\n", "\n")
+                .replace("\r", "\n");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java
new file mode 100644
index 000000000000..9e0eef768d03
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+public class DataUtil {
+
+    public static String b64Url(byte[] in) {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(in);
+    }
+
+    public static String jsonEscape(String s) {
+        return s == null ? "" : s.replace("\\", "\\\\").replace("\"", "\\\"");
+    }
+
+    public static boolean constantTimeEquals(String a, String b) {
+        if (a == null || b == null) return false;
+        return constantTimeEquals(a.getBytes(StandardCharsets.UTF_8), b.getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static boolean constantTimeEquals(byte[] x, byte[] y) {
+        if (x.length != y.length) return false;
+        int r = 0;
+        for (int i = 0; i < x.length; i++) r |= x[i] ^ y[i];
+        return r == 0;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java
new file mode 100644
index 000000000000..a12b4d4e0da7
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+import com.google.gson.JsonObject;
+
+public class JwtUtil {
+    public static final String ALGORITHM = "HmacSHA256";
+    public static final String ISSUER = "veeam-control";
+
+    public static String issueHs256Jwt(String subject, String scope, long ttlSeconds, String secret) throws Exception {
+        long now = Instant.now().getEpochSecond();
+        long exp = now + ttlSeconds;
+
+        JsonObject headerObject = new JsonObject();
+        headerObject.addProperty("alg", "HS256");
+        headerObject.addProperty("typ", "JWT");
+        String headerJson = headerObject.toString();
+        JsonObject payloadObject = new JsonObject();
+        payloadObject.addProperty("iss", ISSUER);
+        payloadObject.addProperty("sub", subject);
+        payloadObject.addProperty("scope", scope);
+        payloadObject.addProperty("iat", now);
+        payloadObject.addProperty("exp", exp);
+        String payloadJson = payloadObject.toString();
+
+        String header = DataUtil.b64Url(headerJson.getBytes(StandardCharsets.UTF_8));
+        String payload = DataUtil.b64Url(payloadJson.getBytes(StandardCharsets.UTF_8));
+        String signingInput = header + "." + payload;
+
+        byte[] sig = hmacSha256(signingInput.getBytes(StandardCharsets.UTF_8), secret.getBytes(StandardCharsets.UTF_8));
+        return signingInput + "." + DataUtil.b64Url(sig);
+    }
+
+    public static byte[] hmacSha256(byte[] data, byte[] key) throws Exception {
+        final Mac mac = Mac.getInstance(ALGORITHM);
+        mac.init(new SecretKeySpec(key, ALGORITHM));
+        return mac.doFinal(data);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java
new file mode 100644
index 000000000000..933e57b202a3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.dataformat.xml.XmlMapper;
+
+public class Mapper {
+    private final ObjectMapper json;
+    private final XmlMapper xml;
+
+    public Mapper() {
+        this.json = new ObjectMapper();
+        this.xml = new XmlMapper();
+
+        configure(json);
+        configure(xml);
+    }
+
+    private static void configure(final ObjectMapper mapper) {
+        mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
+        mapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
+        mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+        // If you ever add enums etc:
+        // mapper.enable(SerializationFeature.WRITE_ENUMS_USING_TO_STRING);
+        // mapper.enable(DeserializationFeature.READ_ENUMS_USING_TO_STRING);
+    }
+
+    public String toJson(final Object value) throws JsonProcessingException {
+        return json.writeValueAsString(value);
+    }
+
+    public String toXml(final Object value) throws JsonProcessingException {
+        return xml.writeValueAsString(value);
+    }
+
+    public ObjectMapper jsonMapper() {
+        return json;
+    }
+
+    public XmlMapper xmlMapper() {
+        return xml;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java
new file mode 100644
index 000000000000..1c82216f113b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+
+import javax.servlet.http.HttpServletRequest;
+
+public final class Negotiation {
+
+    public enum OutFormat { XML, JSON }
+
+    public static OutFormat responseFormat(HttpServletRequest req) {
+        String accept = req.getHeader("Accept");
+        if (accept == null || accept.isBlank() || accept.contains("*/*")) {
+            return OutFormat.XML;
+        }
+        accept = accept.toLowerCase();
+        if (accept.contains("application/json")) return OutFormat.JSON;
+        if (accept.contains("application/xml") || accept.contains("text/xml")) {
+            return OutFormat.XML;
+        }
+        return OutFormat.XML;
+    }
+
+    public static String contentType(OutFormat fmt) {
+        return fmt == OutFormat.JSON
+                ? "application/json"
+                : "application/xml";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java
new file mode 100644
index 000000000000..5cf558cdd778
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.UuidUtils;
+
+public class PathUtil {
+    private static final boolean CONSIDER_ONLY_UUID_AS_ID = false;
+
+    public static List<String> extractIdAndSubPath(final String path, final String baseRoute) {
+
+        if (StringUtils.isBlank(path)) {
+            return null;
+        }
+
+        // Remove base route (be tolerant of trailing slash in baseRoute)
+        String rest = path;
+        if (StringUtils.isNotBlank(baseRoute)) {
+            String normalizedBase = baseRoute.endsWith("/") && baseRoute.length() > 1
+                    ? baseRoute.substring(0, baseRoute.length() - 1)
+                    : baseRoute;
+            if (rest.startsWith(normalizedBase)) {
+                rest = rest.substring(normalizedBase.length());
+            }
+        }
+
+        // Expect "/{id}" or "/{id}/..." (no empty segments)
+        if (StringUtils.isBlank(rest) || !rest.startsWith("/")) {
+            return null; // /api/datacenters (no id) or invalid format
+        }
+
+        rest = rest.substring(1); // remove leading '/'
+
+        if (StringUtils.isBlank(rest)) {
+            return null;
+        }
+
+        final String[] parts = rest.split("/", -1);
+
+        // Collect non-blank segments
+        List<String> validParts = new ArrayList<>();
+        for (String part : parts) {
+            if (StringUtils.isNotBlank(part)) {
+                validParts.add(part);
+            }
+        }
+
+        // Validate first segment, check if it is a UUID if enabled
+        if (validParts.isEmpty() || (CONSIDER_ONLY_UUID_AS_ID && !UuidUtils.isUuid(validParts.get(0)))) {
+            return null;
+        }
+
+        return validParts;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java
new file mode 100644
index 000000000000..63e3c98aa7f0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.dto.Fault;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public final class ResponseWriter {
+    private static final Logger LOGGER = LogManager.getLogger(ResponseWriter.class);
+
+    private final Mapper mapper;
+
+    public ResponseWriter(final Mapper mapper) {
+        this.mapper = mapper;
+    }
+
+    public void write(final HttpServletResponse resp, final int status, final Object body, final Negotiation.OutFormat fmt)
+            throws IOException {
+
+        resp.setStatus(status);
+
+        if (body == null) {
+            resp.setContentLength(0);
+            return;
+        }
+
+        final String payload;
+        final String contentType;
+
+        try {
+            if (fmt == Negotiation.OutFormat.XML) {
+                contentType = "application/xml";
+                payload = mapper.toXml(body);
+            } else {
+                contentType = "application/json";
+                payload = mapper.toJson(body);
+            }
+        } catch (Exception e) {
+            // Last-resort fallback
+            resp.setStatus(500);
+            resp.setHeader("Content-Type", "text/plain");
+            resp.getWriter().write("Internal Server Error");
+            return;
+        }
+
+        if (VeeamControlService.DeveloperLogs.value()) {
+            LOGGER.debug("Writing response: status={}, contentType={}, payloadLength={}\n{}",
+                    status, contentType, payload.length(), payload);
+        }
+
+        resp.setCharacterEncoding(StandardCharsets.UTF_8.name());
+        resp.setHeader("Content-Type", contentType);
+        resp.getWriter().write(payload);
+    }
+
+    public void writeFault(final HttpServletResponse resp, final int status, final String reason, final String detail, final Negotiation.OutFormat fmt)
+            throws IOException {
+        Fault fault = new Fault(reason, detail);
+        if (fmt == Negotiation.OutFormat.XML) {
+            write(resp, status, fault, fmt);
+        } else {
+            write(resp, status, fault, fmt);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties
new file mode 100644
index 000000000000..453e40dee69d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties
@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+name=veeam-control-service
+parent=backup
diff --git a/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml
new file mode 100644
index 000000000000..83d100ec76e8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml
@@ -0,0 +1,66 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements. See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership. The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied. See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:aop="http://www.springframework.org/schema/aop"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans
+                      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+                      http://www.springframework.org/schema/aop
+                      http://www.springframework.org/schema/aop/spring-aop.xsd"
+>
+
+    <bean id="routeHandlerRegistry"
+          class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
+    </bean>
+
+    <bean class="org.apache.cloudstack.spring.lifecycle.registry.RegistryLifecycle">
+        <property name="registry" ref="routeHandlerRegistry" />
+        <property name="typeClass" value="org.apache.cloudstack.veeam.RouteHandler" />
+    </bean>
+
+    <bean id="veeamControlSsoService" class="org.apache.cloudstack.veeam.sso.SsoService"/>
+    <bean id="pkiResourceRouteHandler" class="org.apache.cloudstack.veeam.services.PkiResourceRouteHandler"/>
+    <bean id="apiRouteHandler" class="org.apache.cloudstack.veeam.api.ApiRouteHandler" />
+    <bean id="dataCentersRouteHandler" class="org.apache.cloudstack.veeam.api.DataCentersRouteHandler"/>
+    <bean id="clustersRouteHandler" class="org.apache.cloudstack.veeam.api.ClustersRouteHandler"/>
+    <bean id="hostsRouteHandler" class="org.apache.cloudstack.veeam.api.HostsRouteHandler"/>
+    <bean id="networksRouteHandler" class="org.apache.cloudstack.veeam.api.NetworksRouteHandler"/>
+    <bean id="vnicProfilesRouteHandler" class="org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler"/>
+    <bean id="vmsRouteHandler" class="org.apache.cloudstack.veeam.api.VmsRouteHandler"/>
+    <bean id="disksRouteHandler" class="org.apache.cloudstack.veeam.api.DisksRouteHandler"/>
+    <bean id="imageTransfersRouteHandler" class="org.apache.cloudstack.veeam.api.ImageTransfersRouteHandler"/>
+    <bean id="jobsRouteHandler" class="org.apache.cloudstack.veeam.api.JobsRouteHandler"/>
+    <bean id="tagsRouteHandler" class="org.apache.cloudstack.veeam.api.TagsRouteHandler"/>
+
+    <bean id="veeamControlService" class="org.apache.cloudstack.veeam.VeeamControlServiceImpl" >
+        <property name="routeHandlers" value="#{routeHandlerRegistry.registered}" />
+    </bean>
+
+    <bean id="serverAdapter" class="org.apache.cloudstack.veeam.adapter.ServerAdapter"/>
+    <bean id="apiAccessInterceptor" class="org.apache.cloudstack.veeam.adapter.ApiAccessInterceptor"/>
+
+    <!--
+      AOP
+    -->
+    <aop:config proxy-target-class="true">
+        <aop:advisor advice-ref="apiAccessInterceptor"
+                     pointcut="execution(public * org.apache.cloudstack.veeam.adapter.ServerAdapter.*(..)) &amp;&amp; @annotation(org.apache.cloudstack.veeam.adapter.ApiAccess)" />
+    </aop:config>
+
+</beans>
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java
new file mode 100644
index 000000000000..6fe382873223
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java
@@ -0,0 +1,227 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ConfigKey.Scope;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+import org.apache.cloudstack.utils.server.ServerPropertiesUtil;
+import org.eclipse.jetty.server.Server;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+public class VeeamControlServerTest {
+
+    private static final String KEY_ENABLED = "integration.veeam.control.enabled";
+    private static final String KEY_PORT = "integration.veeam.control.port";
+    private static final String KEY_CONTEXT_PATH = "integration.veeam.control.context.path";
+    private static final String KEY_DEVELOPER_LOGS = "integration.veeam.control.developer.logs";
+
+    private ConfigDepotImpl previousDepot;
+    private Properties previousServerProperties;
+    private final Map<String, String> globalValues = new HashMap<>();
+
+    @Before
+    public void setUp() throws Exception {
+        previousDepot = getConfigDepot();
+        final ConfigDepotImpl depot = mock(ConfigDepotImpl.class);
+        when(depot.getConfigStringValue(Mockito.anyString(), Mockito.any(), Mockito.any())).thenAnswer(invocation -> {
+            final String key = invocation.getArgument(0);
+            final Scope scope = invocation.getArgument(1);
+            if (scope == Scope.Global) {
+                return globalValues.get(key);
+            }
+            return null;
+        });
+        setConfigDepot(depot);
+
+        previousServerProperties = getServerProperties();
+        Properties props = new Properties();
+        props.setProperty("https.keystore", "");
+        props.setProperty("https.keystore.password", "");
+        setServerProperties(props);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        setConfigDepot(previousDepot);
+        setServerProperties(previousServerProperties);
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.ContextPath);
+        resetConfigKeyCache(VeeamControlService.DeveloperLogs);
+    }
+
+    @Test
+    public void testConstructorSortsHandlersByPriorityDescending() throws Exception {
+        final RouteHandler low = mock(RouteHandler.class);
+        final RouteHandler high = mock(RouteHandler.class);
+        when(low.priority()).thenReturn(1);
+        when(high.priority()).thenReturn(10);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(low, high), mock(VeeamControlService.class));
+        final List<RouteHandler> handlers = getRouteHandlers(server);
+
+        assertEquals(high, handlers.get(0));
+        assertEquals(low, handlers.get(1));
+    }
+
+    @Test
+    public void testStartIfEnabledReturnsWithoutStartingWhenDisabled() throws Exception {
+        globalValues.put(KEY_ENABLED, "false");
+        resetConfigKeyCache(VeeamControlService.Enabled);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(), mock(VeeamControlService.class));
+        server.startIfEnabled();
+
+        assertNull(getJettyServer(server));
+    }
+
+    @Test
+    public void testStartIfEnabledStartsHttpServerWhenEnabled() throws Exception {
+        globalValues.put(KEY_ENABLED, "true");
+        globalValues.put(KEY_PORT, "0");
+        globalValues.put(KEY_CONTEXT_PATH, "/ovirt-engine");
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.ContextPath);
+
+        final VeeamControlService service = mock(VeeamControlService.class);
+        when(service.getCurrentManagementServerHostId()).thenReturn(1L);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(), service);
+        try {
+            server.startIfEnabled();
+            final Server jetty = getJettyServer(server);
+            assertNotNull(jetty);
+            assertTrue(jetty.isStarted());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    public void testStopStopsExistingJettyServerAndClearsReference() throws Exception {
+        final VeeamControlServer server = new VeeamControlServer(List.of(), mock(VeeamControlService.class));
+        final Server jetty = mock(Server.class);
+        setJettyServer(server, jetty);
+
+        server.stop();
+
+        verify(jetty).stop();
+        assertNull(getJettyServer(server));
+    }
+
+    @Test
+    public void testGetRequestResponseMetadataIncludesHeadersWhenDeveloperLogsEnabled() throws Exception {
+        globalValues.put(KEY_DEVELOPER_LOGS, "true");
+        resetConfigKeyCache(VeeamControlService.DeveloperLogs);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api");
+        request.setRemoteAddr("127.0.0.1");
+        request.setQueryString("x=1");
+        request.addHeader("X-Test", "abc");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        response.setStatus(202);
+
+        final Method metadataMethod = VeeamControlServer.class.getDeclaredMethod("getRequestResponseMetadata",
+                HttpServletRequest.class, HttpServletResponse.class);
+        metadataMethod.setAccessible(true);
+        final String metadata = (String) metadataMethod.invoke(null, request, response);
+
+        assertTrue(metadata.contains("remote address: 127.0.0.1"));
+        assertTrue(metadata.contains("uri: /api?x=1"));
+        assertTrue(metadata.contains("headers: [X-Test=abc;"));
+        assertTrue(metadata.contains("status: 202"));
+    }
+
+    @SuppressWarnings("unchecked")
+    private static List<RouteHandler> getRouteHandlers(final VeeamControlServer server) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("routeHandlers");
+        field.setAccessible(true);
+        return (List<RouteHandler>) field.get(server);
+    }
+
+    private static Server getJettyServer(final VeeamControlServer server) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("server");
+        field.setAccessible(true);
+        return (Server) field.get(server);
+    }
+
+    private static void setJettyServer(final VeeamControlServer server, final Server jetty) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("server");
+        field.setAccessible(true);
+        field.set(server, jetty);
+    }
+
+    private static ConfigDepotImpl getConfigDepot() throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        return (ConfigDepotImpl) field.get(null);
+    }
+
+    private static void setConfigDepot(final ConfigDepotImpl depot) throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        field.set(null, depot);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static Properties getServerProperties() throws Exception {
+        final Field field = ServerPropertiesUtil.class.getDeclaredField("propertiesRef");
+        field.setAccessible(true);
+        final AtomicReference<Properties> ref = (AtomicReference<Properties>) field.get(null);
+        return ref.get();
+    }
+
+    @SuppressWarnings("unchecked")
+    private static void setServerProperties(final Properties properties) throws Exception {
+        final Field field = ServerPropertiesUtil.class.getDeclaredField("propertiesRef");
+        field.setAccessible(true);
+        final AtomicReference<Properties> ref = (AtomicReference<Properties>) field.get(null);
+        ref.set(properties);
+    }
+
+    private static void resetConfigKeyCache(final ConfigKey<?> configKey) throws Exception {
+        final Field valueField = ConfigKey.class.getDeclaredField("_value");
+        valueField.setAccessible(true);
+        valueField.set(configKey, null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java
new file mode 100644
index 000000000000..a4dd970c9cfb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java
@@ -0,0 +1,185 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ConfigKey.Scope;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.utils.UuidUtils;
+
+@RunWith(MockitoJUnitRunner.class)
+public class VeeamControlServiceImplTest {
+
+    private static final String KEY_ENABLED = "integration.veeam.control.enabled";
+    private static final String KEY_PORT = "integration.veeam.control.port";
+    private static final String KEY_USERNAME = "integration.veeam.control.api.username";
+    private static final String KEY_PASSWORD = "integration.veeam.control.api.password";
+    private static final String KEY_ALLOWED_CIDRS = "integration.veeam.control.allowed.client.cidrs";
+
+    private ConfigDepotImpl previousDepot;
+    private final Map<String, String> globalValues = new HashMap<>();
+
+    @Before
+    public void setUp() throws Exception {
+        previousDepot = getConfigDepot();
+        final ConfigDepotImpl depot = mock(ConfigDepotImpl.class);
+        when(depot.getConfigStringValue(Mockito.anyString(), Mockito.any(), Mockito.any())).thenAnswer(invocation -> {
+            final String key = invocation.getArgument(0);
+            final Scope scope = invocation.getArgument(1);
+            if (scope == Scope.Global) {
+                return globalValues.get(key);
+            }
+            return null;
+        });
+        setConfigDepot(depot);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        setConfigDepot(previousDepot);
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+    }
+
+    @Test
+    public void testParseImageTransfer() {
+        String data = "{\"active\":false,\"direction\":\"upload\",\"format\":\"cow\",\"inactivity_timeout\":3600,\"phase\":\"cancelled\",\"shallow\":false,\"transferred\":0,\"link\":[],\"disk\":{\"id\":\"dba4d72d-01de-4267-aa8e-305996b53599\"},\"image\":{},\"backup\":{\"creation_date\":0}}";
+        Mapper mapper = new Mapper();
+        try {
+            mapper.jsonMapper().readValue(data, ImageTransfer.class);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Test
+    public void testGetAllowedClientCidrsInternalSanitizesAndFiltersInvalidEntries() throws Exception {
+        globalValues.put(KEY_ALLOWED_CIDRS, " 10.0.0.0/24,invalid-cidr, ,192.168.1.100/32 ");
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        final List<String> cidrs = service.getAllowedClientCidrsInternal();
+
+        assertEquals(List.of("10.0.0.0/24", "192.168.1.100/32"), cidrs);
+    }
+
+    @Test
+    public void testGetAllowedClientCidrsInternalReturnsEmptyListForBlankValue() throws Exception {
+        globalValues.put(KEY_ALLOWED_CIDRS, "   ");
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        assertTrue(service.getAllowedClientCidrsInternal().isEmpty());
+    }
+
+    @Test
+    public void testValidateCredentials() throws Exception {
+        globalValues.put(KEY_USERNAME, "veeam-user");
+        globalValues.put(KEY_PASSWORD, "veeam-pass");
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        assertTrue(service.validateCredentials("veeam-user", "veeam-pass"));
+        assertFalse(service.validateCredentials("veeam-user", "wrong"));
+        assertFalse(service.validateCredentials("wrong", "veeam-pass"));
+    }
+
+    @Test
+    public void testGetInstanceIdReturnsSystemAccountUuid() {
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+        final AccountService accountService = mock(AccountService.class);
+        final Account account = mock(Account.class);
+        service.accountService = accountService;
+        when(accountService.getSystemAccount()).thenReturn(account);
+        when(account.getUuid()).thenReturn("system-account-uuid");
+
+        assertEquals("system-account-uuid", service.getInstanceId());
+    }
+
+    @Test
+    public void testGetHmacSecretUsesConfiguredInputs() throws Exception {
+        globalValues.put(KEY_PORT, "8095");
+        globalValues.put(KEY_USERNAME, "api-user");
+        globalValues.put(KEY_PASSWORD, "api-pass");
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+
+        final VeeamControlServiceImpl service = Mockito.spy(new VeeamControlServiceImpl());
+        Mockito.doReturn("instance-uuid").when(service).getInstanceId();
+
+        final String expected = UuidUtils.nameUUIDFromBytes(
+                "instance-uuid:8095:api-userapi-pass".getBytes(StandardCharsets.UTF_8)).toString();
+        assertEquals(expected, service.getHmacSecret());
+    }
+
+    @Test
+    public void testGetConfigKeysContainsExpectedEntries() {
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        final ConfigKey<?>[] keys = service.getConfigKeys();
+
+        assertEquals(11, keys.length);
+        assertEquals(KEY_ENABLED, keys[0].key());
+    }
+
+    private static ConfigDepotImpl getConfigDepot() throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        return (ConfigDepotImpl) field.get(null);
+    }
+
+    private static void setConfigDepot(final ConfigDepotImpl depot) throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        field.set(null, depot);
+    }
+
+    private static void resetConfigKeyCache(final ConfigKey<?> configKey) throws Exception {
+        final Field valueField = ConfigKey.class.getDeclaredField("_value");
+        valueField.setAccessible(true);
+        valueField.set(configKey, null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java
new file mode 100644
index 000000000000..c788613e52cf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+public class VeeamControlServletTest {
+
+    @Test
+    public void testServiceHandlesRootRequestForGet() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final HttpServletRequest request = new MockHttpServletRequest("GET", "/");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.service(request, response);
+
+        assertEquals(200, response.getStatus());
+        assertTrue(response.getContentAsString().contains("CloudStack Veeam Control Service"));
+    }
+
+    @Test
+    public void testServiceReturnsBadRequestForUnsupportedRootMethod() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final HttpServletRequest request = new MockHttpServletRequest("PUT", "/");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.service(request, response);
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Unsupported method for root"));
+    }
+
+    @Test
+    public void testServiceDelegatesToMatchingRouteHandler() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/path";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final HttpServletRequest request = new MockHttpServletRequest("GET", path);
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(true);
+
+        servlet.service(request, response);
+
+        verify(handler).handle(request, response, path, Negotiation.OutFormat.XML, servlet);
+    }
+
+    @Test
+    public void testServiceReturnsNotFoundWhenNoHandlerMatches() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/path";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", path);
+        request.setPathInfo(path);
+        request.addHeader("Accept", "application/json");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(false);
+
+        servlet.service(request, response);
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+        verify(handler).canHandle("GET", path);
+    }
+
+    @Test
+    public void testServiceConvertsHandlerErrorToFaultResponse() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/faultpath";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final HttpServletRequest request = new MockHttpServletRequest("GET", path);
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(true);
+        doThrow(VeeamControlServlet.Error.unauthorized("denied")).when(handler)
+                .handle(request, response, path, Negotiation.OutFormat.XML, servlet);
+
+        servlet.service(request, response);
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("denied"));
+    }
+
+    @Test
+    public void testMethodNotAllowedWritesAllowHeaderAndFault() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.methodNotAllowed(response, "GET, POST", Negotiation.OutFormat.JSON);
+
+        assertEquals(405, response.getStatus());
+        assertEquals("GET, POST", response.getHeader("Allow"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java
new file mode 100644
index 000000000000..16fafb9034bd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertSame;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Method;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
+import org.apache.cloudstack.context.CallContext;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+
+public class ApiAccessInterceptorTest {
+
+    private static final long BASE_USER_ID = 100L;
+    private static final long BASE_ACCOUNT_ID = 200L;
+    private static final long SERVICE_USER_ID = 300L;
+    private static final long SERVICE_ACCOUNT_ID = 400L;
+
+    private final ApiAccessInterceptor interceptor = new ApiAccessInterceptor();
+    private final AccountManager accountManager = mock(AccountManager.class);
+
+    @Before
+    public void setUp() {
+        interceptor.accountManager = accountManager;
+        CallContext.unregisterAll();
+    }
+
+    @After
+    public void tearDown() {
+        CallContext.unregisterAll();
+    }
+
+    @Test
+    public void testInvokePassesThroughWhenTargetIsNull() throws Throwable {
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(null);
+        when(invocation.proceed()).thenReturn("ok");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("ok", result);
+        verify(invocation).proceed();
+        verifyNoInteractions(accountManager);
+    }
+
+    @Test
+    public void testInvokePassesThroughWhenMethodHasNoApiAccessAnnotation() throws Throwable {
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("noApiAccess"));
+        when(invocation.proceed()).thenReturn("done");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("done", result);
+        verify(invocation).proceed();
+        verifyNoInteractions(accountManager);
+    }
+
+    @Test
+    public void testInvokeChecksApiAccessForDirectlyAnnotatedMethodAndRestoresCallContext() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("classAnnotated"));
+        when(invocation.proceed()).thenAnswer(i -> {
+            assertEquals(SERVICE_USER_ID, CallContext.current().getCallingUserId());
+            assertEquals(SERVICE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+            return "secured";
+        });
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("secured", result);
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    @Test
+    public void testInvokeFindsAnnotationOnImplementationWhenInterfaceMethodIsUnannotated() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final Method interfaceMethod = ApiContract.class.getMethod("implAnnotatedThroughInterface");
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(interfaceMethod);
+        when(invocation.proceed()).thenReturn("ok");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("ok", result);
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    @Test
+    public void testInvokeUnregistersServiceContextWhenProceedThrows() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        final RuntimeException expected = new RuntimeException("boom");
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("classAnnotated"));
+        when(invocation.proceed()).thenThrow(expected);
+
+        try {
+            interceptor.invoke(invocation);
+        } catch (RuntimeException e) {
+            assertSame(expected, e);
+        }
+
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    private static void registerBaseContext() {
+        final User baseUser = mock(User.class);
+        final Account baseAccount = mock(Account.class);
+        when(baseUser.getId()).thenReturn(BASE_USER_ID);
+        when(baseAccount.getId()).thenReturn(BASE_ACCOUNT_ID);
+        CallContext.register(baseUser, baseAccount);
+    }
+
+    private static Pair<User, Account> serviceUserAccount() {
+        final User serviceUser = mock(User.class);
+        final Account serviceAccount = mock(Account.class);
+        when(serviceUser.getId()).thenReturn(SERVICE_USER_ID);
+        when(serviceAccount.getId()).thenReturn(SERVICE_ACCOUNT_ID);
+        return new Pair<>(serviceUser, serviceAccount);
+    }
+
+    private interface ApiContract {
+        String implAnnotatedThroughInterface();
+    }
+
+    private static class TestServerAdapter extends ServerAdapter implements ApiContract {
+        private final Pair<User, Account> serviceAccount;
+
+        private TestServerAdapter(final Pair<User, Account> serviceAccount) {
+            this.serviceAccount = serviceAccount;
+        }
+
+        @Override
+        public Pair<User, Account> getServiceAccount() {
+            return serviceAccount;
+        }
+
+        @ApiAccess(command = ListZonesCmd.class)
+        public String classAnnotated() {
+            return "classAnnotated";
+        }
+
+        @Override
+        @ApiAccess(command = ListZonesCmd.class)
+        public String implAnnotatedThroughInterface() {
+            return "implAnnotatedThroughInterface";
+        }
+
+        public String noApiAccess() {
+            return "noApiAccess";
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
new file mode 100644
index 000000000000..f3f1f45584f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
@@ -0,0 +1,1140 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.jobs.dao.AsyncJobDao;
+import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.logging.log4j.Logger;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.api.query.dao.AsyncJobJoinDao;
+import com.cloud.api.query.dao.DataCenterJoinDao;
+import com.cloud.api.query.dao.HostJoinDao;
+import com.cloud.api.query.dao.StoragePoolJoinDao;
+import com.cloud.api.query.dao.UserVmJoinDao;
+import com.cloud.api.query.dao.VolumeJoinDao;
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.domain.dao.DomainDao;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.projects.Project;
+import com.cloud.projects.ProjectManager;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class ServerAdapterTest {
+
+    @InjectMocks
+    ServerAdapter serverAdapter;
+
+    @Mock AccountService accountService;
+    @Mock DataCenterDao dataCenterDao;
+    @Mock DataCenterJoinDao dataCenterJoinDao;
+    @Mock StoragePoolJoinDao storagePoolJoinDao;
+    @Mock ClusterDao clusterDao;
+    @Mock HostJoinDao hostJoinDao;
+    @Mock NetworkDao networkDao;
+    @Mock UserVmDao userVmDao;
+    @Mock UserVmJoinDao userVmJoinDao;
+    @Mock VMInstanceDetailsDao vmInstanceDetailsDao;
+    @Mock VolumeDao volumeDao;
+    @Mock VolumeJoinDao volumeJoinDao;
+    // kept minimal: only mocks used directly by tests
+    @Mock com.cloud.storage.VolumeApiService volumeApiService;
+    @Mock PrimaryDataStoreDao primaryDataStoreDao;
+    @Mock ImageTransferDao imageTransferDao;
+    @Mock ServiceOfferingDao serviceOfferingDao;
+    @Mock VMTemplateDao templateDao;
+    @Mock UserVmManager userVmManager;
+    @Mock NicDao nicDao;
+    @Mock AsyncJobDao asyncJobDao;
+    @Mock AsyncJobJoinDao asyncJobJoinDao;
+    @Mock VMSnapshotDao vmSnapshotDao;
+    @Mock BackupDao backupDao;
+    @Mock NetworkModel networkModel;
+    @Mock ProjectManager projectManager;
+    @Mock DomainDao domainDao;
+    @Mock
+    KVMBackupExportService kvmBackupExportService;
+
+    @Before
+    public void setupCallContext() {
+        CallContext.register(Mockito.mock(User.class), Mockito.mock(Account.class));
+    }
+
+    @After
+    public void cleanupCallContext() {
+        CallContext.unregister();
+    }
+
+
+
+    @Test
+    public void testGetProvisionedSizeInGb_ExactlyOneGB() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(1L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(gb)));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_MultipleGB() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(5L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(5 * gb)));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_LessThanOneGB_RoundsUpToOne() {
+        assertEquals(1L, ServerAdapter.getProvisionedSizeInGb("512"));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_NotExactGB_RoundsUp() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(2L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(gb + gb / 2)));
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_InvalidString_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("not-a-number");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_Zero_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("0");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_Negative_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("-1073741824");
+    }
+
+
+    @Test
+    public void testGetDetailsForInstanceCreation_WorkerVm_AddsCpuMode() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(true);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertEquals("host-passthrough", result.get(VmDetailConstants.GUEST_CPU_MODE));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_NotWorkerVm_NoCpuMode() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertFalse(result.containsKey(VmDetailConstants.GUEST_CPU_MODE));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_CustomizedOffering_AddsDetails() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(4);
+        when(offering.getRamSize()).thenReturn(2048);
+        when(offering.getSpeed()).thenReturn(null);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertEquals("4", result.get(VmDetailConstants.CPU_NUMBER));
+        assertEquals("2048", result.get(VmDetailConstants.MEMORY));
+        assertEquals("1000", result.get(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_CustomizedOffering_WithSpeed_DoesNotAddDefaultCpuSpeed() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        when(offering.getSpeed()).thenReturn(2000);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertFalse(result.containsKey(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_SkipsBiosAndUefiKeys() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> existingDetails = new HashMap<>();
+        existingDetails.put("BIOS", "bios_value");
+        existingDetails.put("UEFI", "uefi_value");
+        existingDetails.put("custom_key", "custom_value");
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, existingDetails);
+
+        assertFalse(result.containsKey("BIOS"));
+        assertFalse(result.containsKey("UEFI"));
+        assertEquals("custom_value", result.get("custom_key"));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_PreservesExistingCpuSpeed() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        when(offering.getSpeed()).thenReturn(null);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> existingDetails = new HashMap<>();
+        existingDetails.put(VmDetailConstants.CPU_SPEED, "3000");
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, existingDetails);
+
+        assertEquals("3000", result.get(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NullVm_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails(null, network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NullNetwork_ReturnsNullPair() {
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("config", null);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NoRestoreConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails(null, network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_BlankRestoreConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("   ", network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_BlankMacAndIpFromConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("  ", "\t"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NoConflicts_ReturnsMacAndIp() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(30L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        when(nicDao.findByNetworkIdAndMacAddress(30L, "02:00:00:00:00:01")).thenReturn(null);
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.10", 30L)).thenReturn(null);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:01", "10.0.0.10"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertEquals("02:00:00:00:00:01", result.first());
+            assertEquals("10.0.0.10", result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_MacConflictWithSameIp_ClearsBoth() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(31L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        NicVO conflictingNic = mock(NicVO.class);
+        when(conflictingNic.getIPv4Address()).thenReturn("10.0.0.11");
+        when(nicDao.findByNetworkIdAndMacAddress(31L, "02:00:00:00:00:02")).thenReturn(conflictingNic);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:02", "10.0.0.11"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_MacConflictWithDifferentIp_ClearsOnlyMac() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(32L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        NicVO conflictingNic = mock(NicVO.class);
+        when(conflictingNic.getIPv4Address()).thenReturn("10.0.0.99");
+        when(nicDao.findByNetworkIdAndMacAddress(32L, "02:00:00:00:00:03")).thenReturn(conflictingNic);
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.12", 32L)).thenReturn(null);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:03", "10.0.0.12"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertEquals("10.0.0.12", result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_IpConflict_ClearsIpAndMac() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(33L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        when(nicDao.findByNetworkIdAndMacAddress(33L, "02:00:00:00:00:04")).thenReturn(null);
+        NicVO conflictingIpNic = mock(NicVO.class);
+        when(conflictingIpNic.getIPv4Address()).thenReturn("10.0.0.13");
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.13", 33L)).thenReturn(conflictingIpNic);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:04", "10.0.0.13"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+
+    @Test
+    public void testGetDummyTags_ContainsRootTag() {
+        Map<String, Tag> tags = ServerAdapter.getDummyTags();
+        assertNotNull(tags);
+        assertFalse(tags.isEmpty());
+    }
+
+
+    @Test
+    public void testGetTemplateForInstanceCreation_NullUuid_ReturnsNull() {
+        assertNull(serverAdapter.getTemplateForInstanceCreation(null, null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_BlankUuid_ReturnsNull() {
+        assertNull(serverAdapter.getTemplateForInstanceCreation("   ", null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_TemplateNotFound_ReturnsNull() {
+        when(templateDao.findByUuid("missing-uuid")).thenReturn(null);
+        assertNull(serverAdapter.getTemplateForInstanceCreation("missing-uuid", null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_TemplateFound_ReturnsTemplate() {
+        VMTemplateVO template = mock(VMTemplateVO.class);
+        when(templateDao.findByUuid("valid-uuid")).thenReturn(template);
+        assertEquals(template, serverAdapter.getTemplateForInstanceCreation("valid-uuid", null));
+    }
+
+
+    @Test
+    public void testGetZoneById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getZoneById(null));
+    }
+
+    @Test
+    public void testGetZoneById_ReturnsVoFromDao() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.findById(1L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getZoneById(1L));
+    }
+
+    @Test
+    public void testGetHostById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getHostById(null));
+    }
+
+    @Test
+    public void testGetHostById_ReturnsVoFromDao() {
+        HostJoinVO vo = mock(HostJoinVO.class);
+        when(hostJoinDao.findById(2L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getHostById(2L));
+    }
+
+    @Test
+    public void testGetVolumeById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getVolumeById(null));
+    }
+
+    @Test
+    public void testGetVolumeById_ReturnsVoFromDao() {
+        VolumeJoinVO vo = mock(VolumeJoinVO.class);
+        when(volumeJoinDao.findById(3L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getVolumeById(3L));
+    }
+
+    @Test
+    public void testGetNetworkById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getNetworkById(null));
+    }
+
+    @Test
+    public void testGetNetworkById_ReturnsVoFromDao() {
+        NetworkVO vo = mock(NetworkVO.class);
+        when(networkDao.findById(4L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getNetworkById(4L));
+    }
+
+
+    @Test
+    public void testWaitForJobCompletion_JobNotFound_Returns() {
+        when(asyncJobDao.findByIdIncludingRemoved(99L)).thenReturn(null);
+        serverAdapter.waitForJobCompletion(99L);
+        verify(asyncJobDao).findByIdIncludingRemoved(99L);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_JobAlreadySucceeded_Returns() {
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED);
+        when(asyncJobDao.findByIdIncludingRemoved(1L)).thenReturn(job);
+        serverAdapter.waitForJobCompletion(1L);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_JobAlreadyFailed_Returns() {
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.FAILED);
+        when(asyncJobDao.findByIdIncludingRemoved(2L)).thenReturn(job);
+        serverAdapter.waitForJobCompletion(2L);
+    }
+
+
+    @Test
+    public void testWaitForJobCompletion_NullJobJoinVO_Returns() {
+        AsyncJobJoinVO job = null;
+        serverAdapter.waitForJobCompletion(job);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_CompletedJobJoinVO_DelegatesById() {
+        AsyncJobJoinVO jobVO = mock(AsyncJobJoinVO.class);
+        when(jobVO.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED.ordinal());
+        when(jobVO.getId()).thenReturn(5L);
+
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED);
+        when(asyncJobDao.findByIdIncludingRemoved(5L)).thenReturn(job);
+
+        serverAdapter.waitForJobCompletion(jobVO);
+
+        verify(asyncJobDao).findByIdIncludingRemoved(5L);
+    }
+
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_NullAccount_ReturnsAllNulls() {
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(null);
+        assertNull(result.first());
+        assertNull(result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_NormalAccount_ReturnsDomainAndName() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.NORMAL);
+        when(account.getDomainId()).thenReturn(2L);
+        when(account.getAccountName()).thenReturn("myaccount");
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertEquals(Long.valueOf(2L), result.first());
+        assertEquals("myaccount", result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_ProjectAccount_ProjectNotFound_ReturnsAllNulls() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.PROJECT);
+        when(account.getId()).thenReturn(10L);
+        when(projectManager.findByProjectAccountId(10L)).thenReturn(null);
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertNull(result.first());
+        assertNull(result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_ProjectAccount_ProjectFound_ReturnsProjectId() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.PROJECT);
+        when(account.getId()).thenReturn(10L);
+        when(account.getDomainId()).thenReturn(1L);
+
+        Project project = mock(Project.class);
+        when(project.getId()).thenReturn(5L);
+        when(projectManager.findByProjectAccountId(10L)).thenReturn(project);
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertEquals(Long.valueOf(1L), result.first());
+        assertNull(result.second());
+        assertEquals(Long.valueOf(5L), result.third());
+    }
+
+
+    @Test
+    public void testGetServiceOfferingFromRequest_BlankUuid_ReturnsNull() {
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, "", 2, 1024));
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, null, 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_OfferingNotFound_ReturnsNull() {
+        when(serviceOfferingDao.findByUuid("uuid1")).thenReturn(null);
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, "uuid1", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_AccessDenied_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid2")).thenReturn(offering);
+        doThrow(new PermissionDeniedException("denied"))
+                .when(accountService).checkAccess(eq(account), eq(offering), any());
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid2", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_NotCustomized_CpuMemoryMismatch_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid3")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(false);
+        when(offering.getCpu()).thenReturn(4);
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid3", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_NotCustomized_CpuMemoryMatch_ReturnsOffering() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid4")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(false);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        DataCenterVO zone = mock(DataCenterVO.class);
+
+        assertEquals(offering, serverAdapter.getServiceOfferingFromRequest(zone, account, "uuid4", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_Customized_ValidParams_SetsAndReturnsOffering() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid5")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(true);
+        doNothing().when(userVmManager).validateCustomParameters(eq(offering), any());
+        DataCenterVO zone = mock(DataCenterVO.class);
+
+        ServiceOfferingVO result = serverAdapter.getServiceOfferingFromRequest(zone, account, "uuid5", 2, 1024);
+
+        assertEquals(offering, result);
+        verify(offering).setCpu(2);
+        verify(offering).setRamSize(1024);
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_Customized_InvalidParams_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid6")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(true);
+        doThrow(new InvalidParameterValueException("invalid"))
+                .when(userVmManager).validateCustomParameters(eq(offering), any());
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid6", 2, 1024));
+    }
+
+
+    @Test
+    public void testAccountCannotAccessNetwork_CanAccess_ReturnsFalse() {
+        NetworkVO network = mock(NetworkVO.class);
+        Account account = mock(Account.class);
+        when(accountService.getActiveAccountById(1L)).thenReturn(account);
+        doNothing().when(networkModel).checkNetworkPermissions(account, network);
+
+        assertFalse(serverAdapter.accountCannotAccessNetwork(network, 1L));
+    }
+
+    @Test
+    public void testAccountCannotAccessNetwork_CannotAccess_ReturnsTrue() {
+        NetworkVO network = mock(NetworkVO.class);
+        Account account = mock(Account.class);
+        when(accountService.getActiveAccountById(1L)).thenReturn(account);
+        doThrow(new CloudRuntimeException("Access denied"))
+                .when(networkModel).checkNetworkPermissions(account, network);
+
+        assertTrue(serverAdapter.accountCannotAccessNetwork(network, 1L));
+    }
+
+
+    @Test
+    public void testValidateInstanceStorage_SupportedStorageType_NoException() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(1L);
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getPoolId()).thenReturn(10L);
+        when(volumeDao.findUsableVolumesForInstance(1L)).thenReturn(List.of(vol));
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(List.of(pool));
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateInstanceStorage_UnsupportedStorageType_Throws() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(2L);
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getPoolId()).thenReturn(20L);
+        when(volumeDao.findUsableVolumesForInstance(2L)).thenReturn(List.of(vol));
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        when(pool.getName()).thenReturn("ceph-pool");
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(List.of(pool));
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+    @Test
+    public void testValidateInstanceStorage_NoVolumes_NoException() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(3L);
+        when(volumeDao.findUsableVolumesForInstance(3L)).thenReturn(Collections.emptyList());
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(Collections.emptyList());
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+
+    @Test
+    public void testGetBackupDisks_NullVolumeInfos_ReturnsEmptyList() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getBackedUpVolumes()).thenReturn(null);
+
+        assertTrue(serverAdapter.getBackupDisks(backup).isEmpty());
+    }
+
+    @Test
+    public void testGetBackupDisks_EmptyVolumeInfos_ReturnsEmptyList() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getBackedUpVolumes()).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.getBackupDisks(backup).isEmpty());
+    }
+
+
+    @Test
+    public void testGetResourceOwnerFiltersWithDomainIds_NullDomainPath_ReturnsNullDomainIds() {
+        ServerAdapter spyAdapter = spy(serverAdapter);
+        doReturn(new Pair<>(List.of(1L, 2L), (String) null)).when(spyAdapter).getResourceOwnerFilters();
+
+        Pair<List<Long>, List<Long>> result = spyAdapter.getResourceOwnerFiltersWithDomainIds();
+
+        assertEquals(List.of(1L, 2L), result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetResourceOwnerFiltersWithDomainIds_WithDomainPath_ReturnsDomainIds() {
+        ServerAdapter spyAdapter = spy(serverAdapter);
+        doReturn(new Pair<>(List.of(1L), "ROOT/subdomain")).when(spyAdapter).getResourceOwnerFilters();
+        when(domainDao.getDomainChildrenIds("ROOT/subdomain")).thenReturn(List.of(10L, 11L));
+
+        Pair<List<Long>, List<Long>> result = spyAdapter.getResourceOwnerFiltersWithDomainIds();
+
+        assertEquals(List.of(10L, 11L), result.second());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetDataCenter_NotFound_Throws() {
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.getDataCenter("dc-uuid");
+    }
+
+    @Test
+    public void testGetDataCenter_Found_ReturnsDataCenter() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(vo);
+
+        DataCenter result = serverAdapter.getDataCenter("dc-uuid");
+
+        assertNotNull(result);
+    }
+
+
+    @Test
+    public void testListAllDataCenters_ReturnsConvertedList() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.listByIds(anyList(), any())).thenReturn(List.of(vo));
+
+        List<DataCenter> result = serverAdapter.listAllDataCenters(0L, 10L);
+
+        assertNotNull(result);
+        assertEquals(1, result.size());
+    }
+
+    @Test
+    public void testListAllDataCenters_EmptyList_ReturnsEmpty() {
+        when(dataCenterJoinDao.listByIds(anyList(), any())).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listAllDataCenters(0L, 10L).isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListStorageDomainsByDcId_DataCenterNotFound_Throws() {
+        when(dataCenterDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.listStorageDomainsByDcId("dc-uuid", 0L, 10L);
+    }
+
+    @Test
+    public void testListStorageDomainsByDcId_Found_ReturnsList() {
+        DataCenterVO dcVO = mock(DataCenterVO.class);
+        when(dcVO.getId()).thenReturn(1L);
+        when(dataCenterDao.findByUuid("dc-uuid")).thenReturn(dcVO);
+        StoragePoolJoinVO poolVO = mock(StoragePoolJoinVO.class);
+        when(storagePoolJoinDao.listAvailableByZoneHypervisorAndType(eq(1L), eq(Hypervisor.HypervisorType.KVM), any(), any())).thenReturn(List.of(poolVO));
+
+        assertNotNull(serverAdapter.listStorageDomainsByDcId("dc-uuid", 0L, 10L));
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListNetworksByDcId_DataCenterNotFound_Throws() {
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.listNetworksByDcId("dc-uuid", 0L, 10L);
+    }
+
+    @Test
+    public void testListNetworksByDcId_Found_ReturnsEmptyListWhenNoNetworks() {
+        DataCenterJoinVO dcVO = mock(DataCenterJoinVO.class);
+        when(dcVO.getId()).thenReturn(1L);
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(dcVO);
+        when(networkDao.listByZoneAndTrafficType(eq(1L), eq(Networks.TrafficType.Guest), any()))
+                .thenReturn(Collections.emptyList());
+        assertTrue(serverAdapter.listNetworksByDcId("dc-uuid", 0L, 10L).isEmpty());
+    }
+
+
+    @Test
+    public void testListAllClusters_ReturnsEmptyListWhenNoClusters() {
+        when(clusterDao.listByZonesAndHypervisorType(anyList(), any(), any())).thenReturn(Collections.emptyList());
+        assertTrue(serverAdapter.listAllClusters(0L, 10L).isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetCluster_NotFound_Throws() {
+        when(clusterDao.findByUuid("cl-uuid")).thenReturn(null);
+        serverAdapter.getCluster("cl-uuid");
+    }
+
+
+    @Test
+    public void testListAllHosts_ReturnsList() {
+        HostJoinVO hostVO = mock(HostJoinVO.class);
+        when(hostJoinDao.listAvailableRoutingByZonesAndHypervisor(anyList(), any(), any())).thenReturn(List.of(hostVO));
+
+        assertEquals(1, serverAdapter.listAllHosts(0L, 10L).size());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetHost_NotFound_Throws() {
+        when(hostJoinDao.findByUuid("host-uuid")).thenReturn(null);
+        serverAdapter.getHost("host-uuid");
+    }
+
+    @Test
+    public void testGetHost_Found_ReturnsHost() {
+        HostJoinVO vo = mock(HostJoinVO.class);
+        when(hostJoinDao.findByUuid("host-uuid")).thenReturn(vo);
+
+        assertNotNull(serverAdapter.getHost("host-uuid"));
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetVnicProfile_NotFound_Throws() {
+        when(networkDao.findByUuid("net-uuid")).thenReturn(null);
+        serverAdapter.getVnicProfile("net-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetInstance_NotFound_Throws() {
+        when(userVmJoinDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.getInstance("vm-uuid", false, false, false, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.deleteInstance("vm-uuid", true, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testStartInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.startInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testStopInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.stopInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testShutdownInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.shutdownInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.getDisk("vol-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.deleteDisk("vol-uuid");
+    }
+
+    @Test
+    public void testDeleteDisk_Found_DeletesVolume() {
+        VolumeVO vo = mock(VolumeVO.class);
+        when(vo.getId()).thenReturn(10L);
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(vo);
+        Account account = CallContext.current().getCallingAccount();
+
+        serverAdapter.deleteDisk("vol-uuid");
+
+        verify(volumeApiService).destroyVolume(10L, account, true, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCopyDisk_AlwaysThrows() {
+        serverAdapter.copyDisk("any-uuid");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testReduceDisk_AlwaysThrows() {
+        serverAdapter.reduceDisk("any-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListNicsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listNicsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListDiskAttachmentsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listDiskAttachmentsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListSnapshotsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listSnapshotsByInstanceUuid("vm-uuid");
+    }
+
+    @Test
+    public void testListSnapshotsByInstanceUuid_Found_ReturnsEmptyList() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getId()).thenReturn(1L);
+        when(vmVO.getUuid()).thenReturn("vm-uuid");
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(vmSnapshotDao.findByVm(1L)).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listSnapshotsByInstanceUuid("vm-uuid").isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.getSnapshot("snap-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.deleteSnapshot("snap-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testRevertInstanceToSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.revertInstanceToSnapshot("snap-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListBackupsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listBackupsByInstanceUuid("vm-uuid");
+    }
+
+    @Test
+    public void testListBackupsByInstanceUuid_Found_ReturnsEmptyList() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getId()).thenReturn(1L);
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(backupDao.searchByVmIds(anyList())).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listBackupsByInstanceUuid("vm-uuid").isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetBackup_NotFound_Throws() {
+        when(backupDao.findByUuidIncludingRemoved("backup-uuid")).thenReturn(null);
+        serverAdapter.getBackup("backup-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeBackup_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.finalizeBackup("vm-uuid", "backup-uuid");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeBackup_BackupNotFound_Throws() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(backupDao.findByUuid("backup-uuid")).thenReturn(null);
+        serverAdapter.finalizeBackup("vm-uuid", "backup-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListCheckpointsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listCheckpointsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteCheckpoint_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.deleteCheckpoint("vm-uuid", "chk-001");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetJob_NotFound_Throws() {
+        when(asyncJobJoinDao.findByUuidIncludingRemoved("job-uuid")).thenReturn(null);
+        serverAdapter.getJob("job-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuidIncludingRemoved("transfer-uuid")).thenReturn(null);
+        serverAdapter.getImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCancelImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuid("transfer-uuid")).thenReturn(null);
+        serverAdapter.cancelImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuid("transfer-uuid")).thenReturn(null);
+        serverAdapter.finalizeImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateInstance_VmNotFound_Throws() {
+        when(userVmJoinDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.updateInstance("vm-uuid", new Vm());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.updateDisk("vol-uuid", new Disk());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListDisksByBackupUuid_AlwaysThrows() {
+        serverAdapter.listDisksByBackupUuid("backup-uuid");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java
new file mode 100644
index 000000000000..3a6b9cbe4002
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java
@@ -0,0 +1,91 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.cloud.user.Account;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.dto.Api;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class ApiRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testCanHandleAndHandleRootApiRequest() throws Exception {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final User user = mock(User.class);
+        when(user.getUuid()).thenReturn("user-1");
+        when(handler.serverAdapter.getServiceAccount()).thenReturn(new Pair<>(user, mock(Account.class)));
+        when(handler.veeamControlService.getInstanceId()).thenReturn("instance-1");
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api", Negotiation.OutFormat.JSON, newServlet());
+
+        assertTrue(handler.canHandle("GET", "/api?x=1"));
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"instance_id\":\"instance-1\"");
+        assertContains(response.body(), "\"authenticated_user\"");
+        assertContains(response.body(), "clusters/search");
+    }
+
+    @Test
+    public void testCreateApiObjectBuildsLinksAndUserReferences() {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final User user = mock(User.class);
+        when(user.getUuid()).thenReturn("service-user");
+        when(handler.serverAdapter.getServiceAccount()).thenReturn(new Pair<>(user, mock(Account.class)));
+        when(handler.veeamControlService.getInstanceId()).thenReturn("instance-2");
+
+        final Api api = handler.createApiObject("/ctx/api");
+
+        assertNotNull(api.getLink());
+        assertTrue(!api.getLink().isEmpty());
+        assertEquals("instance-2", api.getProductInfo().getInstanceId());
+        assertEquals("service-user", api.getAuthenticatedUser().getId());
+        assertEquals("service-user", api.getEffectiveUser().getId());
+        assertNotNull(api.getTime());
+    }
+
+    @Test
+    public void testHandleUnknownPathReturnsNotFound() throws Exception {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/unknown", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "\"reason\":\"Not found\"");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java
new file mode 100644
index 000000000000..a7ee380f137c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java
@@ -0,0 +1,80 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class ClustersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListReturnsNamedClusterList() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllClusters(null, 25L)).thenReturn(List.of(withId(new Cluster(), "cl-1")));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "25"), null, null), response.response,
+                "/api/clusters", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(handler.serverAdapter).listAllClusters(null, 25L);
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"cluster\":[");
+        assertContains(response.body(), "\"id\":\"cl-1\"");
+    }
+
+    @Test
+    public void testHandleGetByIdReturnsClusterAndMissingClusterIsNotFound() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getCluster("cl-1")).thenReturn(withId(new Cluster(), "cl-1"));
+        when(handler.serverAdapter.getCluster("missing")).thenThrow(new InvalidParameterValueException("missing"));
+
+        final ResponseCapture ok = newResponse();
+        handler.handle(newRequest("GET"), ok.response, "/api/clusters/cl-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(ok.response).setStatus(200);
+        assertContains(ok.body(), "\"id\":\"cl-1\"");
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/clusters/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing");
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedMethod() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("POST"), response.response, "/api/clusters", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setHeader("Allow", "GET");
+        verify(response.response).setStatus(405);
+        assertContains(response.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java
new file mode 100644
index 000000000000..38ddbfad37b9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java
@@ -0,0 +1,91 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class DataCentersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllDataCenters(null, 20L)).thenReturn(List.of(withId(new DataCenter(), "dc-1")));
+        when(handler.serverAdapter.getDataCenter("dc-1")).thenReturn(withId(new DataCenter(), "dc-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "20"), null, null), list.response,
+                "/api/datacenters", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"data_center\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/datacenters/dc-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"dc-1\"");
+    }
+
+    @Test
+    public void testHandleGetStorageDomainsAndNetworksByDataCenterId() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listStorageDomainsByDcId("dc-1", null, 15L))
+                .thenReturn(List.of(withId(new StorageDomain(), "sd-1")));
+        when(handler.serverAdapter.listNetworksByDcId("dc-1", null, 15L))
+                .thenReturn(List.of(withId(new Network(), "net-1")));
+
+        final ResponseCapture storageDomains = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "15"), null, null), storageDomains.response,
+                "/api/datacenters/dc-1/storagedomains", Negotiation.OutFormat.JSON, newServlet());
+        verify(storageDomains.response).setStatus(200);
+        assertContains(storageDomains.body(), "\"storage_domain\":[");
+        assertContains(storageDomains.body(), "sd-1");
+
+        final ResponseCapture networks = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "15"), null, null), networks.response,
+                "/api/datacenters/dc-1/networks", Negotiation.OutFormat.JSON, newServlet());
+        verify(networks.response).setStatus(200);
+        assertContains(networks.body(), "\"network\":[");
+        assertContains(networks.body(), "net-1");
+    }
+
+    @Test
+    public void testHandleMissingDataCenterReturnsNotFound() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getDataCenter("missing")).thenThrow(new InvalidParameterValueException("missing dc"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/datacenters/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing dc");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java
new file mode 100644
index 000000000000..f3872d0cd89d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java
@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class DisksRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllDisks(null, 10L)).thenReturn(List.of(withId(new Disk(), "disk-1")));
+        when(handler.serverAdapter.getDisk("disk-1")).thenReturn(withId(new Disk(), "disk-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "10"), null, null), list.response,
+                "/api/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"disk\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"disk-1\"");
+    }
+
+    @Test
+    public void testHandlePostAndPutParseDiskJson() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<Disk> createCaptor = ArgumentCaptor.forClass(Disk.class);
+        final Disk created = withId(new Disk(), "disk-created");
+        created.setName("created-disk");
+        when(handler.serverAdapter.createDisk(createCaptor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"created-disk\"}"), post.response,
+                "/api/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("created-disk", createCaptor.getValue().getName());
+        assertContains(post.body(), "disk-created");
+
+        final ArgumentCaptor<Disk> updateCaptor = ArgumentCaptor.forClass(Disk.class);
+        final Disk updated = withId(new Disk(), "disk-1");
+        updated.setName("updated-disk");
+        when(handler.serverAdapter.updateDisk(org.mockito.ArgumentMatchers.eq("disk-1"), updateCaptor.capture())).thenReturn(updated);
+
+        final ResponseCapture put = newResponse();
+        handler.handle(newRequest("PUT", Map.of(), "application/json", "{\"name\":\"updated-disk\"}"), put.response,
+                "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(put.response).setStatus(200);
+        assertEquals("updated-disk", updateCaptor.getValue().getName());
+        assertContains(put.body(), "updated-disk");
+    }
+
+    @Test
+    public void testHandleDeleteCopyAndReduceRoutes() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.copyDisk("disk-1")).thenReturn(withId(new Disk(), "copy-1"));
+        when(handler.serverAdapter.reduceDisk("disk-1")).thenReturn(withId(new Disk(), "reduced-1"));
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE"), delete.response, "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteDisk("disk-1");
+        verify(delete.response).setStatus(200);
+        assertContains(delete.body(), "Deleted disk ID: disk-1");
+
+        final ResponseCapture copy = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{}"), copy.response,
+                "/api/disks/disk-1/copy", Negotiation.OutFormat.JSON, newServlet());
+        verify(copy.response).setStatus(200);
+        assertContains(copy.body(), "copy-1");
+
+        final ResponseCapture reduce = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{}"), reduce.response,
+                "/api/disks/disk-1/reduce", Negotiation.OutFormat.JSON, newServlet());
+        verify(reduce.response).setStatus(200);
+        assertContains(reduce.body(), "reduced-1");
+    }
+
+    @Test
+    public void testHandleCopyRejectsUnsupportedMethod() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/disks/disk-1/copy", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setHeader("Allow", "POST");
+        verify(response.response).setStatus(405);
+        assertContains(response.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java
new file mode 100644
index 000000000000..ef9370374726
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java
@@ -0,0 +1,64 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class HostsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final HostsRouteHandler handler = new HostsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllHosts(null, null)).thenReturn(List.of(withId(new Host(), "host-1")));
+        when(handler.serverAdapter.getHost("host-1")).thenReturn(withId(new Host(), "host-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/hosts", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"host\":[");
+        assertContains(list.body(), "host-1");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/hosts/host-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"host-1\"");
+    }
+
+    @Test
+    public void testHandleGetByIdNotFound() throws Exception {
+        final HostsRouteHandler handler = new HostsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getHost("missing")).thenThrow(new InvalidParameterValueException("missing host"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/hosts/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing host");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java
new file mode 100644
index 000000000000..7ad85a4a4ee3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class ImageTransfersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllImageTransfers(null, 5L)).thenReturn(List.of(withId(new ImageTransfer(), "transfer-1")));
+        when(handler.serverAdapter.getImageTransfer("transfer-1")).thenReturn(withId(new ImageTransfer(), "transfer-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "5"), null, null), list.response,
+                "/api/imagetransfers", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"image_transfer\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/imagetransfers/transfer-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"transfer-1\"");
+    }
+
+    @Test
+    public void testHandlePostParsesRequestAndCancelFinalizeActions() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<ImageTransfer> captor = ArgumentCaptor.forClass(ImageTransfer.class);
+        final ImageTransfer created = withId(new ImageTransfer(), "transfer-created");
+        created.setPhase("transferring");
+        when(handler.serverAdapter.createImageTransfer(captor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"phase\":\"transferring\"}"), post.response,
+                "/api/imagetransfers", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("transferring", captor.getValue().getPhase());
+        assertContains(post.body(), "transfer-created");
+
+        final ResponseCapture cancel = newResponse();
+        handler.handle(newRequest("POST"), cancel.response, "/api/imagetransfers/transfer-1/cancel", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).cancelImageTransfer("transfer-1");
+        verify(cancel.response).setStatus(200);
+        assertContains(cancel.body(), "cancelled successfully");
+
+        final ResponseCapture finalize = newResponse();
+        handler.handle(newRequest("POST"), finalize.response, "/api/imagetransfers/transfer-1/finalize", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).finalizeImageTransfer("transfer-1");
+        verify(finalize.response).setStatus(200);
+        assertContains(finalize.body(), "finalized successfully");
+    }
+
+    @Test
+    public void testHandleMissingTransferAndUnsupportedActionMethod() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getImageTransfer("missing")).thenThrow(new InvalidParameterValueException("missing transfer"));
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/imagetransfers/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing transfer");
+
+        final ResponseCapture wrongMethod = newResponse();
+        handler.handle(newRequest("GET"), wrongMethod.response, "/api/imagetransfers/transfer-1/cancel", Negotiation.OutFormat.JSON, newServlet());
+        verify(wrongMethod.response).setHeader("Allow", "POST");
+        verify(wrongMethod.response).setStatus(405);
+        assertContains(wrongMethod.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java
new file mode 100644
index 000000000000..f3236896d4b2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class JobsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final JobsRouteHandler handler = new JobsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listPendingJobs()).thenReturn(List.of(withId(new Job(), "job-1")));
+        when(handler.serverAdapter.getJob("job-1")).thenReturn(withId(new Job(), "job-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/jobs", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"job\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/jobs/job-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"job-1\"");
+    }
+
+    @Test
+    public void testHandleMissingJobAndUnsupportedMethod() throws Exception {
+        final JobsRouteHandler handler = new JobsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getJob("missing")).thenThrow(new InvalidParameterValueException("missing job"));
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/jobs/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing job");
+
+        final ResponseCapture wrongMethod = newResponse();
+        handler.handle(newRequest("POST"), wrongMethod.response, "/api/jobs", Negotiation.OutFormat.JSON, newServlet());
+        verify(wrongMethod.response).setStatus(405);
+        assertContains(wrongMethod.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java
new file mode 100644
index 000000000000..35381b673c42
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class NetworksRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final NetworksRouteHandler handler = new NetworksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllNetworks(null, null)).thenReturn(List.of(withId(new Network(), "net-1")));
+        when(handler.serverAdapter.getNetwork("net-1")).thenReturn(withId(new Network(), "net-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/networks", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"network\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/networks/net-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"net-1\"");
+    }
+
+    @Test
+    public void testHandleMissingNetworkReturnsNotFound() throws Exception {
+        final NetworksRouteHandler handler = new NetworksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getNetwork("missing")).thenThrow(new InvalidParameterValueException("missing network"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/networks/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing network");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java
new file mode 100644
index 000000000000..ff0a6d822237
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.BufferedReader;
+import java.io.PrintWriter;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.Collections;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+
+class RouteHandlerTestSupport {
+
+    protected VeeamControlServlet newServlet() {
+        return new VeeamControlServlet(Collections.emptyList());
+    }
+
+    protected HttpServletRequest newRequest(final String method) throws Exception {
+        return newRequest(method, Collections.emptyMap(), null, null);
+    }
+
+    protected HttpServletRequest newRequest(final String method, final Map<String, String> params,
+            final String contentType, final String body) throws Exception {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final Map<String, String> safeParams = params == null ? Collections.emptyMap() : params;
+
+        when(request.getMethod()).thenReturn(method);
+        when(request.getContentType()).thenReturn(contentType);
+        when(request.getParameterMap()).thenReturn(toParameterMap(safeParams));
+        when(request.getParameter(org.mockito.ArgumentMatchers.anyString())).thenAnswer(invocation -> safeParams.get(invocation.getArgument(0)));
+        when(request.getReader()).thenReturn(new BufferedReader(new StringReader(body == null ? "" : body)));
+        return request;
+    }
+
+    protected ResponseCapture newResponse() throws Exception {
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        final PrintWriter writer = new PrintWriter(sink);
+        when(response.getWriter()).thenReturn(writer);
+        return new ResponseCapture(response, sink, writer);
+    }
+
+    protected static <T extends BaseDto> T withId(final T dto, final String id) {
+        dto.setId(id);
+        dto.setHref("/api/test/" + id);
+        return dto;
+    }
+
+    protected static void assertContains(final String actual, final String expected) {
+        assertTrue("Expected body to contain: " + expected + " but was: " + actual, actual.contains(expected));
+    }
+
+    private static Map<String, String[]> toParameterMap(final Map<String, String> params) {
+        final java.util.LinkedHashMap<String, String[]> result = new java.util.LinkedHashMap<>();
+        for (Map.Entry<String, String> entry : params.entrySet()) {
+            result.put(entry.getKey(), new String[]{entry.getValue()});
+        }
+        return result;
+    }
+
+    protected static class ResponseCapture {
+        final HttpServletResponse response;
+        private final StringWriter sink;
+        private final PrintWriter writer;
+
+        ResponseCapture(final HttpServletResponse response, final StringWriter sink, final PrintWriter writer) {
+            this.response = response;
+            this.sink = sink;
+            this.writer = writer;
+        }
+
+        String body() {
+            writer.flush();
+            return sink.toString();
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java
new file mode 100644
index 000000000000..1b01887aabf4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class TagsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final TagsRouteHandler handler = new TagsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllTags(null, null)).thenReturn(List.of(withId(new Tag(), "tag-1")));
+        when(handler.serverAdapter.getTag("tag-1")).thenReturn(withId(new Tag(), "tag-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/tags", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"tag\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/tags/tag-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"tag-1\"");
+    }
+
+    @Test
+    public void testHandleMissingTagReturnsNotFound() throws Exception {
+        final TagsRouteHandler handler = new TagsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getTag("missing")).thenThrow(new InvalidParameterValueException("missing tag"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/tags/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing tag");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java
new file mode 100644
index 000000000000..281254fd6864
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java
@@ -0,0 +1,297 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class VmsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListUsesFollowFlags() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllInstances(true, true, true, true, null, 10L))
+                .thenReturn(List.of(withId(new Vm(), "vm-1")));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET", Map.of(
+                        "max", "10",
+                        "all_content", "true",
+                        "follow", "tags,disk_attachments.disk,nics.reporteddevices"), null, null),
+                response.response, "/api/vms", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(handler.serverAdapter).listAllInstances(true, true, true, true, null, 10L);
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"vm\":[");
+        assertContains(response.body(), "vm-1");
+    }
+
+    @Test
+    public void testHandlePostAndUpdateParseVmJson() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<Vm> createCaptor = ArgumentCaptor.forClass(Vm.class);
+        final Vm created = withId(new Vm(), "vm-created");
+        created.setName("vm-created");
+        when(handler.serverAdapter.createInstance(createCaptor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"vm-created\"}"), post.response,
+                "/api/vms", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("vm-created", createCaptor.getValue().getName());
+        assertContains(post.body(), "vm-created");
+
+        final ArgumentCaptor<Vm> updateCaptor = ArgumentCaptor.forClass(Vm.class);
+        final Vm updated = withId(new Vm(), "vm-1");
+        updated.setName("vm-updated");
+        when(handler.serverAdapter.updateInstance(eq("vm-1"), updateCaptor.capture())).thenReturn(updated);
+
+        final ResponseCapture put = newResponse();
+        handler.handle(newRequest("PUT", Map.of(), "application/json", "{\"name\":\"vm-updated\"}"), put.response,
+                "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(put.response).setStatus(200);
+        assertEquals("vm-updated", updateCaptor.getValue().getName());
+        assertContains(put.body(), "vm-updated");
+    }
+
+    @Test
+    public void testHandleGetByIdDeleteAndPowerActions() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getInstance("vm-1", true, true, true, true)).thenReturn(withId(new Vm(), "vm-1"));
+
+        final VmAction deleteAction = new VmAction();
+        deleteAction.setStatus("deleted");
+        final VmAction startAction = new VmAction();
+        startAction.setStatus("starting");
+        final VmAction stopAction = new VmAction();
+        stopAction.setStatus("stopping");
+        final VmAction shutdownAction = new VmAction();
+        shutdownAction.setStatus("shutting_down");
+        when(handler.serverAdapter.deleteInstance("vm-1", true, true)).thenReturn(deleteAction);
+        when(handler.serverAdapter.startInstance("vm-1", false)).thenReturn(startAction);
+        when(handler.serverAdapter.stopInstance("vm-1", false)).thenReturn(stopAction);
+        when(handler.serverAdapter.shutdownInstance("vm-1", false)).thenReturn(shutdownAction);
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET", Map.of(
+                        "all_content", "true",
+                        "follow", "tags,disk_attachments.disk,nics.reporteddevices"), null, null),
+                get.response, "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "\"id\":\"vm-1\"");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE", Map.of("async", "true", "detach_only", "false"), null, null), delete.response,
+                "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteInstance("vm-1", true, true);
+        verify(delete.response).setStatus(200);
+        assertContains(delete.body(), "deleted");
+
+        final ResponseCapture start = newResponse();
+        handler.handle(newRequest("POST"), start.response, "/api/vms/vm-1/start", Negotiation.OutFormat.JSON, newServlet());
+        verify(start.response).setStatus(202);
+        assertContains(start.body(), "starting");
+
+        final ResponseCapture stop = newResponse();
+        handler.handle(newRequest("POST"), stop.response, "/api/vms/vm-1/stop", Negotiation.OutFormat.JSON, newServlet());
+        verify(stop.response).setStatus(202);
+        assertContains(stop.body(), "stopping");
+
+        final ResponseCapture shutdown = newResponse();
+        handler.handle(newRequest("POST"), shutdown.response, "/api/vms/vm-1/shutdown", Negotiation.OutFormat.JSON, newServlet());
+        verify(shutdown.response).setStatus(202);
+        assertContains(shutdown.body(), "shutting_down");
+    }
+
+    @Test
+    public void testHandleDiskAttachmentAndNicRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listDiskAttachmentsByInstanceUuid("vm-1"))
+                .thenReturn(List.of(withId(new DiskAttachment(), "attach-1")));
+        when(handler.serverAdapter.listNicsByInstanceUuid("vm-1"))
+                .thenReturn(List.of(withId(new Nic(), "nic-1")));
+
+        final ArgumentCaptor<DiskAttachment> diskAttachmentCaptor = ArgumentCaptor.forClass(DiskAttachment.class);
+        final DiskAttachment createdAttachment = withId(new DiskAttachment(), "attach-created");
+        createdAttachment.setActive("true");
+        when(handler.serverAdapter.attachInstanceDisk(eq("vm-1"), diskAttachmentCaptor.capture())).thenReturn(createdAttachment);
+
+        final ArgumentCaptor<Nic> nicCaptor = ArgumentCaptor.forClass(Nic.class);
+        final Nic createdNic = withId(new Nic(), "nic-created");
+        createdNic.setName("nic-created");
+        when(handler.serverAdapter.attachInstanceNic(eq("vm-1"), nicCaptor.capture())).thenReturn(createdNic);
+
+        final ResponseCapture attachments = newResponse();
+        handler.handle(newRequest("GET"), attachments.response, "/api/vms/vm-1/diskattachments", Negotiation.OutFormat.JSON, newServlet());
+        verify(attachments.response).setStatus(200);
+        assertContains(attachments.body(), "\"disk_attachment\":[");
+
+        final ResponseCapture postAttachment = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"active\":\"true\"}"), postAttachment.response,
+                "/api/vms/vm-1/diskattachments", Negotiation.OutFormat.JSON, newServlet());
+        verify(postAttachment.response).setStatus(201);
+        assertEquals("true", diskAttachmentCaptor.getValue().getActive());
+        assertContains(postAttachment.body(), "attach-created");
+
+        final ResponseCapture nics = newResponse();
+        handler.handle(newRequest("GET"), nics.response, "/api/vms/vm-1/nics", Negotiation.OutFormat.JSON, newServlet());
+        verify(nics.response).setStatus(200);
+        assertContains(nics.body(), "\"nic\":[");
+
+        final ResponseCapture postNic = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"nic-created\"}"), postNic.response,
+                "/api/vms/vm-1/nics", Negotiation.OutFormat.JSON, newServlet());
+        verify(postNic.response).setStatus(201);
+        assertEquals("nic-created", nicCaptor.getValue().getName());
+        assertContains(postNic.body(), "nic-created");
+    }
+
+    @Test
+    public void testHandleSnapshotRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listSnapshotsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Snapshot(), "snap-1")));
+        when(handler.serverAdapter.getSnapshot("snap-1")).thenReturn(withId(new Snapshot(), "snap-1"));
+
+        final ArgumentCaptor<Snapshot> createCaptor = ArgumentCaptor.forClass(Snapshot.class);
+        final Snapshot createdSnapshot = withId(new Snapshot(), "snap-created");
+        createdSnapshot.setDescription("created snapshot");
+        when(handler.serverAdapter.createInstanceSnapshot(eq("vm-1"), createCaptor.capture())).thenReturn(createdSnapshot);
+
+        final ResourceAction deleteAction = new ResourceAction();
+        deleteAction.setStatus("deleted");
+        final ResourceAction restoreAction = new ResourceAction();
+        restoreAction.setStatus("restored");
+        when(handler.serverAdapter.deleteSnapshot("snap-1", true)).thenReturn(deleteAction);
+        when(handler.serverAdapter.revertInstanceToSnapshot("snap-1", false)).thenReturn(restoreAction);
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/snapshots", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"snapshot\":[");
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"description\":\"created snapshot\"}"), post.response,
+                "/api/vms/vm-1/snapshots", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(202);
+        assertEquals("created snapshot", createCaptor.getValue().getDescription());
+        assertContains(post.body(), "snap-created");
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET"), get.response, "/api/vms/vm-1/snapshots/snap-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "snap-1");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE", Map.of("async", "true"), null, null), delete.response,
+                "/api/vms/vm-1/snapshots/snap-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(delete.response).setStatus(202);
+        assertContains(delete.body(), "deleted");
+
+        final ResponseCapture restore = newResponse();
+        handler.handle(newRequest("POST"), restore.response, "/api/vms/vm-1/snapshots/snap-1/restore", Negotiation.OutFormat.JSON, newServlet());
+        verify(restore.response).setStatus(202);
+        assertContains(restore.body(), "restored");
+    }
+
+    @Test
+    public void testHandleBackupRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listBackupsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Backup(), "backup-1")));
+        when(handler.serverAdapter.getBackup("backup-1")).thenReturn(withId(new Backup(), "backup-1"));
+        when(handler.serverAdapter.listDisksByBackupUuid("backup-1")).thenReturn(List.of(withId(new Disk(), "disk-1")));
+
+        final ArgumentCaptor<Backup> createCaptor = ArgumentCaptor.forClass(Backup.class);
+        final Backup createdBackup = withId(new Backup(), "backup-created");
+        createdBackup.setName("backup-created");
+        when(handler.serverAdapter.createInstanceBackup(eq("vm-1"), createCaptor.capture())).thenReturn(createdBackup);
+
+        final Backup finalizedBackup = withId(new Backup(), "backup-1");
+        finalizedBackup.setPhase("finalized");
+        when(handler.serverAdapter.finalizeBackup("vm-1", "backup-1")).thenReturn(finalizedBackup);
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/backups", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"backup\":[");
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"backup-created\"}"), post.response,
+                "/api/vms/vm-1/backups", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(200);
+        assertEquals("backup-created", createCaptor.getValue().getName());
+        assertContains(post.body(), "backup-created");
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET"), get.response, "/api/vms/vm-1/backups/backup-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "backup-1");
+
+        final ResponseCapture disks = newResponse();
+        handler.handle(newRequest("GET"), disks.response, "/api/vms/vm-1/backups/backup-1/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(disks.response).setStatus(200);
+        assertContains(disks.body(), "\"disk\":[");
+
+        final ResponseCapture finalize = newResponse();
+        handler.handle(newRequest("POST"), finalize.response, "/api/vms/vm-1/backups/backup-1/finalize", Negotiation.OutFormat.JSON, newServlet());
+        verify(finalize.response).setStatus(200);
+        assertContains(finalize.body(), "finalized");
+    }
+
+    @Test
+    public void testHandleCheckpointRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listCheckpointsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Checkpoint(), "chk-1")));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/checkpoints", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"checkpoints\":[");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE"), delete.response, "/api/vms/vm-1/checkpoints/chk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteCheckpoint("vm-1", "chk-1");
+        verify(delete.response).setStatus(200);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java
new file mode 100644
index 000000000000..c22d2c402edb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class VnicProfilesRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final VnicProfilesRouteHandler handler = new VnicProfilesRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllVnicProfiles(null, null)).thenReturn(List.of(withId(new VnicProfile(), "vnic-1")));
+        when(handler.serverAdapter.getVnicProfile("vnic-1")).thenReturn(withId(new VnicProfile(), "vnic-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vnicprofiles", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"vnic_profile\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/vnicprofiles/vnic-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"vnic-1\"");
+    }
+
+    @Test
+    public void testHandleMissingVnicProfileReturnsNotFound() throws Exception {
+        final VnicProfilesRouteHandler handler = new VnicProfilesRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getVnicProfile("missing")).thenThrow(new InvalidParameterValueException("missing vnic"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/vnicprofiles/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing vnic");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java
new file mode 100644
index 000000000000..503fd05104b4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java
@@ -0,0 +1,85 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+
+public class AsyncJobJoinVOToJobConverterTest {
+
+    @Test
+    public void testToJob_MapsSucceededStatusAndOwnerRef() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-1");
+        when(vo.getUserUuid()).thenReturn("user-1");
+        when(vo.getCreated()).thenReturn(new Date(1000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.SUCCEEDED.ordinal());
+
+        final Job job = AsyncJobJoinVOToJobConverter.toJob(vo);
+
+        assertEquals("job-1", job.getId());
+        assertEquals("finished", job.getStatus());
+        assertEquals(Long.valueOf(1000L), job.getStartTime());
+        assertNotNull(job.getEndTime());
+        assertEquals("user-1", job.getOwner().getId());
+    }
+
+    @Test
+    public void testToJob_MapsInProgressToStartedAndNoEndTime() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-2");
+        when(vo.getUserUuid()).thenReturn("user-2");
+        when(vo.getCreated()).thenReturn(new Date(2000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.IN_PROGRESS.ordinal());
+
+        final Job job = AsyncJobJoinVOToJobConverter.toJob(vo);
+
+        assertEquals("started", job.getStatus());
+        assertNull(job.getEndTime());
+    }
+
+    @Test
+    public void testToActionAndToJobList() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-3");
+        when(vo.getUserUuid()).thenReturn("user-3");
+        when(vo.getCreated()).thenReturn(new Date(3000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.CANCELLED.ordinal());
+
+        final ResourceAction action = AsyncJobJoinVOToJobConverter.toAction(vo);
+        assertEquals("complete", action.getStatus());
+        assertEquals("job-3", action.getJob().getId());
+
+        final List<Job> jobs = AsyncJobJoinVOToJobConverter.toJobList(List.of(vo));
+        assertEquals(1, jobs.size());
+        assertEquals("aborted", jobs.get(0).getStatus());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java
new file mode 100644
index 000000000000..1eb59b2f4b1a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.vm.UserVmVO;
+
+public class BackupVOToBackupConverterTest {
+
+    @Test
+    public void testToBackup_MapsCoreFieldsAndResolvedRefs() {
+        final BackupVO backupVO = mock(BackupVO.class);
+        when(backupVO.getUuid()).thenReturn("bkp-1");
+        when(backupVO.getName()).thenReturn("backup-1");
+        when(backupVO.getDescription()).thenReturn("desc-1");
+        when(backupVO.getDate()).thenReturn(new Date(1000L));
+        when(backupVO.getStatus()).thenReturn(Backup.Status.ReadyForImageTransfer);
+        when(backupVO.getFromCheckpointId()).thenReturn("cp-1");
+        when(backupVO.getToCheckpointId()).thenReturn("cp-2");
+        when(backupVO.getVmId()).thenReturn(101L);
+        when(backupVO.getHostId()).thenReturn(201L);
+
+        final UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getUuid()).thenReturn("vm-1");
+        final HostJoinVO hostVO = mock(HostJoinVO.class);
+        when(hostVO.getUuid()).thenReturn("host-1");
+
+        final org.apache.cloudstack.veeam.api.dto.Backup backup = BackupVOToBackupConverter.toBackup(
+                backupVO,
+                id -> vmVO,
+                id -> hostVO,
+                vo -> List.of(new Disk())
+        );
+
+        assertEquals("bkp-1", backup.getId());
+        assertEquals("backup-1", backup.getName());
+        assertEquals("desc-1", backup.getDescription());
+        assertEquals(Long.valueOf(1000L), backup.getCreationDate());
+        assertEquals("ready", backup.getPhase());
+        assertEquals("cp-1", backup.getFromCheckpointId());
+        assertEquals("cp-2", backup.getToCheckpointId());
+        assertEquals("vm-1", backup.getVm().getId());
+        assertEquals("host-1", backup.getHost().getId());
+        assertNotNull(backup.getDisks());
+    }
+
+    @Test
+    public void testToBackup_PhaseMappingForDifferentStatuses() {
+        final BackupVO queued = mock(BackupVO.class);
+        when(queued.getUuid()).thenReturn("b1");
+        when(queued.getDate()).thenReturn(new Date(1L));
+        when(queued.getStatus()).thenReturn(Backup.Status.Queued);
+        when(queued.getVmId()).thenReturn(1L);
+
+        final BackupVO finalizing = mock(BackupVO.class);
+        when(finalizing.getUuid()).thenReturn("b2");
+        when(finalizing.getDate()).thenReturn(new Date(2L));
+        when(finalizing.getStatus()).thenReturn(Backup.Status.FinalizingImageTransfer);
+        when(finalizing.getVmId()).thenReturn(2L);
+
+        final BackupVO failed = mock(BackupVO.class);
+        when(failed.getUuid()).thenReturn("b3");
+        when(failed.getDate()).thenReturn(new Date(3L));
+        when(failed.getStatus()).thenReturn(Backup.Status.Failed);
+        when(failed.getVmId()).thenReturn(3L);
+
+        assertEquals("initializing", BackupVOToBackupConverter.toBackup(queued, null, null, null).getPhase());
+        assertEquals("finalizing", BackupVOToBackupConverter.toBackup(finalizing, null, null, null).getPhase());
+        assertEquals("failed", BackupVOToBackupConverter.toBackup(failed, null, null, null).getPhase());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java
new file mode 100644
index 000000000000..1ac57f44949a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.cpu.CPU;
+import com.cloud.dc.ClusterVO;
+
+public class ClusterVOToClusterConverterTest {
+
+    @Test
+    public void testToCluster_MapsDefaultsAndResolvedDataCenter() {
+        final ClusterVO vo = mock(ClusterVO.class);
+        when(vo.getUuid()).thenReturn("cluster-1");
+        when(vo.getName()).thenReturn("cluster-a");
+        when(vo.getArch()).thenReturn(CPU.CPUArch.amd64);
+        when(vo.getDataCenterId()).thenReturn(11L);
+
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-1");
+
+        final Cluster cluster = ClusterVOToClusterConverter.toCluster(vo, id -> zone);
+
+        assertEquals("cluster-1", cluster.getId());
+        assertEquals("cluster-a", cluster.getName());
+        assertEquals("x86_64", cluster.getCpu().getArchitecture());
+        assertEquals("dc-1", cluster.getDataCenter().getId());
+        assertEquals("urandom", cluster.getRequiredRngSources().requiredRngSource.get(0));
+        assertEquals("networks", cluster.getLink().get(0).getRel());
+        assertNotNull(cluster.getSchedulingPolicy());
+        assertNotNull(cluster.getMacPool());
+        assertTrue(cluster.getHref().contains("/api/clusters/cluster-1"));
+    }
+
+    @Test
+    public void testToClusterList_ConvertsAllItems() {
+        final ClusterVO first = mock(ClusterVO.class);
+        when(first.getUuid()).thenReturn("c1");
+        when(first.getName()).thenReturn("c1");
+        when(first.getArch()).thenReturn(CPU.CPUArch.x86);
+        when(first.getDataCenterId()).thenReturn(1L);
+
+        final ClusterVO second = mock(ClusterVO.class);
+        when(second.getUuid()).thenReturn("c2");
+        when(second.getName()).thenReturn("c2");
+        when(second.getArch()).thenReturn(CPU.CPUArch.amd64);
+        when(second.getDataCenterId()).thenReturn(2L);
+
+        final List<Cluster> clusters = ClusterVOToClusterConverter.toClusterList(List.of(first, second), id -> null);
+
+        assertEquals(2, clusters.size());
+        assertEquals("c1", clusters.get(0).getId());
+        assertEquals("c2", clusters.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java
new file mode 100644
index 000000000000..59d14a5545cc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.org.Grouping;
+
+public class DataCenterJoinVOToDataCenterConverterTest {
+
+    @Test
+    public void testToDataCenter_MapsIdentityStatusAndLinks() {
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-1");
+        when(zone.getName()).thenReturn("zone-a");
+        when(zone.getDescription()).thenReturn("desc-a");
+        when(zone.getAllocationState()).thenReturn(Grouping.AllocationState.Enabled);
+
+        final DataCenter dc = DataCenterJoinVOToDataCenterConverter.toDataCenter(zone);
+
+        assertEquals("dc-1", dc.getId());
+        assertEquals("zone-a", dc.getName());
+        assertEquals("desc-a", dc.getDescription());
+        assertEquals("up", dc.getStatus());
+        assertNotNull(dc.getVersion());
+        assertNotNull(dc.getSupportedVersions());
+        assertEquals(3, dc.getLink().size());
+        assertEquals("cluster", dc.getLink().get(0).getRel());
+    }
+
+    @Test
+    public void testToDataCenter_DisabledZoneMapsToDown() {
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-2");
+        when(zone.getName()).thenReturn("zone-b");
+        when(zone.getDescription()).thenReturn("desc-b");
+        when(zone.getAllocationState()).thenReturn(Grouping.AllocationState.Disabled);
+
+        final DataCenter dc = DataCenterJoinVOToDataCenterConverter.toDataCenter(zone);
+
+        assertEquals("down", dc.getStatus());
+    }
+
+    @Test
+    public void testToDcList_ConvertsAllItems() {
+        final DataCenterJoinVO first = mock(DataCenterJoinVO.class);
+        when(first.getUuid()).thenReturn("dc-1");
+        when(first.getName()).thenReturn("zone-a");
+        when(first.getDescription()).thenReturn("desc-a");
+        when(first.getAllocationState()).thenReturn(Grouping.AllocationState.Enabled);
+
+        final DataCenterJoinVO second = mock(DataCenterJoinVO.class);
+        when(second.getUuid()).thenReturn("dc-2");
+        when(second.getName()).thenReturn("zone-b");
+        when(second.getDescription()).thenReturn("desc-b");
+        when(second.getAllocationState()).thenReturn(Grouping.AllocationState.Disabled);
+
+        final List<DataCenter> result = DataCenterJoinVOToDataCenterConverter.toDCList(List.of(first, second));
+
+        assertEquals(2, result.size());
+        assertEquals("dc-1", result.get(0).getId());
+        assertEquals("dc-2", result.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java
new file mode 100644
index 000000000000..e5ab87b40c55
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java
@@ -0,0 +1,123 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.host.Status;
+import com.cloud.resource.ResourceState;
+
+public class HostJoinVOToHostConverterTest {
+
+    @Test
+    public void testToHost_MapsUpHostAndCoreFields() {
+        final HostJoinVO vo = mock(HostJoinVO.class);
+        when(vo.getUuid()).thenReturn("host-1");
+        when(vo.getName()).thenReturn("kvm-1");
+        when(vo.getPrivateIpAddress()).thenReturn("10.10.10.11");
+        when(vo.isInMaintenanceStates()).thenReturn(false);
+        when(vo.getStatus()).thenReturn(Status.Up);
+        when(vo.getResourceState()).thenReturn(ResourceState.Enabled);
+        when(vo.getClusterUuid()).thenReturn("cl-1");
+        when(vo.getSpeed()).thenReturn(2400L);
+        when(vo.getCpuSockets()).thenReturn(2);
+        when(vo.getCpus()).thenReturn(8);
+        when(vo.getTotalMemory()).thenReturn(16000L);
+        when(vo.getMemUsedCapacity()).thenReturn(4000L);
+
+        final Host host = HostJoinVOToHostConverter.toHost(vo);
+
+        assertEquals("host-1", host.getId());
+        assertEquals("kvm-1", host.getName());
+        assertEquals("10.10.10.11", host.getAddress());
+        assertEquals("up", host.getStatus());
+        assertEquals("cl-1", host.getCluster().getId());
+        assertEquals("2400", host.getCpu().getSpeed());
+        assertEquals("16000", host.getMemory());
+        assertEquals("12000", host.getMaxSchedulingMemory());
+        assertTrue(host.getHref().contains("/api/hosts/host-1"));
+    }
+
+    @Test
+    public void testToHost_MapsMaintenanceAndFallbackName() {
+        final HostJoinVO vo = mock(HostJoinVO.class);
+        when(vo.getUuid()).thenReturn("host-2");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getPrivateIpAddress()).thenReturn("10.10.10.12");
+        when(vo.isInMaintenanceStates()).thenReturn(true);
+        when(vo.getStatus()).thenReturn(Status.Down);
+        when(vo.getResourceState()).thenReturn(ResourceState.Disabled);
+        when(vo.getClusterUuid()).thenReturn("cl-2");
+        when(vo.getSpeed()).thenReturn(2200L);
+        when(vo.getCpuSockets()).thenReturn(1);
+        when(vo.getCpus()).thenReturn(4);
+        when(vo.getTotalMemory()).thenReturn(8000L);
+        when(vo.getMemUsedCapacity()).thenReturn(2000L);
+
+        final Host host = HostJoinVOToHostConverter.toHost(vo);
+
+        assertEquals("host-host-2", host.getName());
+        assertEquals("maintenance", host.getStatus());
+    }
+
+    @Test
+    public void testToHostList_ConvertsAllEntries() {
+        final HostJoinVO first = mock(HostJoinVO.class);
+        when(first.getUuid()).thenReturn("h1");
+        when(first.getName()).thenReturn("h1");
+        when(first.getPrivateIpAddress()).thenReturn("1.1.1.1");
+        when(first.isInMaintenanceStates()).thenReturn(false);
+        when(first.getStatus()).thenReturn(Status.Up);
+        when(first.getResourceState()).thenReturn(ResourceState.Enabled);
+        when(first.getClusterUuid()).thenReturn("c1");
+        when(first.getSpeed()).thenReturn(1000L);
+        when(first.getCpuSockets()).thenReturn(1);
+        when(first.getCpus()).thenReturn(1);
+        when(first.getTotalMemory()).thenReturn(1024L);
+        when(first.getMemUsedCapacity()).thenReturn(24L);
+
+        final HostJoinVO second = mock(HostJoinVO.class);
+        when(second.getUuid()).thenReturn("h2");
+        when(second.getName()).thenReturn("h2");
+        when(second.getPrivateIpAddress()).thenReturn("2.2.2.2");
+        when(second.isInMaintenanceStates()).thenReturn(false);
+        when(second.getStatus()).thenReturn(Status.Down);
+        when(second.getResourceState()).thenReturn(ResourceState.Disabled);
+        when(second.getClusterUuid()).thenReturn("c2");
+        when(second.getSpeed()).thenReturn(2000L);
+        when(second.getCpuSockets()).thenReturn(1);
+        when(second.getCpus()).thenReturn(2);
+        when(second.getTotalMemory()).thenReturn(2048L);
+        when(second.getMemUsedCapacity()).thenReturn(48L);
+
+        final List<Host> hosts = HostJoinVOToHostConverter.toHostList(List.of(first, second));
+
+        assertEquals(2, hosts.size());
+        assertEquals("h1", hosts.get(0).getId());
+        assertEquals("h2", hosts.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java
new file mode 100644
index 000000000000..a5d88b0f0a6b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertTrue;
+import org.junit.Test;
+
+public class ImageTransferVOToImageTransferConverterTest {
+
+    @Test
+    public void testConverterExposesExpectedApiMethods() {
+        final java.lang.reflect.Method[] methods = ImageTransferVOToImageTransferConverter.class.getDeclaredMethods();
+        boolean hasSingle = false;
+        boolean hasList = false;
+        for (java.lang.reflect.Method method : methods) {
+            if ("toImageTransfer".equals(method.getName())) {
+                hasSingle = true;
+            }
+            if ("toImageTransferList".equals(method.getName())) {
+                hasList = true;
+            }
+        }
+        assertTrue(hasSingle);
+        assertTrue(hasList);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java
new file mode 100644
index 000000000000..f3323e18fa6d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToNetworkConverterTest {
+
+    @Test
+    public void testToNetwork_MapsFieldsAndDataCenterRef() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-1");
+        when(vo.getName()).thenReturn("guest-net");
+        when(vo.getDisplayText()).thenReturn("Guest network");
+        when(vo.getPrivateMtu()).thenReturn(1450);
+        when(vo.getDataCenterId()).thenReturn(10L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("dc-1");
+
+        final Network dto = NetworkVOToNetworkConverter.toNetwork(vo, id -> dc);
+
+        assertEquals("net-1", dto.getId());
+        assertEquals("guest-net", dto.getName());
+        assertEquals("Guest network", dto.getDescription());
+        assertEquals("", dto.getComment());
+        assertEquals("1450", dto.getMtu());
+        assertEquals("false", dto.getPortIsolation());
+        assertEquals("false", dto.getStp());
+        assertEquals("guest-net", dto.getVdsmName());
+        assertNotNull(dto.getUsages());
+        assertEquals(1, dto.getUsages().getItems().size());
+        assertEquals("vm", dto.getUsages().getItems().get(0));
+        assertNotNull(dto.getLink());
+        assertTrue(dto.getLink().isEmpty());
+        assertEquals("dc-1", dto.getDataCenter().getId());
+        assertTrue(dto.getHref().contains("/api/networks/net-1"));
+    }
+
+    @Test
+    public void testToNetwork_UsesFallbackNameAndSkipsBlankDataCenterUuid() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-2");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getTrafficType()).thenReturn(Networks.TrafficType.Guest);
+        when(vo.getDisplayText()).thenReturn("Fallback network");
+        when(vo.getPrivateMtu()).thenReturn(null);
+        when(vo.getDataCenterId()).thenReturn(20L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("");
+
+        final Network dto = NetworkVOToNetworkConverter.toNetwork(vo, id -> dc);
+
+        assertEquals("Guest-net-2", dto.getName());
+        assertEquals("0", dto.getMtu());
+        assertEquals("Guest-net-2", dto.getVdsmName());
+        assertNull(dto.getDataCenter());
+    }
+
+    @Test
+    public void testToNetworkList_ConvertsAllItemsInOrder() {
+        final NetworkVO first = mock(NetworkVO.class);
+        when(first.getUuid()).thenReturn("net-1");
+        when(first.getName()).thenReturn("first-net");
+        when(first.getDisplayText()).thenReturn("First network");
+        when(first.getPrivateMtu()).thenReturn(1400);
+
+        final NetworkVO second = mock(NetworkVO.class);
+        when(second.getUuid()).thenReturn("net-2");
+        when(second.getName()).thenReturn(null);
+        when(second.getTrafficType()).thenReturn(Networks.TrafficType.Control);
+        when(second.getDisplayText()).thenReturn("Second network");
+        when(second.getPrivateMtu()).thenReturn(null);
+
+        final List<Network> result = NetworkVOToNetworkConverter.toNetworkList(List.of(first, second), null);
+
+        assertEquals(2, result.size());
+        assertEquals("net-1", result.get(0).getId());
+        assertEquals("first-net", result.get(0).getName());
+        assertEquals("net-2", result.get(1).getId());
+        assertEquals("Control-net-2", result.get(1).getName());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java
new file mode 100644
index 000000000000..c8a57e90383a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToVnicProfileConverterTest {
+
+    @Test
+    public void testToVnicProfile_MapsNetworkAndDataCenterRefs() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-3");
+        when(vo.getName()).thenReturn("profile-net");
+        when(vo.getDisplayText()).thenReturn("Profile network");
+        when(vo.getDataCenterId()).thenReturn(30L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("dc-3");
+
+        final VnicProfile profile = NetworkVOToVnicProfileConverter.toVnicProfile(vo, id -> dc);
+
+        assertEquals("net-3", profile.getId());
+        assertEquals("profile-net", profile.getName());
+        assertEquals("Profile network", profile.getDescription());
+        assertEquals("net-3", profile.getNetwork().getId());
+        assertEquals("dc-3", profile.getDataCenter().getId());
+        assertTrue(profile.getHref().contains("/api/vnicprofiles/net-3"));
+        assertTrue(profile.getNetwork().getHref().contains("/api/networks/net-3"));
+    }
+
+    @Test
+    public void testToVnicProfile_UsesFallbackNameAndOmitsBlankDataCenterUuid() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-4");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getTrafficType()).thenReturn(Networks.TrafficType.Management);
+        when(vo.getDisplayText()).thenReturn("Mgmt network");
+        when(vo.getDataCenterId()).thenReturn(40L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("");
+
+        final VnicProfile profile = NetworkVOToVnicProfileConverter.toVnicProfile(vo, id -> dc);
+
+        assertEquals("Management-net-4", profile.getName());
+        assertEquals("Mgmt network", profile.getDescription());
+        assertEquals("net-4", profile.getNetwork().getId());
+        assertNull(profile.getDataCenter());
+    }
+
+    @Test
+    public void testToVnicProfileList_ConvertsAllItemsInOrder() {
+        final NetworkVO first = mock(NetworkVO.class);
+        when(first.getUuid()).thenReturn("net-1");
+        when(first.getName()).thenReturn("profile-a");
+        when(first.getDisplayText()).thenReturn("Profile A");
+
+        final NetworkVO second = mock(NetworkVO.class);
+        when(second.getUuid()).thenReturn("net-2");
+        when(second.getName()).thenReturn(null);
+        when(second.getTrafficType()).thenReturn(Networks.TrafficType.Control);
+        when(second.getDisplayText()).thenReturn("Profile B");
+
+        final List<VnicProfile> result = NetworkVOToVnicProfileConverter.toVnicProfileList(List.of(first, second), null);
+
+        assertEquals(2, result.size());
+        assertEquals("net-1", result.get(0).getId());
+        assertEquals("profile-a", result.get(0).getName());
+        assertEquals("net-2", result.get(1).getId());
+        assertEquals("Control-net-2", result.get(1).getName());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java
new file mode 100644
index 000000000000..cb60d8e081eb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.junit.Test;
+
+import com.cloud.network.dao.NetworkVO;
+
+public class NicVOToNicConverterTest {
+
+    @Test
+    public void testToNic_MapsVmHrefIpAndVnicProfile() {
+        final com.cloud.vm.NicVO vo = mock(com.cloud.vm.NicVO.class);
+        when(vo.getUuid()).thenReturn("nic-1");
+        when(vo.getReserver()).thenReturn("eth0");
+        when(vo.getMacAddress()).thenReturn("02:00:00:00:00:01");
+        when(vo.getIPv4Address()).thenReturn("10.1.1.10");
+        when(vo.getIPv4Gateway()).thenReturn("10.1.1.1");
+        when(vo.getNetworkId()).thenReturn(10L);
+
+        final NetworkVO network = mock(NetworkVO.class);
+        when(network.getUuid()).thenReturn("net-1");
+
+        final Nic nic = NicVOToNicConverter.toNic(vo, "vm-1", id -> network);
+
+        assertEquals("nic-1", nic.getId());
+        assertEquals("virtio", nic.getInterfaceType());
+        assertEquals("vm-1", nic.getVm().getId());
+        assertTrue(nic.getHref().contains("/api/vms/vm-1/nics/nic-1"));
+        assertEquals("net-1", nic.getVnicProfile().getId());
+        assertNotNull(nic.getReportedDevices());
+        assertEquals("v4", nic.getReportedDevices().getItems().get(0).getIps().getItems().get(0).getVersion());
+    }
+
+    @Test(expected = NullPointerException.class)
+    public void testToNic_BlankVmUuidCurrentBehaviorThrowsNpe() {
+        final com.cloud.vm.NicVO vo = mock(com.cloud.vm.NicVO.class);
+        when(vo.getUuid()).thenReturn("nic-2");
+        when(vo.getReserver()).thenReturn("eth1");
+        when(vo.getMacAddress()).thenReturn("02:00:00:00:00:02");
+
+        NicVOToNicConverter.toNic(vo, "", null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java
new file mode 100644
index 000000000000..6c607ea1f8c8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.junit.Test;
+
+import com.cloud.server.ResourceTag;
+import com.cloud.tags.ResourceTagVO;
+
+public class ResourceTagVOToTagConverterTest {
+
+    @Test
+    public void testGetRootTagAndRootRef() {
+        final Tag root = ResourceTagVOToTagConverter.getRootTag();
+
+        assertEquals(BaseDto.ZERO_UUID, root.getId());
+        assertEquals("root", root.getName());
+        assertNotNull(ResourceTagVOToTagConverter.getRootTagRef().getHref());
+    }
+
+    @Test
+    public void testToTag_FromResourceTagVoWithVmReference() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("env");
+        when(vo.getValue()).thenReturn("prod");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.UserVm);
+        when(vo.getResourceUuid()).thenReturn("vm-1");
+
+        final Tag tag = ResourceTagVOToTagConverter.toTag(vo);
+
+        assertEquals("prod", tag.getId());
+        assertEquals("prod", tag.getName());
+        assertNotNull(tag.getParent());
+        assertNotNull(tag.getVm());
+        assertEquals("vm-1", tag.getVm().getId());
+    }
+
+    @Test
+    public void testToTag_FromResourceTagVoWithoutVmReference() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("scope");
+        when(vo.getValue()).thenReturn("global");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.Volume);
+
+        final Tag tag = ResourceTagVOToTagConverter.toTag(vo);
+
+        assertEquals("global", tag.getId());
+        assertNull(tag.getVm());
+    }
+
+    @Test
+    public void testToTagsAndToTagsFromValues() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("team");
+        when(vo.getValue()).thenReturn("ops");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.UserVm);
+        when(vo.getResourceUuid()).thenReturn("vm-2");
+
+        assertEquals(1, ResourceTagVOToTagConverter.toTags(List.of(vo)).size());
+        assertEquals("ops", ResourceTagVOToTagConverter.toTagsFromValues(List.of("ops")).get(0).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java
new file mode 100644
index 000000000000..479dab2157cf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.ImageStoreJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.StoragePoolStatus;
+
+public class StoreVOToStorageDomainConverterTest {
+
+    @Test
+    public void testToStorageDomain_FromPrimaryPool() {
+        final StoragePoolJoinVO pool = mock(StoragePoolJoinVO.class);
+        when(pool.getUuid()).thenReturn("pool-1");
+        when(pool.getName()).thenReturn("Primary-1");
+        when(pool.getCapacityBytes()).thenReturn(1000L);
+        when(pool.getUsedBytes()).thenReturn(250L);
+        when(pool.getStatus()).thenReturn(StoragePoolStatus.Up);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        when(pool.getZoneUuid()).thenReturn("dc-1");
+
+        final StorageDomain sd = StoreVOToStorageDomainConverter.toStorageDomain(pool);
+
+        assertEquals("pool-1", sd.getId());
+        assertEquals("data", sd.getType());
+        assertEquals("active", sd.getStatus());
+        assertEquals("750", sd.getAvailable());
+        assertEquals("250", sd.getUsed());
+        assertEquals("1000", sd.getCommitted());
+        assertEquals("nfs", sd.getStorage().getType());
+        assertEquals("dc-1", sd.getDataCenters().getItems().get(0).getId());
+        assertTrue(sd.getLink().stream().anyMatch(l -> "disks".equals(l.getRel())));
+    }
+
+    @Test
+    public void testToStorageDomain_FromImageStore() {
+        final ImageStoreJoinVO store = mock(ImageStoreJoinVO.class);
+        when(store.getUuid()).thenReturn("img-1");
+        when(store.getName()).thenReturn("Secondary-1");
+        when(store.getProviderName()).thenReturn("glance");
+        when(store.getZoneUuid()).thenReturn("dc-2");
+
+        final StorageDomain sd = StoreVOToStorageDomainConverter.toStorageDomain(store);
+
+        assertEquals("img-1", sd.getId());
+        assertEquals("image", sd.getType());
+        assertEquals("unattached", sd.getStatus());
+        assertEquals("glance", sd.getStorage().getType());
+        assertEquals("dc-2", sd.getDataCenters().getItems().get(0).getId());
+        assertTrue(sd.getLink().stream().anyMatch(l -> "images".equals(l.getRel())));
+    }
+
+    @Test
+    public void testListConverters() {
+        final StoragePoolJoinVO pool = mock(StoragePoolJoinVO.class);
+        when(pool.getUuid()).thenReturn("p");
+        when(pool.getName()).thenReturn("P");
+        when(pool.getCapacityBytes()).thenReturn(10L);
+        when(pool.getUsedBytes()).thenReturn(2L);
+        when(pool.getStatus()).thenReturn(StoragePoolStatus.Up);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.Filesystem);
+        when(pool.getZoneUuid()).thenReturn("z");
+
+        final ImageStoreJoinVO store = mock(ImageStoreJoinVO.class);
+        when(store.getUuid()).thenReturn("s");
+        when(store.getName()).thenReturn("S");
+        when(store.getProviderName()).thenReturn("glance");
+        when(store.getZoneUuid()).thenReturn("z");
+
+        assertEquals(1, StoreVOToStorageDomainConverter.toStorageDomainListFromPools(List.of(pool)).size());
+        assertEquals(1, StoreVOToStorageDomainConverter.toStorageDomainListFromStores(List.of(store)).size());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java
new file mode 100644
index 000000000000..190976e232b8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java
@@ -0,0 +1,140 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.junit.Test;
+
+import org.apache.cloudstack.api.ApiConstants;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.vm.VirtualMachine;
+
+public class UserVmJoinVOToVmConverterTest {
+
+    @Test
+    public void testToVm_MapsUpStateWithBasicFields() {
+        final UserVmJoinVO src = mock(UserVmJoinVO.class);
+        when(src.getId()).thenReturn(101L);
+        when(src.getUuid()).thenReturn("vm-1");
+        when(src.getName()).thenReturn("vm-1-name");
+        when(src.getDisplayName()).thenReturn("vm-1-display");
+        when(src.getInstanceName()).thenReturn("i-101");
+        when(src.getState()).thenReturn(VirtualMachine.State.Running);
+        when(src.getCreated()).thenReturn(new Date(1000L));
+        when(src.getLastUpdated()).thenReturn(new Date(2000L));
+        when(src.getTemplateUuid()).thenReturn("tmpl-1");
+        when(src.getHostUuid()).thenReturn("host-1");
+        when(src.getRamSize()).thenReturn(512);
+        when(src.getArch()).thenReturn("x86_64");
+        when(src.getCpu()).thenReturn(2);
+        when(src.getGuestOsDisplayName()).thenReturn("Linux");
+        when(src.getServiceOfferingUuid()).thenReturn("offering-1");
+        when(src.getAccountUuid()).thenReturn("acct-1");
+        when(src.getAffinityGroupUuid()).thenReturn("ag-1");
+        when(src.getUserDataUuid()).thenReturn("ud-1");
+
+        final Vm vm = UserVmJoinVOToVmConverter.toVm(src, null, null, null, null, null, null, null, false);
+
+        assertEquals("vm-1", vm.getId());
+        assertEquals("vm-1-name", vm.getName());
+        assertEquals("vm-1-display", vm.getDescription());
+        assertEquals("up", vm.getStatus());
+        assertEquals(Long.valueOf(1000L), vm.getCreationTime());
+        assertEquals(Long.valueOf(2000L), vm.getStartTime());
+        assertNull(vm.getStopTime());
+        assertEquals("536870912", vm.getMemory());
+        assertEquals("x86_64", vm.getCpu().getArchitecture());
+        assertEquals("host-1", vm.getHost().getId());
+        assertNotNull(vm.getActions());
+        assertEquals(3, vm.getActions().getItems().size());
+    }
+
+    @Test
+    public void testToVm_UsesResolversAndMapsDownState() {
+        final UserVmJoinVO src = mock(UserVmJoinVO.class);
+        when(src.getId()).thenReturn(202L);
+        when(src.getUuid()).thenReturn("vm-2");
+        when(src.getName()).thenReturn("vm-2-name");
+        when(src.getDisplayName()).thenReturn("vm-2-display");
+        when(src.getInstanceName()).thenReturn("i-202");
+        when(src.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(src.getCreated()).thenReturn(new Date(3000L));
+        when(src.getLastUpdated()).thenReturn(new Date(4000L));
+        when(src.getTemplateUuid()).thenReturn("tmpl-2");
+        when(src.getHostUuid()).thenReturn(null);
+        when(src.getHostId()).thenReturn(22L);
+        when(src.getLastHostId()).thenReturn(null);
+        when(src.getRamSize()).thenReturn(1024);
+        when(src.getArch()).thenReturn("x86_64");
+        when(src.getCpu()).thenReturn(4);
+        when(src.getGuestOsDisplayName()).thenReturn("Linux");
+        when(src.getServiceOfferingUuid()).thenReturn("offering-2");
+        when(src.getAccountUuid()).thenReturn("acct-2");
+        when(src.getAffinityGroupUuid()).thenReturn("ag-2");
+        when(src.getUserDataUuid()).thenReturn("ud-2");
+
+        final HostJoinVO hostVo = mock(HostJoinVO.class);
+        when(hostVo.getUuid()).thenReturn("host-2");
+        when(hostVo.getClusterUuid()).thenReturn("cluster-2");
+
+        final Tag tag = new Tag();
+        tag.setId("tag-1");
+
+        final DiskAttachment disk = new DiskAttachment();
+        disk.setId("da-1");
+
+        final Nic nic = new Nic();
+        nic.setId("nic-1");
+
+        final Vm vm = UserVmJoinVOToVmConverter.toVm(
+                src,
+                id -> hostVo,
+                id -> Map.of(ApiConstants.BootType.UEFI.toString(), "true"),
+                id -> List.of(tag),
+                id -> List.of(disk),
+                ignored -> List.of(nic),
+                null,
+                null,
+                false);
+
+        assertEquals("down", vm.getStatus());
+        assertEquals(Long.valueOf(4000L), vm.getStopTime());
+        assertEquals("host-2", vm.getHost().getId());
+        assertEquals("cluster-2", vm.getCluster().getId());
+        assertEquals(1, vm.getTags().getItems().size());
+        assertEquals(1, vm.getDiskAttachments().getItems().size());
+        assertEquals(1, vm.getNics().getItems().size());
+        assertEquals("acct-2", vm.getAccountId());
+        assertEquals("ag-2", vm.getAffinityGroupId());
+        assertEquals("ud-2", vm.getUserDataId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java
new file mode 100644
index 000000000000..7fb0396fc685
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java
@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.junit.Test;
+
+public class UserVmVOToCheckpointConverterTest {
+
+    @Test
+    public void testToCheckpoint_ReturnsNullWhenCheckpointIdMissing() {
+        assertNull(UserVmVOToCheckpointConverter.toCheckpoint(null, "10"));
+        assertNull(UserVmVOToCheckpointConverter.toCheckpoint("", "10"));
+    }
+
+    @Test
+    public void testToCheckpoint_ParsesCreationTimeWhenProvided() {
+        final Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint("chk-1", "1700000000");
+
+        assertNotNull(checkpoint);
+        assertEquals("chk-1", checkpoint.getId());
+        assertEquals("chk-1", checkpoint.getName());
+        assertEquals(String.valueOf(1700000000L * 1000L), checkpoint.getCreationDate());
+        assertEquals("created", checkpoint.getState());
+    }
+
+    @Test
+    public void testToCheckpoint_UsesNowWhenCreateTimeInvalid() {
+        final long before = System.currentTimeMillis();
+        final Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint("chk-2", "not-a-number");
+        final long after = System.currentTimeMillis();
+
+        final long creation = Long.parseLong(checkpoint.getCreationDate());
+        assertTrue(creation >= before && creation <= after);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java
new file mode 100644
index 000000000000..75a36c13a4dc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java
@@ -0,0 +1,74 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.junit.Test;
+
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+
+public class VmSnapshotVOToSnapshotConverterTest {
+
+    @Test
+    public void testToSnapshot_MapsReadyDiskAndMemorySnapshot() {
+        final VMSnapshotVO vo = mock(VMSnapshotVO.class);
+        when(vo.getUuid()).thenReturn("snap-1");
+        when(vo.getDescription()).thenReturn("desc");
+        when(vo.getCreated()).thenReturn(new Date(1234L));
+        when(vo.getType()).thenReturn(VMSnapshotVO.Type.DiskAndMemory);
+        when(vo.getState()).thenReturn(VMSnapshot.State.Ready);
+
+        final Snapshot snapshot = VmSnapshotVOToSnapshotConverter.toSnapshot(vo, "vm-1");
+
+        assertEquals("snap-1", snapshot.getId());
+        assertTrue(snapshot.getHref().contains("/api/vms/vm-1/snapshots/snap-1"));
+        assertEquals("vm-1", snapshot.getVm().getId());
+        assertEquals("desc", snapshot.getDescription());
+        assertEquals(Long.valueOf(1234L), snapshot.getDate());
+        assertEquals("true", snapshot.getPersistMemorystate());
+        assertEquals("ok", snapshot.getSnapshotStatus());
+        assertEquals("link", snapshot.getActions().asMap().keySet().iterator().next());
+    }
+
+    @Test
+    public void testToSnapshot_MapsNonReadyToLockedAndToSnapshotList() {
+        final VMSnapshotVO vo = mock(VMSnapshotVO.class);
+        when(vo.getUuid()).thenReturn("snap-2");
+        when(vo.getDescription()).thenReturn("desc2");
+        when(vo.getCreated()).thenReturn(new Date(5678L));
+        when(vo.getType()).thenReturn(VMSnapshotVO.Type.Disk);
+        when(vo.getState()).thenReturn(VMSnapshot.State.Creating);
+
+        final Snapshot snapshot = VmSnapshotVOToSnapshotConverter.toSnapshot(vo, "vm-2");
+        assertEquals("false", snapshot.getPersistMemorystate());
+        assertEquals("locked", snapshot.getSnapshotStatus());
+
+        final List<Snapshot> list = VmSnapshotVOToSnapshotConverter.toSnapshotList(List.of(vo), "vm-2");
+        assertEquals(1, list.size());
+        assertEquals("snap-2", list.get(0).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java
new file mode 100644
index 000000000000..ae4d5961748b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+
+public class VolumeJoinVOToDiskConverterTest {
+
+    @Test
+    public void testToDisk_MapsCoreFieldsAndResolverOverridesActualSize() {
+        final VolumeJoinVO vol = mock(VolumeJoinVO.class);
+        when(vol.getUuid()).thenReturn("vol-1");
+        when(vol.getVolumeType()).thenReturn(Volume.Type.ROOT);
+        when(vol.getName()).thenReturn("root-disk");
+        when(vol.getSize()).thenReturn(1000L);
+        when(vol.getVolumeStoreSize()).thenReturn(500L);
+        when(vol.getFormat()).thenReturn(Storage.ImageFormat.RAW);
+        when(vol.getState()).thenReturn(Volume.State.Ready);
+        when(vol.getPath()).thenReturn("path-1");
+        when(vol.getDiskOfferingUuid()).thenReturn("do-1");
+        when(vol.getPoolUuid()).thenReturn("pool-1");
+
+        final Disk disk = VolumeJoinVOToDiskConverter.toDisk(vol, v -> 700L);
+
+        assertEquals("vol-1", disk.getId());
+        assertEquals("true", disk.getBootable());
+        assertEquals("raw", disk.getFormat());
+        assertEquals("ok", disk.getStatus());
+        assertEquals("700", disk.getActualSize());
+        assertNotNull(disk.getStorageDomains());
+        assertTrue(disk.getHref().contains("/api/disks/vol-1"));
+    }
+
+    @Test
+    public void testToDiskAttachment_MapsVmAndDisk() {
+        final VolumeJoinVO vol = mock(VolumeJoinVO.class);
+        when(vol.getUuid()).thenReturn("vol-2");
+        when(vol.getVmUuid()).thenReturn("vm-2");
+        when(vol.getVolumeType()).thenReturn(Volume.Type.DATADISK);
+        when(vol.getName()).thenReturn("data-disk");
+        when(vol.getSize()).thenReturn(2048L);
+        when(vol.getVolumeStoreSize()).thenReturn(1024L);
+        when(vol.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
+        when(vol.getState()).thenReturn(Volume.State.Allocated);
+        when(vol.getPath()).thenReturn("path-2");
+        when(vol.getDiskOfferingUuid()).thenReturn("do-2");
+        when(vol.getPoolUuid()).thenReturn("pool-2");
+
+        final DiskAttachment da = VolumeJoinVOToDiskConverter.toDiskAttachment(vol, null);
+
+        assertEquals("vol-2", da.getId());
+        assertEquals("vm-2", da.getVm().getId());
+        assertEquals("false", da.getBootable());
+        assertEquals("virtio_scsi", da.getIface());
+        assertEquals("vol-2", da.getDisk().getId());
+    }
+
+    @Test
+    public void testToDiskListFromVolumeInfos_MapsBootableByVolumeType() {
+        final Backup.VolumeInfo root = new Backup.VolumeInfo("root-id", "p1", Volume.Type.ROOT, 10L, 0L, "do", 0L, 0L);
+        final Backup.VolumeInfo data = new Backup.VolumeInfo("data-id", "p2", Volume.Type.DATADISK, 20L, 1L, "do", 0L, 0L);
+
+        final List<Disk> result = VolumeJoinVOToDiskConverter.toDiskListFromVolumeInfos(List.of(root, data));
+
+        assertEquals(2, result.size());
+        assertEquals("true", result.get(0).getBootable());
+        assertEquals("false", result.get(1).getBootable());
+        assertEquals("20", result.get(1).getTotalSize());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java
new file mode 100644
index 000000000000..418b8ba79dcd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertNotNull;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class BackupTest {
+    @Test
+    public void gettersSetters() {
+        Backup backup = new Backup();
+        backup.setName("backup-vm1");
+        backup.setDescription("Full backup");
+        backup.setCreationDate(1714465200000L);
+        backup.setPhase("succeeded");
+        backup.setFromCheckpointId("cp-1");
+        backup.setToCheckpointId("cp-2");
+        assertEquals("backup-vm1", backup.getName());
+        assertEquals("Full backup", backup.getDescription());
+        assertEquals(Long.valueOf(1714465200000L), backup.getCreationDate());
+        assertEquals("succeeded", backup.getPhase());
+        assertEquals("cp-1", backup.getFromCheckpointId());
+        assertEquals("cp-2", backup.getToCheckpointId());
+    }
+
+    @Test
+    public void gettersSetters_VmAndHost() {
+        Backup backup = new Backup();
+        Vm vm = Vm.of("/api/vms/v1", "v1");
+        Host host = Host.of("/api/hosts/h1", "h1");
+        backup.setVm(vm);
+        backup.setHost(host);
+        assertEquals("v1", backup.getVm().getId());
+        assertEquals("h1", backup.getHost().getId());
+    }
+
+    @Test
+    public void disks_NamedList() {
+        Backup backup = new Backup();
+        Disk disk = new Disk();
+        disk.setName("disk-1");
+        NamedList<Disk> disks = NamedList.of("disk", Collections.singletonList(disk));
+        backup.setDisks(disks);
+        assertNotNull(backup.getDisks());
+        assertEquals(1, backup.getDisks().getItems().size());
+        assertEquals("disk-1", backup.getDisks().getItems().get(0).getName());
+    }
+
+    @Test
+    public void json_ContainsNameAndPhase() throws Exception {
+        Mapper mapper = new Mapper();
+        Backup backup = new Backup();
+        backup.setName("nightly");
+        backup.setPhase("running");
+        String json = mapper.toJson(backup);
+        assertTrue(json.contains("\"name\":\"nightly\""));
+        assertTrue(json.contains("\"phase\":\"running\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java
new file mode 100644
index 000000000000..9b776bac5618
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class BaseDtoTest {
+    @Test
+    public void zeroUuid_ConstantValue() {
+        assertEquals("00000000-0000-0000-0000-000000000000", BaseDto.ZERO_UUID);
+    }
+
+    @Test
+    public void getActionLink_BuildsRelAndHref() {
+        Link link = BaseDto.getActionLink("start", "/ovirt-engine/api/vms/1");
+        assertEquals("start", link.getRel());
+        assertEquals("/ovirt-engine/api/vms/1/start", link.getHref());
+    }
+
+    @Test
+    public void ref_of_SetsHrefAndId() {
+        Ref ref = Ref.of("https://host/api/templates/abc", "abc");
+        assertEquals("https://host/api/templates/abc", ref.getHref());
+        assertEquals("abc", ref.getId());
+    }
+
+    @Test
+    public void link_of_SetsRelAndHref() {
+        Link link = Link.of("edit", "/api/vms/1");
+        assertEquals("edit", link.getRel());
+        assertEquals("/api/vms/1", link.getHref());
+    }
+
+    @Test
+    public void ref_JsonOmitsNullId() throws Exception {
+        Mapper mapper = new Mapper();
+        Ref ref = new Ref();
+        ref.setHref("/api/vms/1");
+        String json = mapper.toJson(ref);
+        assertTrue(json.contains("\"href\":\"/api/vms/1\""));
+        assertFalse(json.contains("\"id\""));
+    }
+
+    @Test
+    public void link_JsonContainsRelAndHref() throws Exception {
+        Mapper mapper = new Mapper();
+        Link link = Link.of("delete", "/api/disks/7");
+        String json = mapper.toJson(link);
+        assertTrue(json.contains("\"rel\":\"delete\""));
+        assertTrue(json.contains("\"href\":\"/api/disks/7\""));
+    }
+
+    @Test
+    public void baseDto_GettersSetters() {
+        Ref ref = new Ref();
+        assertNull(ref.getHref());
+        assertNull(ref.getId());
+        ref.setHref("/test");
+        ref.setId("id-1");
+        assertEquals("/test", ref.getHref());
+        assertEquals("id-1", ref.getId());
+    }
+
+    @Test
+    public void vmOf_SetsHrefAndId() {
+        Vm vm = Vm.of("/ovirt-engine/api/vms/1", "1");
+        assertNotNull(vm);
+        assertEquals("/ovirt-engine/api/vms/1", vm.getHref());
+        assertEquals("1", vm.getId());
+    }
+
+    @Test
+    public void hostOf_SetsHrefAndId() {
+        Host host = Host.of("/ovirt-engine/api/hosts/h1", "h1");
+        assertNotNull(host);
+        assertEquals("/ovirt-engine/api/hosts/h1", host.getHref());
+        assertEquals("h1", host.getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java
new file mode 100644
index 000000000000..695082ce38cc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class CertificateTest {
+    @Test
+    public void gettersSetters() {
+        Certificate cert = new Certificate();
+        cert.setOrganization("Apache");
+        cert.setSubject("CN=cloudstack.apache.org");
+        assertEquals("Apache", cert.getOrganization());
+        assertEquals("CN=cloudstack.apache.org", cert.getSubject());
+    }
+
+    @Test
+    public void json_IncludesOrganizationAndSubject() throws Exception {
+        Mapper mapper = new Mapper();
+        Certificate cert = new Certificate();
+        cert.setOrganization("Apache");
+        cert.setSubject("CN=host");
+        String json = mapper.toJson(cert);
+        assertTrue(json.contains("\"organization\":\"Apache\""));
+        assertTrue(json.contains("\"subject\":\"CN=host\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java
new file mode 100644
index 000000000000..5af29f9fff44
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java
@@ -0,0 +1,68 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class DiskTest {
+    @Test
+    public void gettersSetters() {
+        Disk disk = new Disk();
+        disk.setName("root-disk");
+        disk.setAlias("vm-alias");
+        disk.setFormat("cow");
+        disk.setProvisionedSize("10737418240");
+        disk.setActualSize("2147483648");
+        disk.setStatus("ok");
+        disk.setImageId("img-uuid-1");
+        disk.setBootable("true");
+        assertEquals("root-disk", disk.getName());
+        assertEquals("vm-alias", disk.getAlias());
+        assertEquals("cow", disk.getFormat());
+        assertEquals("10737418240", disk.getProvisionedSize());
+        assertEquals("2147483648", disk.getActualSize());
+        assertEquals("ok", disk.getStatus());
+        assertEquals("img-uuid-1", disk.getImageId());
+        assertEquals("true", disk.getBootable());
+    }
+
+    @Test
+    public void json_ContainsFormatAndName() throws Exception {
+        Mapper mapper = new Mapper();
+        Disk disk = new Disk();
+        disk.setName("data-disk");
+        disk.setFormat("raw");
+        String json = mapper.toJson(disk);
+        assertTrue(json.contains("\"name\":\"data-disk\""));
+        assertTrue(json.contains("\"format\":\"raw\""));
+    }
+
+    @Test
+    public void json_OmitsNullOptionals() throws Exception {
+        Mapper mapper = new Mapper();
+        Disk disk = new Disk();
+        disk.setName("minimal");
+        String json = mapper.toJson(disk);
+        assertFalse(json.contains("\"alias\""));
+        assertFalse(json.contains("\"bootable\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java
new file mode 100644
index 000000000000..129fcf4e60f0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class DtoSerializationTest {
+
+    @Test
+    public void diskAttachmentJson_UsesInterfaceProperty() throws Exception {
+        Mapper mapper = new Mapper();
+        DiskAttachment diskAttachment = new DiskAttachment();
+        diskAttachment.setIface("virtio_scsi");
+
+        String json = mapper.toJson(diskAttachment);
+
+        assertTrue(json.contains("\"interface\":\"virtio_scsi\""));
+        assertFalse(json.contains("\"iface\""));
+    }
+
+    @Test
+    public void nicJson_UsesInterfacePropertyAndRoundTrips() throws Exception {
+        Mapper mapper = new Mapper();
+        Nic nic = new Nic();
+        nic.setInterfaceType("virtio");
+
+        String json = mapper.toJson(nic);
+        Nic read = mapper.jsonMapper().readValue(json, Nic.class);
+
+        assertTrue(json.contains("\"interface\":\"virtio\""));
+        assertFalse(json.contains("interface_type"));
+        assertEquals("virtio", read.getInterfaceType());
+    }
+
+    @Test
+    public void vmJson_IgnoresCloudStackSpecificFields() throws Exception {
+        Mapper mapper = new Mapper();
+        Vm vm = new Vm();
+        vm.setName("vm-1");
+        vm.setAccountId("account-uuid");
+        vm.setAffinityGroupId("affinity-uuid");
+        vm.setUserDataId("userdata-uuid");
+
+        String json = mapper.toJson(vm);
+
+        assertTrue(json.contains("\"name\":\"vm-1\""));
+        assertFalse(json.contains("account_id"));
+        assertFalse(json.contains("affinity_group_id"));
+        assertFalse(json.contains("user_data_id"));
+    }
+
+    @Test
+    public void vmXml_WritesEmptyElements() throws Exception {
+        Mapper mapper = new Mapper();
+        Vm vm = new Vm();
+
+        String xml = mapper.toXml(vm);
+
+        assertTrue(xml.contains("<io/>"));
+        assertTrue(xml.contains("<migration/>"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java
new file mode 100644
index 000000000000..5dc7078ea028
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class FaultTest {
+    @Test
+    public void constructor_SetsReasonAndDetail() {
+        Fault fault = new Fault("Not Found", "Entity was not found");
+        assertEquals("Not Found", fault.getReason());
+        assertEquals("Entity was not found", fault.getDetail());
+    }
+
+    @Test
+    public void json_ContainsReasonAndDetail() throws Exception {
+        Mapper mapper = new Mapper();
+        Fault fault = new Fault("Unauthorized", "Invalid credentials");
+        String json = mapper.toJson(fault);
+        assertTrue(json.contains("\"reason\":\"Unauthorized\""));
+        assertTrue(json.contains("\"detail\":\"Invalid credentials\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java
new file mode 100644
index 000000000000..44d1deae33f8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class HostTest {
+    @Test
+    public void of_SetsHrefAndId() {
+        Host host = Host.of("/api/hosts/h1", "h1");
+        assertNotNull(host);
+        assertEquals("/api/hosts/h1", host.getHref());
+        assertEquals("h1", host.getId());
+    }
+
+    @Test
+    public void gettersSetters_CoreFields() {
+        Host host = new Host();
+        host.setAddress("192.168.1.10");
+        host.setStatus("up");
+        host.setName("kvm-host-01");
+        host.setPort("54321");
+        assertEquals("192.168.1.10", host.getAddress());
+        assertEquals("up", host.getStatus());
+        assertEquals("kvm-host-01", host.getName());
+        assertEquals("54321", host.getPort());
+    }
+
+    @Test
+    public void hardwareInformation_GettersSetters() {
+        Host.HardwareInformation hw = new Host.HardwareInformation();
+        hw.setManufacturer("Dell");
+        hw.setProductName("PowerEdge R740");
+        hw.setSerialNumber("SN12345");
+        hw.setUuid("uuid-001");
+        hw.setVersion("1.0");
+        assertEquals("Dell", hw.getManufacturer());
+        assertEquals("PowerEdge R740", hw.getProductName());
+        assertEquals("SN12345", hw.getSerialNumber());
+        assertEquals("uuid-001", hw.getUuid());
+        assertEquals("1.0", hw.getVersion());
+    }
+
+    @Test
+    public void hostJson_ContainsAddressAndStatus() throws Exception {
+        Mapper mapper = new Mapper();
+        Host host = new Host();
+        host.setAddress("10.0.0.1");
+        host.setStatus("up");
+        String json = mapper.toJson(host);
+        assertTrue(json.contains("\"address\":\"10.0.0.1\""));
+        assertTrue(json.contains("\"status\":\"up\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java
new file mode 100644
index 000000000000..1a8c64ce5602
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class ImageTransferTest {
+    @Test
+    public void gettersSetters() {
+        ImageTransfer it = new ImageTransfer();
+        it.setPhase("initializing");
+        it.setDirection("upload");
+        it.setFormat("raw");
+        it.setTransferUrl("http://host:54322/images/xxx");
+        it.setTransferred("0");
+        it.setActive("true");
+        assertEquals("initializing", it.getPhase());
+        assertEquals("upload", it.getDirection());
+        assertEquals("raw", it.getFormat());
+        assertEquals("http://host:54322/images/xxx", it.getTransferUrl());
+        assertEquals("0", it.getTransferred());
+        assertEquals("true", it.getActive());
+    }
+
+    @Test
+    public void hostAndDiskRefs() {
+        ImageTransfer it = new ImageTransfer();
+        Ref host = Ref.of("/api/hosts/h1", "h1");
+        Ref disk = Ref.of("/api/disks/d1", "d1");
+        Ref image = Ref.of("/api/images/img1", "img1");
+        it.setHost(host);
+        it.setDisk(disk);
+        it.setImage(image);
+        assertEquals("h1", it.getHost().getId());
+        assertEquals("d1", it.getDisk().getId());
+        assertEquals("img1", it.getImage().getId());
+    }
+
+    @Test
+    public void json_ContainsPhaseAndDirection() throws Exception {
+        Mapper mapper = new Mapper();
+        ImageTransfer it = new ImageTransfer();
+        it.setPhase("transferring");
+        it.setDirection("download");
+        String json = mapper.toJson(it);
+        assertTrue(json.contains("\"phase\":\"transferring\""));
+        assertTrue(json.contains("\"direction\":\"download\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java
new file mode 100644
index 000000000000..37157c889fed
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertFalse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class MacIpTest {
+    @Test
+    public void mac_GettersSetters() {
+        Mac mac = new Mac();
+        mac.setAddress("02:00:00:00:00:01");
+        assertEquals("02:00:00:00:00:01", mac.getAddress());
+    }
+
+    @Test
+    public void mac_JsonSerializes() throws Exception {
+        Mapper mapper = new Mapper();
+        Mac mac = new Mac();
+        mac.setAddress("aa:bb:cc:dd:ee:ff");
+        String json = mapper.toJson(mac);
+        assertTrue(json.contains("\"address\":\"aa:bb:cc:dd:ee:ff\""));
+    }
+
+    @Test
+    public void ip_GettersSetters() {
+        Ip ip = new Ip();
+        ip.setAddress("192.168.1.1");
+        ip.setGateway("192.168.1.254");
+        ip.setNetmask("255.255.255.0");
+        ip.setVersion("v4");
+        assertEquals("192.168.1.1", ip.getAddress());
+        assertEquals("192.168.1.254", ip.getGateway());
+        assertEquals("255.255.255.0", ip.getNetmask());
+        assertEquals("v4", ip.getVersion());
+    }
+
+    @Test
+    public void ip_JsonOmitsNullGateway() throws Exception {
+        Mapper mapper = new Mapper();
+        Ip ip = new Ip();
+        ip.setAddress("10.0.0.1");
+        ip.setVersion("v4");
+        String json = mapper.toJson(ip);
+        assertTrue(json.contains("\"address\":\"10.0.0.1\""));
+        assertFalse(json.contains("\"gateway\""));
+        assertFalse(json.contains("\"netmask\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java
new file mode 100644
index 000000000000..5c50638711f5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java
@@ -0,0 +1,93 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.Test;
+
+public class NamedListTest {
+
+    @Test
+    public void of_NullItems_UsesEmptyList() {
+        NamedList<String> namedList = NamedList.of("item", null);
+
+        assertNotNull(namedList.getItems());
+        assertTrue(namedList.getItems().isEmpty());
+        assertTrue(namedList.asMap().containsKey("item"));
+    }
+
+    @Test
+    public void of_ValidName_StoresItemsInMap() {
+        List<String> values = Arrays.asList("a", "b");
+        NamedList<String> namedList = NamedList.of("values", values);
+
+        assertEquals(values, namedList.getItems());
+        assertEquals(values, namedList.asMap().get("values"));
+    }
+
+    @Test
+    public void of_EmptyName_ThrowsIllegalArgumentException() {
+        try {
+            NamedList.of("", Collections.singletonList("x"));
+            fail("Expected IllegalArgumentException for empty name");
+        } catch (IllegalArgumentException e) {
+            assertEquals("name must be non-empty", e.getMessage());
+        }
+    }
+
+    @Test
+    public void fromMap_InvalidMapShape_ThrowsIllegalArgumentException() {
+        try {
+            NamedList.fromMap(null);
+            fail("Expected IllegalArgumentException for null map");
+        } catch (IllegalArgumentException e) {
+            assertEquals("Expected single-property object for NamedList", e.getMessage());
+        }
+
+        Map<String, List<String>> invalid = new HashMap<>();
+        invalid.put("a", Collections.singletonList("x"));
+        invalid.put("b", Collections.singletonList("y"));
+
+        try {
+            NamedList.fromMap(invalid);
+            fail("Expected IllegalArgumentException for map with multiple keys");
+        } catch (IllegalArgumentException e) {
+            assertEquals("Expected single-property object for NamedList", e.getMessage());
+        }
+    }
+
+    @Test
+    public void fromMap_SingleEntry_ReturnsNamedList() {
+        Map<String, List<String>> map = Collections.singletonMap("usage", Collections.singletonList("vm"));
+
+        NamedList<String> namedList = NamedList.fromMap(map);
+
+        assertEquals(Collections.singletonList("vm"), namedList.getItems());
+        assertEquals(map, namedList.asMap());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java
new file mode 100644
index 000000000000..da941aaa3897
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.apache.logging.log4j.Logger;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+
+@RunWith(MockitoJUnitRunner.class)
+public class OvfXmlUtilTest {
+
+    String configuration = "<ovf:Envelope xmlns:ovf=\"http://schemas.dmtf.org/ovf/envelope/1/\" xmlns:rasd=\"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData\" xmlns:vssd=\"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" ovf:version=\"4.4.0.0\">" +
+            "<Content ovf:id=\"out\" xsi:type=\"ovf:VirtualSystem_Type\"><Name>adm-v9</Name><Description>adm-v9</Description>" +
+            "<Section xsi:type=\"ovf:VirtualHardwareSection_Type\"><Info>1 CPU, 512 Memory</Info><System><vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType></System><Item><rasd:Caption>1 virtual cpu</rasd:Caption><rasd:Description>Number of virtual CPU</rasd:Description><rasd:InstanceId>1</rasd:InstanceId><rasd:ResourceType>3</rasd:ResourceType><rasd:num_of_sockets>1</rasd:num_of_sockets><rasd:cpu_per_socket>1</rasd:cpu_per_socket><rasd:threads_per_cpu>1</rasd:threads_per_cpu><rasd:max_num_of_vcpus>1</rasd:max_num_of_vcpus><rasd:VirtualQuantity>1</rasd:VirtualQuantity></Item>" +
+            "<Item><rasd:Caption>512 MB of memory</rasd:Caption><rasd:Description>Memory Size</rasd:Description><rasd:InstanceId>2</rasd:InstanceId><rasd:ResourceType>4</rasd:ResourceType><rasd:AllocationUnits>MegaBytes</rasd:AllocationUnits><rasd:VirtualQuantity>512</rasd:VirtualQuantity></Item>" +
+            "</Section></Content></ovf:Envelope>";
+
+    @Test
+    public void updateFromXml_parsesDetails() {
+        Vm vm = new Vm();
+        OvfXmlUtil.updateFromXml(vm, configuration);
+
+        assertEquals(String.valueOf(512 * OvfXmlUtil.MemoryAllocationUnit.Megabytes.getBytesMultiplier()), vm.getMemory());
+        assertEquals("1", vm.getCpu().getTopology().getSockets());
+        assertEquals("1", vm.getCpu().getTopology().getCores());
+        assertEquals("1", vm.getCpu().getTopology().getThreads());
+    }
+
+    @Test
+    public void test_restoreConfig_parse() throws Exception {
+        Vm vm = mock(Vm.class);
+        Vm.Initialization initialization = mock(Vm.Initialization.class);
+        Vm.Initialization.Configuration configMock = mock(Vm.Initialization.Configuration.class);
+        when(initialization.getConfiguration()).thenReturn(configMock);
+        when(vm.getInitialization()).thenReturn(initialization);
+        String ovfXml;
+        try (InputStream is = getClass().getClassLoader().getResourceAsStream("test-ovf.xml")) {
+            assertNotNull(is);
+            ovfXml = new String(is.readAllBytes(), StandardCharsets.UTF_8);
+        }
+        when(configMock.getType()).thenReturn("ovf");
+        when(configMock.getData()).thenReturn(ovfXml);
+
+        String instanceConfig = OvfXmlUtil.getConfigMetadataXml(vm, mock(Logger.class));
+        assertNotNull(instanceConfig);
+        assertTrue(instanceConfig.contains("ovf:CloudStackMetadata_Type"));
+        assertTrue(instanceConfig.contains("<NetworkId>6aff2178-a323-4148-a592-edbd47b93229</NetworkId>"));
+
+        Pair<String, String> result = OvfXmlUtil.getVmNicDetailFromStoredConfig(instanceConfig, "6aff2178-a323-4148-a592-edbd47b93229", mock(Logger.class));
+        assertNotNull(result);
+        assertEquals("02:01:00:cf:00:05", result.first());
+        assertEquals("10.1.1.40", result.second());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java
new file mode 100644
index 000000000000..318631cd26f5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class ProductInfoApiTest {
+    // ---- ProductInfo -------------------------------------------------------
+    @Test
+    public void productInfo_GettersSetters() {
+        ProductInfo info = new ProductInfo();
+        info.setInstanceId("inst-1");
+        info.setName("oVirt Engine");
+        Version version = new Version();
+        version.setMajor("4");
+        version.setMinor("23");
+        info.setVersion(version);
+        assertEquals("inst-1", info.getInstanceId());
+        assertEquals("oVirt Engine", info.getName());
+        assertNotNull(info.getVersion());
+        assertEquals("4", info.getVersion().getMajor());
+        assertEquals("23", info.getVersion().getMinor());
+    }
+
+    @Test
+    public void productInfoJson_ContainsInstanceId() throws Exception {
+        Mapper mapper = new Mapper();
+        ProductInfo info = new ProductInfo();
+        info.setInstanceId("inst-abc");
+        info.setName("CloudStack");
+        String json = mapper.toJson(info);
+        assertTrue(json.contains("\"instance_id\":\"inst-abc\""));
+        assertTrue(json.contains("\"name\":\"CloudStack\""));
+    }
+
+    // ---- SpecialObjects ----------------------------------------------------
+    @Test
+    public void specialObjects_GettersSetters() {
+        SpecialObjects so = new SpecialObjects();
+        Ref blank = Ref.of("/api/templates/blank", "blank");
+        Ref root = Ref.of("/api/tags/root", "root");
+        so.setBlankTemplate(blank);
+        so.setRootTag(root);
+        assertEquals("blank", so.getBlankTemplate().getId());
+        assertEquals("root", so.getRootTag().getId());
+    }
+
+    // ---- ApiSummary --------------------------------------------------------
+    @Test
+    public void apiSummary_HostsAndVms() {
+        ApiSummary summary = new ApiSummary();
+        SummaryCount hosts = new SummaryCount(2, 5);
+        SummaryCount vms = new SummaryCount(10, 20);
+        summary.setHosts(hosts);
+        summary.setVms(vms);
+        assertEquals("2", summary.getHosts().getActive());
+        assertEquals("5", summary.getHosts().getTotal());
+        assertEquals("10", summary.getVms().getActive());
+        assertEquals("20", summary.getVms().getTotal());
+    }
+
+    // ---- Api root -----------------------------------------------------------
+    @Test
+    public void api_GettersSetters() {
+        Api api = new Api();
+        api.setTime(1714465200000L);
+        ProductInfo info = new ProductInfo();
+        info.setName("CloudStack");
+        api.setProductInfo(info);
+        Ref authUser = Ref.of("/api/users/admin", "admin");
+        api.setAuthenticatedUser(authUser);
+        assertEquals(Long.valueOf(1714465200000L), api.getTime());
+        assertEquals("CloudStack", api.getProductInfo().getName());
+        assertEquals("admin", api.getAuthenticatedUser().getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java
new file mode 100644
index 000000000000..f3f40d064edf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java
@@ -0,0 +1,51 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class SnapshotTest {
+    @Test
+    public void gettersSetters() {
+        Snapshot snapshot = new Snapshot();
+        snapshot.setDate(1714465200000L);
+        snapshot.setSnapshotType("regular");
+        snapshot.setSnapshotStatus("ok");
+        snapshot.setDescription("Daily backup");
+        snapshot.setPersistMemorystate("false");
+        assertEquals(Long.valueOf(1714465200000L), snapshot.getDate());
+        assertEquals("regular", snapshot.getSnapshotType());
+        assertEquals("ok", snapshot.getSnapshotStatus());
+        assertEquals("Daily backup", snapshot.getDescription());
+        assertEquals("false", snapshot.getPersistMemorystate());
+    }
+
+    @Test
+    public void json_ContainsSnapshotTypeAndDate() throws Exception {
+        Mapper mapper = new Mapper();
+        Snapshot snapshot = new Snapshot();
+        snapshot.setSnapshotType("memory");
+        snapshot.setDate(1000L);
+        String json = mapper.toJson(snapshot);
+        assertTrue(json.contains("\"snapshot_type\":\"memory\""));
+        assertTrue(json.contains("\"date\":1000"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java
new file mode 100644
index 000000000000..4c0d4f4eaea2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java
@@ -0,0 +1,53 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class StorageDomainTest {
+    @Test
+    public void gettersSetters() {
+        StorageDomain sd = new StorageDomain();
+        sd.setName("data-domain");
+        sd.setType("data");
+        sd.setStatus("active");
+        sd.setAvailable("107374182400");
+        sd.setUsed("21474836480");
+        sd.setStorageFormat("v5");
+        assertEquals("data-domain", sd.getName());
+        assertEquals("data", sd.getType());
+        assertEquals("active", sd.getStatus());
+        assertEquals("107374182400", sd.getAvailable());
+        assertEquals("21474836480", sd.getUsed());
+        assertEquals("v5", sd.getStorageFormat());
+    }
+
+    @Test
+    public void json_ContainsNameAndType() throws Exception {
+        Mapper mapper = new Mapper();
+        StorageDomain sd = new StorageDomain();
+        sd.setName("nfs-storage");
+        sd.setType("data");
+        String json = mapper.toJson(sd);
+        assertTrue(json.contains("\"name\":\"nfs-storage\""));
+        assertTrue(json.contains("\"type\":\"data\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java
new file mode 100644
index 000000000000..a6032e571934
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertFalse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class SummaryCountTest {
+    @Test
+    public void constructor_IntValues_ConvertsToStrings() {
+        SummaryCount count = new SummaryCount(3, 10);
+        assertEquals("3", count.getActive());
+        assertEquals("10", count.getTotal());
+    }
+
+    @Test
+    public void defaultConstructor_NullValues() {
+        SummaryCount count = new SummaryCount();
+        assertNull(count.getActive());
+        assertNull(count.getTotal());
+    }
+
+    @Test
+    public void json_OmitsNullFields() throws Exception {
+        Mapper mapper = new Mapper();
+        SummaryCount count = new SummaryCount();
+        String json = mapper.toJson(count);
+        assertFalse(json.contains("active"));
+        assertFalse(json.contains("total"));
+    }
+
+    @Test
+    public void json_IncludesPopulatedFields() throws Exception {
+        Mapper mapper = new Mapper();
+        SummaryCount count = new SummaryCount(5, 20);
+        String json = mapper.toJson(count);
+        assertEquals("{\"active\":\"5\",\"total\":\"20\"}", json);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java
new file mode 100644
index 000000000000..c385977e0e40
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java
@@ -0,0 +1,78 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class TopologyTest {
+
+    @Test
+    public void constructor_IntValues_ConvertsToStrings() {
+        Topology topology = new Topology(2, 4, 1);
+
+        assertEquals("2", topology.getSockets());
+        assertEquals("4", topology.getCores());
+        assertEquals("1", topology.getThreads());
+    }
+
+    @Test
+    public void defaultConstructor_NullFields() {
+        Topology topology = new Topology();
+
+        assertNull(topology.getSockets());
+        assertNull(topology.getCores());
+        assertNull(topology.getThreads());
+    }
+
+    @Test
+    public void cpuWithTopology_Serializes() throws Exception {
+        Mapper mapper = new Mapper();
+        Cpu cpu = new Cpu();
+        cpu.setName("Intel Xeon");
+        cpu.setArchitecture("x86_64");
+        Topology topology = new Topology(4, 8, 2);
+        cpu.setTopology(topology);
+
+        String json = mapper.toJson(cpu);
+
+        assertNotNull(json);
+        // Mapper uses SNAKE_CASE, so field names become snake_case
+        assertEquals("Intel Xeon", cpu.getName());
+        assertEquals("x86_64", cpu.getArchitecture());
+        assertEquals(topology, cpu.getTopology());
+    }
+
+    @Test
+    public void topologyJson_OmitsNullFields() throws Exception {
+        Mapper mapper = new Mapper();
+        Topology topology = new Topology();
+        topology.setSockets("2");
+
+        String json = mapper.toJson(topology);
+
+        assertNotNull(json);
+        // only sockets is set
+        assertEquals("2", topology.getSockets());
+        assertNull(topology.getCores());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java
new file mode 100644
index 000000000000..a91f193ba42a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java
@@ -0,0 +1,80 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import org.apache.cloudstack.utils.CloudStackVersion;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.junit.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+public class VersionTest {
+
+    @Test
+    public void fromPackageAndCSVersion_CompleteVersion_IncludesPackageAndCsFields() {
+        CloudStackVersion csVersion = CloudStackVersion.parse("4.23.1.2");
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(csVersion);
+
+            Version version = Version.fromPackageAndCSVersion(true);
+
+            assertEquals("4.23.1.2", version.getFullVersion());
+            assertEquals("4", version.getMajor());
+            assertEquals("23", version.getMinor());
+            assertEquals("1", version.getBuild());
+            assertEquals("2", version.getRevision());
+        }
+    }
+
+    @Test
+    public void fromPackageAndCSVersion_IncompleteVersion_DoesNotSetFullVersion() {
+        CloudStackVersion csVersion = CloudStackVersion.parse("4.23.1.2");
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(csVersion);
+
+            Version version = Version.fromPackageAndCSVersion(false);
+
+            assertNull(version.getFullVersion());
+            assertEquals("4", version.getMajor());
+            assertEquals("23", version.getMinor());
+            assertEquals("1", version.getBuild());
+            assertEquals("2", version.getRevision());
+        }
+    }
+
+    @Test
+    public void fromPackageAndCSVersion_NullCloudStackVersion_ReturnsWithoutNumericParts() {
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(null);
+
+            Version version = Version.fromPackageAndCSVersion(true);
+
+            assertEquals("4.23.1.2", version.getFullVersion());
+            assertNull(version.getMajor());
+            assertNull(version.getMinor());
+            assertNull(version.getBuild());
+            assertNull(version.getRevision());
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java
new file mode 100644
index 000000000000..7741859d8971
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java
@@ -0,0 +1,98 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.junit.Test;
+
+import com.cloud.utils.Pair;
+
+public class VmTest {
+
+    @Test
+    public void of_SetsHrefAndId() {
+        Vm vm = Vm.of("/ovirt-engine/api/vms/1", "1");
+
+        assertEquals("/ovirt-engine/api/vms/1", vm.getHref());
+        assertEquals("1", vm.getId());
+    }
+
+    @Test
+    public void biosGetDefault_UsesSeaBiosAndDisabledBootMenu() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        assertEquals(Vm.Bios.Type.q35_sea_bios.name(), bios.getType());
+        assertEquals("false", bios.getBootMenu().getEnabled());
+    }
+
+    @Test
+    public void biosUpdateBios_UsesSecureBootWhenRequested() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        Vm.Bios.updateBios(bios, ApiConstants.BootMode.SECURE.toString());
+
+        assertEquals(Vm.Bios.Type.q35_secure_boot.name(), bios.getType());
+    }
+
+    @Test
+    public void biosUpdateBios_UsesOvmfForNonSecureMode() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        Vm.Bios.updateBios(bios, ApiConstants.BootMode.LEGACY.toString());
+
+        assertEquals(Vm.Bios.Type.q35_ovmf.name(), bios.getType());
+    }
+
+    @Test
+    public void biosGetBiosFromOrdinal_FallsBackToDefaultWhenInvalid() {
+        Vm.Bios bios = Vm.Bios.getBiosFromOrdinal("not-a-number");
+
+        assertEquals(Vm.Bios.Type.q35_sea_bios.name(), bios.getType());
+    }
+
+    @Test
+    public void biosGetBiosFromOrdinal_MapsKnownOrdinals() {
+        Vm.Bios secure = Vm.Bios.getBiosFromOrdinal(String.valueOf(Vm.Bios.Type.q35_secure_boot.ordinal()));
+        Vm.Bios ovmf = Vm.Bios.getBiosFromOrdinal(String.valueOf(Vm.Bios.Type.q35_ovmf.ordinal()));
+
+        assertEquals(Vm.Bios.Type.q35_secure_boot.name(), secure.getType());
+        assertEquals(Vm.Bios.Type.q35_ovmf.name(), ovmf.getType());
+    }
+
+    @Test
+    public void biosRetrieveBootOptions_ReturnsExpectedMappings() {
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> defaults = Vm.Bios.retrieveBootOptions(null);
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> secure = Vm.Bios.retrieveBootOptions(typeOnly(Vm.Bios.Type.q35_secure_boot.name()));
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> uefiLegacy = Vm.Bios.retrieveBootOptions(typeOnly(Vm.Bios.Type.q35_ovmf.name()));
+
+        assertEquals(ApiConstants.BootType.BIOS, defaults.first());
+        assertEquals(ApiConstants.BootMode.LEGACY, defaults.second());
+        assertEquals(ApiConstants.BootType.UEFI, secure.first());
+        assertEquals(ApiConstants.BootMode.SECURE, secure.second());
+        assertEquals(ApiConstants.BootType.UEFI, uefiLegacy.first());
+        assertEquals(ApiConstants.BootMode.LEGACY, uefiLegacy.second());
+    }
+
+    private Vm.Bios typeOnly(String type) {
+        Vm.Bios bios = new Vm.Bios();
+        bios.setType(type);
+        return bios;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java
new file mode 100644
index 000000000000..27ca43f77866
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertNotNull;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class VnicProfileReportedDeviceTest {
+    // ---- VnicProfile -------------------------------------------------------
+    @Test
+    public void vnicProfile_GettersSetters() {
+        VnicProfile profile = new VnicProfile();
+        profile.setName("default");
+        profile.setDescription("Default vNIC profile");
+        Ref network = Ref.of("/api/networks/net1", "net1");
+        Ref dc = Ref.of("/api/datacenters/dc1", "dc1");
+        profile.setNetwork(network);
+        profile.setDataCenter(dc);
+        assertEquals("default", profile.getName());
+        assertEquals("Default vNIC profile", profile.getDescription());
+        assertEquals("net1", profile.getNetwork().getId());
+        assertEquals("dc1", profile.getDataCenter().getId());
+    }
+
+    @Test
+    public void vnicProfileJson_ContainsName() throws Exception {
+        Mapper mapper = new Mapper();
+        VnicProfile profile = new VnicProfile();
+        profile.setName("my-profile");
+        String json = mapper.toJson(profile);
+        assertTrue(json.contains("\"name\":\"my-profile\""));
+    }
+
+    // ---- ReportedDevice ----------------------------------------------------
+    @Test
+    public void reportedDevice_GettersSetters() {
+        ReportedDevice device = new ReportedDevice();
+        device.setName("eth0");
+        device.setType("bridge");
+        device.setDescription("Primary NIC");
+        Mac mac = new Mac();
+        mac.setAddress("aa:bb:cc:dd:ee:01");
+        device.setMac(mac);
+        NamedList<Ip> ips = NamedList.of("ip", Collections.singletonList(new Ip()));
+        device.setIps(ips);
+        assertEquals("eth0", device.getName());
+        assertEquals("bridge", device.getType());
+        assertEquals("Primary NIC", device.getDescription());
+        assertEquals("aa:bb:cc:dd:ee:01", device.getMac().getAddress());
+        assertNotNull(device.getIps());
+    }
+
+    @Test
+    public void reportedDeviceJson_ContainsNameAndType() throws Exception {
+        Mapper mapper = new Mapper();
+        ReportedDevice device = new ReportedDevice();
+        device.setName("ens3");
+        device.setType("ethernet");
+        String json = mapper.toJson(device);
+        assertTrue(json.contains("\"name\":\"ens3\""));
+        assertTrue(json.contains("\"type\":\"ethernet\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java
new file mode 100644
index 000000000000..16fbd02669c5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java
@@ -0,0 +1,92 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.request;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.junit.Test;
+
+public class ListQueryTest {
+
+    @Test
+    public void testFromRequest_WithNoParametersReturnsDefaults() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Collections.emptyMap());
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        assertFalse(query.isAllContent());
+        assertNull(query.getLimit());
+        assertNull(query.getOffset());
+        assertFalse(query.followContains("tags"));
+    }
+
+    @Test
+    public void testFromRequest_ParsesAllContentMaxAndFollow() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Map.of(
+                "all_content", new String[]{"true"},
+                "max", new String[]{"25"},
+                "follow", new String[]{"tags, disk_attachments.disk, ,nics.reporteddevices"}
+        ));
+        when(request.getParameter("all_content")).thenReturn("true");
+        when(request.getParameter("max")).thenReturn("25");
+        when(request.getParameter("follow")).thenReturn("tags, disk_attachments.disk, ,nics.reporteddevices");
+        when(request.getParameter("search")).thenReturn(null);
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        assertTrue(query.isAllContent());
+        assertTrue(query.followContains("tags"));
+        assertTrue(query.followContains("disk_attachments.disk"));
+        assertTrue(query.followContains("nics.reporteddevices"));
+    }
+
+    @Test
+    public void testFromRequest_SearchParserIgnoresNonEqualsAndUsesPageValueAsMaxCurrentBehavior() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Map.of("search", new String[]{"name=vm and page=3 and status!=down and x>=1"}));
+        when(request.getParameter("all_content")).thenReturn(null);
+        when(request.getParameter("max")).thenReturn(null);
+        when(request.getParameter("follow")).thenReturn(null);
+        when(request.getParameter("search")).thenReturn("name=vm and page=3 and status!=down and x>=1");
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        // Document existing behavior: when search contains page=..., max is set from it.
+        org.junit.Assert.assertEquals(Long.valueOf(3L), query.getLimit());
+    }
+
+    @Test
+    public void testGetOffset_UsesPageAndMax() {
+        final ListQuery query = new ListQuery();
+        query.page = 3L;
+        query.max = 10L;
+
+        org.junit.Assert.assertEquals(Long.valueOf(20L), query.getOffset());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java
new file mode 100644
index 000000000000..d14d1291dc17
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java
@@ -0,0 +1,130 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class AllowedClientCidrsFilterTest {
+
+    @Mock
+    private VeeamControlService veeamControlService;
+
+    @Mock
+    private FilterChain chain;
+
+    @Test
+    public void testDoFilterAllowsNonHttpRequestsToPassThrough() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final ServletRequest request = mock(ServletRequest.class);
+        final ServletResponse response = mock(ServletResponse.class);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+        verifyNoInteractions(veeamControlService);
+    }
+
+    @Test
+    public void testDoFilterRejectsWhenServiceIsUnavailable() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(null);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(503, response.getStatus());
+        assertEquals("Service Unavailable", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterAllowsRequestWhenNoCidrsConfigured() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(Collections.emptyList());
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterAllowsRequestFromConfiguredCidr() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("192.168.10.25");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+        assertEquals(200, response.getStatus());
+    }
+
+    @Test
+    public void testDoFilterRejectsRequestOutsideConfiguredCidrs() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("10.10.10.10");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(403, response.getStatus());
+        assertEquals("Forbidden", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterRejectsMalformedRemoteAddress() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("not-a-valid-ip-address");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(403, response.getStatus());
+        assertEquals("Forbidden", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java
new file mode 100644
index 000000000000..ba25da38e3e8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+import javax.servlet.FilterChain;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class BearerOrBasicAuthFilterTest {
+
+    private static final String SECRET = "very-secret";
+
+    @Mock
+    private VeeamControlService veeamControlService;
+
+    @Mock
+    private FilterChain chain;
+
+    @Test
+    public void testDoFilterRejectsMissingAuthorizationWithJsonPayload() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Accept", "application/json");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertEquals("application/json; charset=UTF-8", response.getContentType());
+        assertNotNull(response.getHeader("WWW-Authenticate"));
+        assertTrue(response.getHeader("WWW-Authenticate").contains("error=\"invalid_token\""));
+        assertTrue(response.getContentAsString().contains("\"error\":\"invalid_token\""));
+        assertTrue(response.getContentAsString().contains("Missing Authorization"));
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterRejectsInvalidBearerToken() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Accept", "application/json");
+        request.addHeader("Authorization", "Bearer not-a-jwt");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Invalid or expired token"));
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterAllowsValidBearerTokenWithRequiredScopes() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String token = JwtUtil.issueHs256Jwt("service-user", "ovirt-app-admin ovirt-app-portal", 60L, SECRET);
+        request.addHeader("Authorization", "Bearer " + token);
+        when(veeamControlService.getHmacSecret()).thenReturn(SECRET);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterAllowsValidBasicCredentials() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String credentials = Base64.getEncoder().encodeToString("veeam:secret".getBytes(StandardCharsets.UTF_8));
+        request.addHeader("Authorization", "Basic " + credentials);
+        when(veeamControlService.validateCredentials("veeam", "secret")).thenReturn(true);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterRejectsInvalidBasicCredentialsWithHtmlPayload() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Authorization", "Basic !!!not-base64!!!");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertEquals("text/html; charset=UTF-8", response.getContentType());
+        assertTrue(response.getContentAsString().contains("Unauthorized"));
+        assertNotNull(response.getHeader("WWW-Authenticate"));
+        assertTrue(response.getHeader("WWW-Authenticate").contains("invalid_client"));
+        verifyNoInteractions(chain);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java
new file mode 100644
index 000000000000..cbae87164536
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java
@@ -0,0 +1,127 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.services;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+
+import org.apache.cloudstack.ca.CAManager;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class PkiResourceRouteHandlerTest {
+
+    @Test
+    public void testCanHandleSanitizesQueryParameters() {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+
+        assertTrue(handler.canHandle("GET", "/services/pki-resource?resource=ca-certificate"));
+    }
+
+    @Test
+    public void testHandleReturnsCertificateDownload() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        final CAManager caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String certificate = "-----BEGIN CERTIFICATE-----\nveeam\n-----END CERTIFICATE-----\n";
+        handler.caManager = caManager;
+        when(caManager.getCaCertificate(null)).thenReturn(certificate);
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+        assertEquals("no-store", response.getHeader("Cache-Control"));
+        assertEquals("attachment; filename=\"pki-resource.cer\"", response.getHeader("Content-Disposition"));
+        assertEquals("application/x-x509-ca-cert; charset=ISO-8859-1", response.getContentType());
+        assertArrayEquals(certificate.getBytes(StandardCharsets.ISO_8859_1), response.getContentAsByteArray());
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedResource() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("resource", "unsupported");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertEquals("Unsupported resource", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedFormat() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("format", "PEM");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertEquals("Unsupported format", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleRejectsEmptyCertificateData() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        final CAManager caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        handler.caManager = caManager;
+        when(caManager.getCaCertificate(null)).thenReturn("");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(500, response.getStatus());
+        assertEquals("No certificate data available", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleReturnsNotFoundForUnknownPath() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource/unknown");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        handler.handle(request, response, "/services/pki-resource/unknown", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java
new file mode 100644
index 000000000000..d6c2c87fd038
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java
@@ -0,0 +1,219 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.sso;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+
+@RunWith(MockitoJUnitRunner.class)
+public class SsoServiceTest {
+
+    private final Mapper mapper = new Mapper();
+
+    @Test
+    public void testCanHandleSanitizesQueryParameters() {
+        final SsoService service = new SsoService();
+
+        assertTrue(service.canHandle("POST", "/sso/oauth/token?scope=abc"));
+    }
+
+    @Test
+    public void testHandleReturnsNotFoundForUnknownPath() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/sso/unknown");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/unknown", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+    }
+
+    @Test
+    public void testHandleTokenRejectsNonPostMethod() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(405, response.getStatus());
+        assertEquals("POST", response.getHeader("Allow"));
+        assertTrue(response.getContentAsString().contains("method_not_allowed"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsMissingGrantType() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Missing parameter: grant_type"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsUnsupportedGrantType() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "client_credentials");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("unsupported_grant_type"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsMissingCredentials() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Missing username/password"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsInvalidCredentials() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "wrong");
+        when(controlService.validateCredentials("veeam", "wrong")).thenReturn(false);
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("invalid_grant"));
+    }
+
+    @Test
+    public void testHandleTokenReturnsServerErrorWhenTokenIssuanceFails() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn(null);
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(500, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Failed to issue token"));
+    }
+
+    @Test
+    public void testHandleTokenIssuesTokenWithDefaultScopes() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn("very-secret");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+
+        final Map<String, Object> payload = mapper.jsonMapper().readValue(response.getContentAsByteArray(), new TypeReference<>() {
+        });
+        assertEquals("bearer", payload.get("token_type"));
+        assertEquals(3600, ((Number) payload.get("expires_in")).intValue());
+        assertEquals(String.join(" ", SsoService.REQUIRED_SCOPES), payload.get("scope"));
+
+        final String accessToken = (String) payload.get("access_token");
+        final String jwtPayload = new String(Base64.getUrlDecoder().decode(accessToken.split("\\.")[1]), StandardCharsets.UTF_8);
+        final Map<String, Object> jwtClaims = mapper.jsonMapper().readValue(jwtPayload, new TypeReference<>() {
+        });
+        assertEquals("veeam", jwtClaims.get("sub"));
+        assertEquals(String.join(" ", SsoService.REQUIRED_SCOPES), jwtClaims.get("scope"));
+    }
+
+    @Test
+    public void testHandleTokenHonorsCustomScope() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        request.setParameter("scope", "custom-scope");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn("very-secret");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"scope\":\"custom-scope\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java
new file mode 100644
index 000000000000..ca56e9a74061
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+
+import java.util.Optional;
+
+import org.junit.Test;
+
+public class CloudConfigUtilTest {
+
+    @Test
+    public void testExtractIpv4Address_ReturnsIpv4FromNetworkConfigWriteFile() {
+        final String userData = "#cloud-config\n"
+                + "write_files:\n"
+                + "  - path: /etc/network/network_config.yml\n"
+                + "    content: |\n"
+                + "      interfaces:\n"
+                + "        - ipv4:\n"
+                + "            enabled: true\n"
+                + "            dhcp: false\n"
+                + "            address:\n"
+                + "              - ip: 10.20.30.40\n";
+
+        final Optional<String> result = CloudConfigUtil.extractIpv4Address(userData);
+
+        assertEquals(Optional.of("10.20.30.40"), result);
+    }
+
+    @Test
+    public void testExtractIpv4Address_ReturnsEmptyWhenNetworkConfigUsesDhcp() {
+        final String userData = "#cloud-config\n"
+                + "write_files:\n"
+                + "  - path: /etc/network/network_config.yml\n"
+                + "    content: |\n"
+                + "      interfaces:\n"
+                + "        - ipv4:\n"
+                + "            enabled: true\n"
+                + "            dhcp: true\n"
+                + "            address:\n"
+                + "              - ip: 10.20.30.40\n";
+
+        assertFalse(CloudConfigUtil.extractIpv4Address(userData).isPresent());
+    }
+
+    @Test
+    public void testExtractIpv4Address_ReturnsEmptyForInvalidYaml() {
+        assertFalse(CloudConfigUtil.extractIpv4Address("write_files: [").isPresent());
+    }
+
+    @Test
+    public void testExtractIpv4Address_NormalizesEscapedNewLines() {
+        final String userData = "write_files:\\n"
+                + "  - path: /tmp/network_config.yml\\n"
+                + "    content: |\\n"
+                + "      interfaces:\\n"
+                + "        - ipv4:\\n"
+                + "            enabled: true\\n"
+                + "            dhcp: false\\n"
+                + "            address:\\n"
+                + "              - ip: 192.168.1.25\\n";
+
+        assertEquals(Optional.of("192.168.1.25"), CloudConfigUtil.extractIpv4Address(userData));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java
new file mode 100644
index 000000000000..a576557a26b0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+
+import org.junit.Test;
+
+public class DataUtilTest {
+
+    @Test
+    public void testB64Url_UsesUrlSafeAlphabetAndNoPadding() {
+        final String encoded = DataUtil.b64Url(new byte[]{(byte) 0xfb, (byte) 0xff});
+        assertEquals("-_8", encoded);
+    }
+
+    @Test
+    public void testJsonEscape_NullAndEscapedCharacters() {
+        assertEquals("", DataUtil.jsonEscape(null));
+        assertEquals("a\\\\b\\\"c", DataUtil.jsonEscape("a\\b\"c"));
+    }
+
+    @Test
+    public void testConstantTimeEquals_StringOverload() {
+        assertTrue(DataUtil.constantTimeEquals("abc", "abc"));
+        assertFalse(DataUtil.constantTimeEquals("abc", "abcd"));
+        assertFalse(DataUtil.constantTimeEquals(null, "abc"));
+        assertFalse(DataUtil.constantTimeEquals("abc", null));
+    }
+
+    @Test
+    public void testConstantTimeEquals_ByteArrayOverload() {
+        final byte[] left = "sample".getBytes(StandardCharsets.UTF_8);
+        assertTrue(DataUtil.constantTimeEquals(left, "sample".getBytes(StandardCharsets.UTF_8)));
+        assertFalse(DataUtil.constantTimeEquals(left, "samples".getBytes(StandardCharsets.UTF_8)));
+        assertFalse(DataUtil.constantTimeEquals(left, "samplE".getBytes(StandardCharsets.UTF_8)));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java
new file mode 100644
index 000000000000..255eec3744b6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+
+import org.junit.Test;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+public class JwtUtilTest {
+
+    @Test
+    public void testHmacSha256_KnownVector() throws Exception {
+        final byte[] actual = JwtUtil.hmacSha256("data".getBytes(StandardCharsets.UTF_8), "key".getBytes(StandardCharsets.UTF_8));
+        final byte[] expected = hexToBytes("5031fe3d989c6d1537a013fa6e739da23463fdaec3b70137d828e36ace221bd0");
+        assertArrayEquals(expected, actual);
+    }
+
+    @Test
+    public void testIssueHs256Jwt_BuildsValidTokenAndClaims() throws Exception {
+        final long before = Instant.now().getEpochSecond();
+        final String token = JwtUtil.issueHs256Jwt("sub-1", "scope-a", 120L, "very-secret");
+        final long after = Instant.now().getEpochSecond();
+
+        final String[] parts = token.split("\\.");
+        assertEquals(3, parts.length);
+
+        final JsonObject header = JsonParser.parseString(new String(Base64.getUrlDecoder().decode(parts[0]), StandardCharsets.UTF_8)).getAsJsonObject();
+        final JsonObject payload = JsonParser.parseString(new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8)).getAsJsonObject();
+
+        assertEquals("HS256", header.get("alg").getAsString());
+        assertEquals("JWT", header.get("typ").getAsString());
+        assertEquals(JwtUtil.ISSUER, payload.get("iss").getAsString());
+        assertEquals("sub-1", payload.get("sub").getAsString());
+        assertEquals("scope-a", payload.get("scope").getAsString());
+
+        final long iat = payload.get("iat").getAsLong();
+        final long exp = payload.get("exp").getAsLong();
+        assertTrue(iat >= before && iat <= after);
+        assertEquals(120L, exp - iat);
+
+        final byte[] expectedSig = JwtUtil.hmacSha256((parts[0] + "." + parts[1]).getBytes(StandardCharsets.UTF_8), "very-secret".getBytes(StandardCharsets.UTF_8));
+        final byte[] actualSig = Base64.getUrlDecoder().decode(parts[2]);
+        assertArrayEquals(expectedSig, actualSig);
+    }
+
+    private static byte[] hexToBytes(final String hex) {
+        final byte[] out = new byte[hex.length() / 2];
+        for (int i = 0; i < out.length; i++) {
+            final int hi = Character.digit(hex.charAt(i * 2), 16);
+            final int lo = Character.digit(hex.charAt(i * 2 + 1), 16);
+            out[i] = (byte)((hi << 4) + lo);
+        }
+        return out;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java
new file mode 100644
index 000000000000..d444386d066d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java
@@ -0,0 +1,72 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+public class MapperTest {
+
+    @Test
+    public void testToJson_UsesSnakeCaseAndOmitsNulls() throws Exception {
+        final Mapper mapper = new Mapper();
+        final String json = mapper.toJson(new Sample("John", "Doe", null));
+
+        assertTrue(json.contains("\"first_name\":\"John\""));
+        assertTrue(json.contains("\"last_name\":\"Doe\""));
+        assertFalse(json.contains("optional_field"));
+    }
+
+    @Test
+    public void testToXml_UsesSnakeCaseAndOmitsNulls() throws Exception {
+        final Mapper mapper = new Mapper();
+        final String xml = mapper.toXml(new Sample("John", "Doe", null));
+
+        assertTrue(xml.contains("<first_name>John</first_name>"));
+        assertTrue(xml.contains("<last_name>Doe</last_name>"));
+        assertFalse(xml.contains("optional_field"));
+    }
+
+    @Test
+    public void testJsonMapper_IgnoresUnknownProperties() throws Exception {
+        final Mapper mapper = new Mapper();
+        final Sample sample = mapper.jsonMapper().readValue("{\"first_name\":\"Alice\",\"unknown\":\"x\"}", Sample.class);
+
+        assertNotNull(sample);
+        assertEquals("Alice", sample.firstName);
+    }
+
+    static class Sample {
+        public String firstName;
+        public String lastName;
+        public String optionalField;
+
+        Sample() {
+        }
+
+        Sample(final String firstName, final String lastName, final String optionalField) {
+            this.firstName = firstName;
+            this.lastName = lastName;
+            this.optionalField = optionalField;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java
new file mode 100644
index 000000000000..fb08f14b24eb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.junit.Test;
+
+public class NegotiationTest {
+
+    @Test
+    public void testResponseFormat_DefaultsToXmlForNullBlankWildcardAndUnknown() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+
+        when(request.getHeader("Accept")).thenReturn(null);
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("   ");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("*/*");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("application/octet-stream");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+    }
+
+    @Test
+    public void testResponseFormat_ResolvesJsonAndXmlMediaTypesCaseInsensitively() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+
+        when(request.getHeader("Accept")).thenReturn("Application/JSON");
+        assertEquals(Negotiation.OutFormat.JSON, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("application/xml");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("text/xml");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+    }
+
+    @Test
+    public void testContentType_ReturnsMimeTypeForEachFormat() {
+        assertEquals("application/json", Negotiation.contentType(Negotiation.OutFormat.JSON));
+        assertEquals("application/xml", Negotiation.contentType(Negotiation.OutFormat.XML));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java
new file mode 100644
index 000000000000..f069c724c704
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java
@@ -0,0 +1,54 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import java.util.List;
+
+import org.junit.Test;
+
+public class PathUtilTest {
+
+    @Test
+    public void testExtractIdAndSubPath_ReturnsNullForBlankOrInvalidPath() {
+        assertNull(PathUtil.extractIdAndSubPath(null, "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("   ", "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("api/datacenters/123", "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("/api/datacenters", "/api/datacenters"));
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_RemovesBaseRouteAndReturnsSegments() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/api/datacenters/123/sub/path", "/api/datacenters");
+        assertEquals(List.of("123", "sub", "path"), parts);
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_HandlesTrailingSlashBaseAndRepeatedSlashes() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/api/datacenters//123///child/", "/api/datacenters/");
+        assertEquals(List.of("123", "child"), parts);
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_WithoutBaseRouteUsesPathDirectly() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/id-1/sub", "");
+        assertEquals(List.of("id-1", "sub"), parts);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java
new file mode 100644
index 000000000000..241d92f7c933
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Test;
+
+public class ResponseWriterTest {
+
+    @Test
+    public void testWrite_NullBodySetsStatusAndZeroContentLength() throws Exception {
+        final Mapper mapper = new Mapper();
+        final ResponseWriter responseWriter = new ResponseWriter(mapper);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        responseWriter.write(response, 204, null, Negotiation.OutFormat.XML);
+
+        verify(response).setStatus(204);
+        verify(response).setContentLength(0);
+        verify(response, never()).getWriter();
+    }
+
+    @Test
+    public void testWrite_JsonBodyWritesPayloadAndHeaders() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("item-1"), Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(200);
+        verify(response).setHeader("Content-Type", "application/json");
+        assertTrue(sink.toString().contains("\"name\":\"item-1\""));
+    }
+
+    @Test
+    public void testWrite_XmlBodyWritesPayloadAndHeaders() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("item-2"), Negotiation.OutFormat.XML);
+
+        verify(response).setHeader("Content-Type", "application/xml");
+        assertTrue(sink.toString().contains("<name>item-2</name>"));
+    }
+
+    @Test
+    public void testWrite_WhenMappingFailsReturnsInternalServerError() throws Exception {
+        final Mapper mapper = mock(Mapper.class);
+        doThrow(new RuntimeException("boom")).when(mapper).toJson(org.mockito.ArgumentMatchers.any());
+
+        final ResponseWriter responseWriter = new ResponseWriter(mapper);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("ignored"), Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(500);
+        verify(response).setHeader("Content-Type", "text/plain");
+        assertTrue(sink.toString().contains("Internal Server Error"));
+        verify(response, never()).setContentLength(anyInt());
+    }
+
+    @Test
+    public void testWriteFault_JsonWritesFaultStructure() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.writeFault(response, 404, "Not Found", "missing vm", Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(404);
+        assertTrue(sink.toString().contains("\"reason\":\"Not Found\""));
+        assertTrue(sink.toString().contains("\"detail\":\"missing vm\""));
+    }
+
+    static class Payload {
+        public String name;
+
+        Payload(final String name) {
+            this.name = name;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml b/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml
new file mode 100644
index 000000000000..ed22ca632398
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml
@@ -0,0 +1,225 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<ovf:Envelope
+        xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1/"
+        xmlns:rasd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData"
+        xmlns:vssd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ovf:version="4.4.0.0">
+  <References>
+    <File ovf:href="6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:id="2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:size="4096" ovf:description="Active VM" ovf:disk_storage_type="IMAGE" ovf:cinder_volume_type=""></File>
+  </References>
+  <NetworkSection>
+    <Info>List of networks</Info>
+    <Network ovf:name="Network-85990692-f734-4695-afe4-aca34a21f459">
+      <Description></Description>
+    </Network>
+  </NetworkSection>
+  <Section xsi:type="ovf:DiskSection_Type">
+    <Info>List of Virtual Disks</Info>
+    <Disk ovf:diskId="2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:size="1" ovf:actual_size="1" ovf:vm_snapshot_id="dfa11f00-f92d-353b-8dbe-a653a0a4315b" ovf:parentRef="" ovf:fileRef="6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:format="http://www.vmware.com/specifications/vmdk.html#sparse" ovf:volume-format="COW" ovf:volume-type="Sparse" ovf:disk-interface="VirtIO_SCSI" ovf:read-only="false" ovf:shareable="false" ovf:boot="true" ovf:pass-discard="false" ovf:incremental-backup="false" ovf:disk-alias="ROOT-27" ovf:disk-description="ROOT-27" ovf:wipe-after-delete="false"></Disk>
+  </Section>
+  <Section xsi:type="ovf:CloudStackMetadata_Type">
+    <Info>CloudStack specific metadata</Info>
+    <CloudStack>
+      <AccountId>048531b6-4386-11f1-930c-525400580bd0</AccountId>
+      <DomainId>e0afbb58-4385-11f1-930c-525400580bd0</DomainId>
+      <ProjectId></ProjectId>
+      <ServiceOfferingId>ac3edee0-e2fb-4cd1-b6d4-d3b4555203ba</ServiceOfferingId>
+      <DataDiskOfferingIdMap>
+        <Entry>
+          <DiskId>2efdaae2-6c38-4ac8-ac75-562cf47adba1</DiskId>
+          <OfferingId>4de70249-b89d-4f08-9ca2-05ddb4ad1b2a</OfferingId>
+        </Entry>
+      </DataDiskOfferingIdMap>
+      <Details>
+        <Detail>
+          <Key>keyboard</Key>
+          <Value>us</Value>
+        </Detail>
+        <Detail>
+          <Key>skip.force.disk.controller</Key>
+          <Value>true</Value>
+        </Detail>
+        <Detail>
+          <Key>nicAdapter</Key>
+          <Value>virtio</Value>
+        </Detail>
+        <Detail>
+          <Key>rootDiskController</Key>
+          <Value>osdefault</Value>
+        </Detail>
+      </Details>
+      <Nics>
+        <Nic>
+          <Id>85990692-f734-4695-afe4-aca34a21f459</Id>
+          <NetworkId>6aff2178-a323-4148-a592-edbd47b93229</NetworkId>
+          <MACAddress>02:01:00:cf:00:05</MACAddress>
+          <Ip4Address>10.1.1.40</Ip4Address>
+          <Ip6Address></Ip6Address>
+        </Nic>
+      </Nics>
+    </CloudStack>
+  </Section>
+  <Content ovf:id="out" xsi:type="ovf:VirtualSystem_Type">
+    <Name>test-vm1</Name>
+    <Description>test-vm1</Description>
+    <Comment></Comment>
+    <CreationDate>2026/05/06 18:29:58</CreationDate>
+    <ExportDate>2026/05/06 18:47:55</ExportDate>
+    <DeleteProtected>false</DeleteProtected>
+    <SsoMethod>guest_agent</SsoMethod>
+    <IsSmartcardEnabled>false</IsSmartcardEnabled>
+    <NumOfIoThreads>1</NumOfIoThreads>
+    <TimeZone>Etc/GMT</TimeZone>
+    <default_boot_sequence>0</default_boot_sequence>
+    <Generation>11</Generation>
+    <ClusterCompatibilityVersion>4.8</ClusterCompatibilityVersion>
+    <VmType>1</VmType>
+    <ResumeBehavior>AUTO_RESUME</ResumeBehavior>
+    <MinAllocatedMem>512</MinAllocatedMem>
+    <IsStateless>false</IsStateless>
+    <IsRunAndPause>false</IsRunAndPause>
+    <AutoStartup>false</AutoStartup>
+    <Priority>0</Priority>
+    <CreatedByUserId>048531b6-4386-11f1-930c-525400580bd0</CreatedByUserId>
+    <MigrationSupport>0</MigrationSupport>
+    <IsBootMenuEnabled>false</IsBootMenuEnabled>
+    <IsSpiceFileTransferEnabled>true</IsSpiceFileTransferEnabled>
+    <IsSpiceCopyPasteEnabled>true</IsSpiceCopyPasteEnabled>
+    <AllowConsoleReconnect>false</AllowConsoleReconnect>
+    <ConsoleDisconnectAction>LOCK_SCREEN</ConsoleDisconnectAction>
+    <ConsoleDisconnectActionDelay>0</ConsoleDisconnectActionDelay>
+    <CustomEmulatedMachine></CustomEmulatedMachine>
+    <BiosType>3</BiosType>
+    <CustomCpuName></CustomCpuName>
+    <PredefinedProperties></PredefinedProperties>
+    <UserDefinedProperties></UserDefinedProperties>
+    <MaxMemorySizeMb>512</MaxMemorySizeMb>
+    <MultiQueuesEnabled>true</MultiQueuesEnabled>
+    <VirtioScsiMultiQueuesEnabled>false</VirtioScsiMultiQueuesEnabled>
+    <UseHostCpu>false</UseHostCpu>
+    <BalloonEnabled>false</BalloonEnabled>
+    <CpuPinningPolicy>0</CpuPinningPolicy>
+    <ClusterName></ClusterName>
+    <TemplateId>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</TemplateId>
+    <TemplateName>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</TemplateName>
+    <IsInitilized>true</IsInitilized>
+    <Origin>3</Origin>
+    <quota_id>00000000-0000-0000-0000-000000000000</quota_id>
+    <DefaultDisplayType>2</DefaultDisplayType>
+    <TrustedService>false</TrustedService>
+    <OriginalTemplateId>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</OriginalTemplateId>
+    <OriginalTemplateName>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</OriginalTemplateName>
+    <UseLatestVersion>false</UseLatestVersion>
+    <StopTime>2026/05/06 18:29:58</StopTime>
+    <BootTime>2026/05/06 18:29:58</BootTime>
+    <Downtime>0</Downtime>
+    <Section ovf:id="649d4d91-7cad-4541-a0a4-3930472f95ec" ovf:required="false" xsi:type="ovf:OperatingSystemSection_Type">
+      <Info>Guest Operating System</Info>
+      <Description>linux</Description>
+    </Section>
+    <Section xsi:type="ovf:VirtualHardwareSection_Type">
+      <Info>1 CPU, 512 Memory</Info>
+      <System>
+        <vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType>
+      </System>
+      <Item>
+        <rasd:Caption>1 virtual cpu</rasd:Caption>
+        <rasd:Description>Number of virtual CPU</rasd:Description>
+        <rasd:InstanceId>1</rasd:InstanceId>
+        <rasd:ResourceType>3</rasd:ResourceType>
+        <rasd:num_of_sockets>1</rasd:num_of_sockets>
+        <rasd:cpu_per_socket>1</rasd:cpu_per_socket>
+        <rasd:threads_per_cpu>1</rasd:threads_per_cpu>
+        <rasd:max_num_of_vcpus>1</rasd:max_num_of_vcpus>
+        <rasd:VirtualQuantity>1</rasd:VirtualQuantity>
+      </Item>
+      <Item>
+        <rasd:Caption>512 MB of memory</rasd:Caption>
+        <rasd:Description>Memory Size</rasd:Description>
+        <rasd:InstanceId>2</rasd:InstanceId>
+        <rasd:ResourceType>4</rasd:ResourceType>
+        <rasd:AllocationUnits>byte * 2^20</rasd:AllocationUnits>
+        <rasd:VirtualQuantity>512</rasd:VirtualQuantity>
+      </Item>
+      <Item>
+        <rasd:Caption>ROOT-27</rasd:Caption>
+        <rasd:InstanceId>2efdaae2-6c38-4ac8-ac75-562cf47adba1</rasd:InstanceId>
+        <rasd:ResourceType>17</rasd:ResourceType>
+        <rasd:HostResource>6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1</rasd:HostResource>
+        <rasd:Parent>00000000-0000-0000-0000-000000000000</rasd:Parent>
+        <rasd:Template>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</rasd:Template>
+        <rasd:ApplicationList></rasd:ApplicationList>
+        <rasd:StorageId>6af2dd24-1af2-3610-b7b8-de38c98ec958</rasd:StorageId>
+        <rasd:StoragePoolId>00000000-0000-0000-0000-000000000000</rasd:StoragePoolId>
+        <rasd:CreationDate>2026/05/06 18:29:58</rasd:CreationDate>
+        <rasd:LastModified>2026/05/06 18:47:55</rasd:LastModified>
+        <rasd:last_modified_date>2026/05/06 18:47:55</rasd:last_modified_date>
+        <Type>disk</Type>
+        <Device>disk</Device>
+        <rasd:Address>{type=drive, bus=0, controller=0, target=0, unit=0}</rasd:Address>
+        <BootOrder>1</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias>ua-6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1</Alias>
+      </Item>
+      <Item>
+        <rasd:Caption>Ethernet adapter - ExternalGuestNetworkGuru</rasd:Caption>
+        <rasd:InstanceId>85990692-f734-4695-afe4-aca34a21f459</rasd:InstanceId>
+        <rasd:ResourceType>10</rasd:ResourceType>
+        <rasd:OtherResourceType></rasd:OtherResourceType>
+        <rasd:ResourceSubType>3</rasd:ResourceSubType>
+        <rasd:Connection>Network-85990692-f734-4695-afe4-aca34a21f459</rasd:Connection>
+        <rasd:Linked>true</rasd:Linked>
+        <rasd:Name>ExternalGuestNetworkGuru</rasd:Name>
+        <rasd:ElementName>6aff2178-a323-4148-a592-edbd47b93229</rasd:ElementName>
+        <rasd:MACAddress>02:01:00:cf:00:05</rasd:MACAddress>
+        <rasd:speed>10000</rasd:speed>
+        <Type>interface</Type>
+        <Device>bridge</Device>
+        <rasd:Address>{type=pci, slot=0x00, bus=0x01, domain=0x0000, function=0x0}</rasd:Address>
+        <BootOrder>0</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias>ua-85990692-f734-4695-afe4-aca34a21f459</Alias>
+      </Item>
+      <Item>
+        <rasd:Caption>USB Controller</rasd:Caption>
+        <rasd:InstanceId>3</rasd:InstanceId>
+        <rasd:ResourceType>23</rasd:ResourceType>
+        <rasd:UsbPolicy>DISABLED</rasd:UsbPolicy>
+      </Item>
+      <Item>
+        <rasd:ResourceType>0</rasd:ResourceType>
+        <rasd:InstanceId>373a1bbf-b292-31c9-a29c-afeb9ba84c21</rasd:InstanceId>
+        <Type>rng</Type>
+        <Device>virtio</Device>
+        <rasd:Address>{type=pci, slot=0x00, bus=0x06, domain=0x0000, function=0x0}</rasd:Address>
+        <BootOrder>0</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias></Alias>
+        <SpecParams>
+          <source>urandom</source>
+        </SpecParams>
+      </Item>
+    </Section>
+  </Content>
+</ovf:Envelope>
diff --git a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
index d9f4963165ec..a0b1973fd8e8 100644
--- a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
+++ b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
@@ -17,18 +17,22 @@
 
 package org.apache.cloudstack.network.contrail.management;
 
+import java.net.InetAddress;
 import java.util.List;
 import java.util.Map;
-import java.net.InetAddress;
 
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
-import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
+import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.RolePermissionEntity;
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.acl.SecurityChecker.AccessType;
+import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPairPermission;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.command.admin.account.CreateAccountCmd;
+import org.apache.cloudstack.api.command.admin.account.UpdateAccountCmd;
 import org.apache.cloudstack.api.command.admin.user.DeleteUserCmd;
 import org.apache.cloudstack.api.command.admin.user.DeleteUserKeysCmd;
 import org.apache.cloudstack.api.command.admin.user.GetUserKeysCmd;
@@ -37,20 +41,15 @@
 import org.apache.cloudstack.api.command.admin.user.MoveUserCmd;
 import org.apache.cloudstack.api.command.admin.user.RegisterUserKeysCmd;
 import org.apache.cloudstack.api.command.admin.user.UpdateUserCmd;
+import org.apache.cloudstack.api.response.ApiKeyPairResponse;
+import org.apache.cloudstack.api.response.ListResponse;
 import org.apache.cloudstack.api.response.UserTwoFactorAuthenticationSetupResponse;
 import org.apache.cloudstack.auth.UserTwoFactorAuthenticator;
 import org.apache.cloudstack.backup.BackupOffering;
-import org.apache.cloudstack.framework.config.ConfigKey;
-
-import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
-import org.apache.cloudstack.acl.ControlledEntity;
-import org.apache.cloudstack.acl.RoleType;
-import org.apache.cloudstack.api.response.ApiKeyPairResponse;
-import org.apache.cloudstack.api.response.ListResponse;
-import org.apache.cloudstack.acl.SecurityChecker.AccessType;
-import org.apache.cloudstack.api.command.admin.account.UpdateAccountCmd;
 import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
+import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
 import com.cloud.api.query.vo.ControlledViewEntity;
 import com.cloud.configuration.ResourceLimit;
 import com.cloud.configuration.dao.ResourceCountDao;
@@ -598,6 +597,10 @@ public void validateUserPasswordAndUpdateIfNeeded(String newPassword, UserVO use
     public void checkApiAccess(Account account, String command, String apiKey) throws PermissionDeniedException {
     }
 
+    @Override
+    public void checkApiAccess(Account caller, String command) throws PermissionDeniedException {
+    }
+
     @Override
     public UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user) {
         return null;
@@ -614,4 +617,19 @@ public void verifyCallerPrivilegeForUserOrAccountOperations(User user) {
     @Override
     public void checkCallerRoleTypeAllowedForUserOrAccountOperations(Account userAccount, User user) {
     }
+
+    @Override
+    public Account getActiveAccountByUuid(String accountUuid) {
+        return null;
+    }
+
+    @Override
+    public User getOneActiveUserForAccount(Account account) {
+        return null;
+    }
+
+    @Override
+    public Account getAccountByUuid(String accountUuid) {
+        return null;
+    }
 }
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 44220481a6fe..6e2f20c9a7d7 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -94,6 +94,7 @@
         <module>integrations/cloudian</module>
         <module>integrations/prometheus</module>
         <module>integrations/kubernetes-service</module>
+        <module>integrations/veeam-control-service</module>
 
         <module>metrics</module>
 
diff --git a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
index 6a7f1d580436..9174aaa38693 100644
--- a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
@@ -90,6 +90,13 @@
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.dao.VMInstanceDao;
 
+import com.cloud.agent.AgentManager;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+
 public class CloudStackPrimaryDataStoreDriverImpl implements PrimaryDataStoreDriver {
     @Override
     public Map<String, String> getCapabilities() {
@@ -133,6 +140,12 @@ public Map<String, String> getCapabilities() {
     @Inject
     private VolumeOrchestrationService volumeOrchestrationService;
 
+    @Inject
+    private ClvmPoolManager clvmPoolManager;
+
+    @Inject
+    private AgentManager agentMgr;
+
     @Override
     public DataTO getTO(DataObject data) {
         return null;
@@ -423,12 +436,19 @@ public void revertSnapshot(SnapshotInfo snapshot, SnapshotInfo snapshotOnPrimary
         CommandResult result = new CommandResult();
         try {
             EndPoint ep = null;
-            if (snapshotOnPrimaryStore != null) {
-                ep = epSelector.select(snapshotOnPrimaryStore);
-            } else {
-                VolumeInfo volumeInfo = volFactory.getVolume(snapshot.getVolumeId(), DataStoreRole.Primary);
+            VolumeInfo volumeInfo = volFactory.getVolume(snapshot.getVolumeId(), DataStoreRole.Primary);
+
+            StoragePoolVO storagePool = primaryStoreDao.findById(volumeInfo.getPoolId());
+            if (storagePool != null && storagePool.getPoolType() == StoragePoolType.CLVM) {
                 ep = epSelector.select(volumeInfo);
+            } else {
+                if (snapshotOnPrimaryStore != null) {
+                    ep = epSelector.select(snapshotOnPrimaryStore);
+                } else {
+                    ep = epSelector.select(volumeInfo);
+                }
             }
+
             if ( ep == null ){
                 String errMsg = "No remote endpoint to send RevertSnapshotCommand, check if host or ssvm is down?";
                 logger.error(errMsg);
@@ -456,6 +476,29 @@ public void resize(DataObject data, AsyncCompletionCallback<CreateCmdResult> cal
 
         CreateCmdResult result = new CreateCmdResult(null, null);
 
+        if (ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            VirtualMachine attachedVm = vol.getAttachedVM();
+            boolean vmIsRunning = attachedVm != null && attachedVm.getHostId() != null;
+            if (!vmIsRunning) {
+                Long lockHostId = clvmPoolManager.getClvmLockHostId(vol.getId(), vol.getUuid(),
+                        vol.getPath(), pool, true);
+                if (lockHostId != null) {
+                    HostVO lockHost = hostDao.findById(lockHostId);
+                    if (lockHost != null && lockHost.getStatus() == Status.Up) {
+                        logger.debug("CLVM resize: routing to lock-holding host {} for volume {}",
+                                lockHostId, vol.getUuid());
+                        endpointsToRunResize = new long[]{lockHostId};
+                    } else {
+                        logger.warn("CLVM resize: lock host {} for volume {} is down or missing, " +
+                                "keeping caller-provided hosts", lockHostId, vol.getUuid());
+                    }
+                } else {
+                    logger.warn("CLVM resize: no lock holder found for volume {}, " +
+                            "keeping caller-provided hosts or epSelector", vol.getUuid());
+                }
+            }
+        }
+
         // if hosts are provided, they are where the VM last ran. We can use that.
         if (endpointsToRunResize == null || endpointsToRunResize.length == 0) {
             EndPoint ep = epSelector.select(data, encryptionRequired);
@@ -474,7 +517,21 @@ public void resize(DataObject data, AsyncCompletionCallback<CreateCmdResult> cal
             resizeCmd.setContextParam(DiskTO.PROTOCOL_TYPE, Storage.StoragePoolType.DatastoreCluster.toString());
         }
         try {
-            ResizeVolumeAnswer answer = (ResizeVolumeAnswer) storageMgr.sendToPool(pool, endpointsToRunResize, resizeCmd);
+            ResizeVolumeAnswer answer;
+            if (ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+                // For CLVM, send only to the determined host, without falling through to other hosts
+                try {
+                    answer = (ResizeVolumeAnswer) agentMgr.send(endpointsToRunResize[0], resizeCmd);
+                } catch (AgentUnavailableException | OperationTimedoutException e) {
+                    logger.error("CLVM resize failed to reach host {} for volume {}: {}",
+                            endpointsToRunResize[0], vol.getUuid(), e.getMessage());
+                    result.setResult(e.getMessage());
+                    callback.complete(result);
+                    return;
+                }
+            } else {
+                answer = (ResizeVolumeAnswer) storageMgr.sendToPool(pool, endpointsToRunResize, resizeCmd);
+            }
             if (answer != null && answer.getResult()) {
                 long finalSize = answer.getNewSize();
                 logger.debug("Resize: volume started at size: " + toHumanReadableSize(vol.getSize()) + " and ended at size: " + toHumanReadableSize(finalSize));
diff --git a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImpl.java b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImpl.java
index e4eb10f51fb2..cad6341d2b8a 100644
--- a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImpl.java
+++ b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImpl.java
@@ -233,6 +233,11 @@ public DataStore initialize(Map<String, Object> dsInfos) {
             parameters.setHost(storageHost);
             parameters.setPort(0);
             parameters.setPath(hostPath.replaceFirst("/", ""));
+        } else if (scheme.equalsIgnoreCase("clvm_ng")) {
+            parameters.setType(StoragePoolType.CLVM_NG);
+            parameters.setHost(storageHost);
+            parameters.setPort(0);
+            parameters.setPath(hostPath.replaceFirst("/", ""));
         } else if (scheme.equalsIgnoreCase("rbd")) {
             if (port == -1) {
                 port = 0;
@@ -329,7 +334,7 @@ public DataStore initialize(Map<String, Object> dsInfos) {
 
         if (existingUuid != null) {
             uuid = (String)existingUuid;
-        } else if (scheme.equalsIgnoreCase("sharedmountpoint") || scheme.equalsIgnoreCase("clvm")) {
+        } else if (scheme.equalsIgnoreCase("sharedmountpoint")) {
             uuid = UUID.randomUUID().toString();
         } else if ("PreSetup".equalsIgnoreCase(scheme) && !HypervisorType.VMware.equals(hypervisorType)) {
             uuid = hostPath.replace("/", "");
diff --git a/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImplTest.java b/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImplTest.java
new file mode 100644
index 000000000000..52c56456a52a
--- /dev/null
+++ b/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImplTest.java
@@ -0,0 +1,286 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.storage.datastore.driver;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.withSettings;
+
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPointSelector;
+import org.apache.cloudstack.framework.async.AsyncCompletionCallback;
+import org.apache.cloudstack.engine.subsystem.api.storage.CreateCmdResult;
+import org.apache.cloudstack.storage.volume.VolumeObject;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.storage.ResizeVolumeAnswer;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.ResizeVolumePayload;
+import com.cloud.storage.Storage;
+import com.cloud.storage.StorageManager;
+import com.cloud.storage.StoragePool;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.vm.VirtualMachine;
+
+@RunWith(MockitoJUnitRunner.class)
+public class CloudStackPrimaryDataStoreDriverImplTest {
+
+    @InjectMocks
+    private CloudStackPrimaryDataStoreDriverImpl driver;
+
+    @Mock
+    private ClvmPoolManager clvmPoolManager;
+    @Mock
+    private AgentManager agentMgr;
+    @Mock
+    private HostDao hostDao;
+    @Mock
+    private EndPointSelector epSelector;
+    @Mock
+    private StorageManager storageMgr;
+
+    @Mock
+    private VolumeObject vol;
+    private StoragePool pool;
+    @Mock
+    private HostVO lockHost;
+    @Mock
+    private AsyncCompletionCallback<CreateCmdResult> callback;
+
+    private static final long LOCK_HOST_ID = 42L;
+    private static final long OTHER_HOST_ID = 99L;
+    private static final String VOLUME_UUID = "test-vol-uuid";
+    private static final String VOLUME_PATH = "vm-1-disk-0";
+
+    @Before
+    public void setUp() {
+        pool = Mockito.mock(StoragePool.class, withSettings().extraInterfaces(DataStore.class));
+
+        when(vol.getUuid()).thenReturn(VOLUME_UUID);
+        when(vol.getId()).thenReturn(1L);
+        when(vol.getPath()).thenReturn(VOLUME_PATH);
+        when(vol.getSize()).thenReturn(10L * 1024 * 1024 * 1024);
+
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+        when(pool.getParent()).thenReturn(0L);
+        when(pool.getPath()).thenReturn("/vg-test");
+
+        when(vol.getDataStore()).thenReturn((DataStore) pool);
+
+        when(hostDao.findById(LOCK_HOST_ID)).thenReturn(lockHost);
+        when(lockHost.getStatus()).thenReturn(Status.Up);
+    }
+
+    private ResizeVolumeAnswer mockSuccessAnswer(long newSize) throws Exception {
+        ResizeVolumeAnswer answer = Mockito.mock(ResizeVolumeAnswer.class);
+        when(answer.getResult()).thenReturn(true);
+        when(answer.getNewSize()).thenReturn(newSize);
+        return answer;
+    }
+
+    private void stubAgentSend(long hostId, Answer answer) throws Exception {
+        Mockito.doReturn(answer).when(agentMgr).send(eq(hostId), any(Command.class));
+    }
+
+    private void verifyAgentSend(long hostId) throws Exception {
+        verify(agentMgr).send(eq(hostId), any(Command.class));
+    }
+
+    private void verifyAgentSendNever(long hostId) throws Exception {
+        verify(agentMgr, never()).send(eq(hostId), any(Command.class));
+    }
+
+    private ResizeVolumePayload makePayload(long[] hosts) {
+        ResizeVolumePayload p = new ResizeVolumePayload(
+                20L * 1024 * 1024 * 1024, null, null, null, false, "test-vm", hosts, false);
+        when(vol.getpayload()).thenReturn(p);
+        return p;
+    }
+
+    @Test
+    public void testResize_clvmNg_vmRunning_usesCallerHost() throws Exception {
+        VirtualMachine runningVm = Mockito.mock(VirtualMachine.class);
+        when(runningVm.getHostId()).thenReturn(OTHER_HOST_ID);
+        when(vol.getAttachedVM()).thenReturn(runningVm);
+        makePayload(new long[]{OTHER_HOST_ID});
+
+        stubAgentSend(OTHER_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        verify(clvmPoolManager, never()).getClvmLockHostId(anyLong(), anyString(), anyString(), any(), anyBoolean());
+        verifyAgentSend(OTHER_HOST_ID);
+    }
+
+    @Test
+    public void testResize_clvmNg_vmStopped_routesToLockHost() throws Exception {
+        VirtualMachine stoppedVm = Mockito.mock(VirtualMachine.class);
+        when(stoppedVm.getHostId()).thenReturn(null);
+        when(vol.getAttachedVM()).thenReturn(stoppedVm);
+        makePayload(new long[]{OTHER_HOST_ID}); // stale lastHostId from caller
+
+        when(clvmPoolManager.getClvmLockHostId(anyLong(), anyString(), anyString(), any(), eq(true)))
+                .thenReturn(LOCK_HOST_ID);
+        stubAgentSend(LOCK_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        // Must override stale lastHostId with actual lock host
+        verifyAgentSend(LOCK_HOST_ID);
+        verifyAgentSendNever(OTHER_HOST_ID);
+    }
+
+    @Test
+    public void testResize_clvmNg_vmStopped_lockHostDown_keepsCallerHosts() throws Exception {
+        VirtualMachine stoppedVm = Mockito.mock(VirtualMachine.class);
+        when(stoppedVm.getHostId()).thenReturn(null);
+        when(vol.getAttachedVM()).thenReturn(stoppedVm);
+        makePayload(new long[]{OTHER_HOST_ID});
+
+        when(clvmPoolManager.getClvmLockHostId(anyLong(), anyString(), anyString(), any(), eq(true)))
+                .thenReturn(LOCK_HOST_ID);
+        when(lockHost.getStatus()).thenReturn(Status.Disconnected);
+        stubAgentSend(OTHER_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        verifyAgentSend(OTHER_HOST_ID);
+    }
+
+    @Test
+    public void testResize_clvmNg_detached_routesToLockHost() throws Exception {
+        when(vol.getAttachedVM()).thenReturn(null);
+        makePayload(null); // no hosts from caller
+
+        when(clvmPoolManager.getClvmLockHostId(anyLong(), anyString(), anyString(), any(), eq(true)))
+                .thenReturn(LOCK_HOST_ID);
+        stubAgentSend(LOCK_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        verifyAgentSend(LOCK_HOST_ID);
+    }
+
+    @Test
+    public void testResize_clvmNg_detached_noLockHolder_fallsToEpSelector() throws Exception {
+        when(vol.getAttachedVM()).thenReturn(null);
+        makePayload(null);
+
+        when(clvmPoolManager.getClvmLockHostId(anyLong(), anyString(), anyString(), any(), eq(true)))
+                .thenReturn(null); // no lock holder found
+
+        EndPoint ep = Mockito.mock(EndPoint.class);
+        when(ep.getId()).thenReturn(LOCK_HOST_ID);
+        when(epSelector.select(any(), anyBoolean())).thenReturn(ep);
+        stubAgentSend(LOCK_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        verify(epSelector).select(any(), anyBoolean());
+        verifyAgentSend(LOCK_HOST_ID);
+    }
+
+    @Test
+    public void testResize_clvmNg_agentUnavailable_failsFast() throws Exception {
+        VirtualMachine runningVm = Mockito.mock(VirtualMachine.class);
+        when(runningVm.getHostId()).thenReturn(OTHER_HOST_ID);
+        when(vol.getAttachedVM()).thenReturn(runningVm);
+        makePayload(new long[]{OTHER_HOST_ID});
+
+        Mockito.doThrow(new AgentUnavailableException("host down", OTHER_HOST_ID))
+                .when(agentMgr).send(eq(OTHER_HOST_ID), any(Command.class));
+
+        driver.resize(vol, callback);
+
+        verify(callback).complete(any());
+        verify(storageMgr, never()).sendToPool(any(StoragePool.class), any(long[].class), any());
+    }
+
+    @Test
+    public void testResize_clvmNg_operationTimedOut_failsFast() throws Exception {
+        VirtualMachine runningVm = Mockito.mock(VirtualMachine.class);
+        when(runningVm.getHostId()).thenReturn(OTHER_HOST_ID);
+        when(vol.getAttachedVM()).thenReturn(runningVm);
+        makePayload(new long[]{OTHER_HOST_ID});
+
+        Mockito.doThrow(new OperationTimedoutException(null, OTHER_HOST_ID, 0, 0, false))
+                .when(agentMgr).send(eq(OTHER_HOST_ID), any(Command.class));
+
+        driver.resize(vol, callback);
+
+        verify(callback).complete(any());
+        verify(storageMgr, never()).sendToPool(any(StoragePool.class), any(long[].class), any());
+    }
+
+    @Test
+    public void testResize_nonClvm_usesSendToPool() throws Exception {
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        makePayload(null);
+
+        EndPoint ep = Mockito.mock(EndPoint.class);
+        when(ep.getId()).thenReturn(OTHER_HOST_ID);
+        when(epSelector.select(any(), anyBoolean())).thenReturn(ep);
+
+        ResizeVolumeAnswer answer = mockSuccessAnswer(20L * 1024 * 1024 * 1024);
+        when(storageMgr.sendToPool(any(StoragePool.class), any(long[].class), any())).thenReturn(answer);
+
+        driver.resize(vol, callback);
+
+        verify(storageMgr).sendToPool(any(StoragePool.class), any(long[].class), any());
+        verify(agentMgr, never()).send(anyLong(), any(Command.class));
+        verify(clvmPoolManager, never()).getClvmLockHostId(anyLong(), anyString(), anyString(), any(), anyBoolean());
+    }
+
+    @Test
+    public void testResize_clvmLegacy_vmStopped_routesToLockHost() throws Exception {
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        VirtualMachine stoppedVm = Mockito.mock(VirtualMachine.class);
+        when(stoppedVm.getHostId()).thenReturn(null);
+        when(vol.getAttachedVM()).thenReturn(stoppedVm);
+        makePayload(new long[]{OTHER_HOST_ID});
+
+        when(clvmPoolManager.getClvmLockHostId(anyLong(), anyString(), anyString(), any(), eq(true)))
+                .thenReturn(LOCK_HOST_ID);
+        stubAgentSend(LOCK_HOST_ID, mockSuccessAnswer(20L * 1024 * 1024 * 1024));
+
+        driver.resize(vol, callback);
+
+        verifyAgentSend(LOCK_HOST_ID);
+        verifyAgentSendNever(OTHER_HOST_ID);
+    }
+}
diff --git a/plugins/user-authenticators/oauth2/pom.xml b/plugins/user-authenticators/oauth2/pom.xml
index 6ab7b9f5faba..89694440591c 100644
--- a/plugins/user-authenticators/oauth2/pom.xml
+++ b/plugins/user-authenticators/oauth2/pom.xml
@@ -38,6 +38,11 @@
             <artifactId>cloud-framework-config</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-rs-security-jose</artifactId>
+            <version>${cs.cxf.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.google.apis</groupId>
             <artifactId>google-api-services-docs</artifactId>
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
index b65027d6a249..b1bb8292f24a 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
@@ -18,10 +18,14 @@
 //
 package org.apache.cloudstack.oauth2;
 
-import com.cloud.user.dao.UserDao;
-import com.cloud.utils.component.Manager;
-import com.cloud.utils.component.ManagerBase;
-import com.cloud.utils.exception.CloudRuntimeException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
@@ -35,16 +39,11 @@
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 import org.apache.commons.lang3.StringUtils;
 
-import javax.inject.Inject;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import com.cloud.utils.component.Manager;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
 
 public class OAuth2AuthManagerImpl extends ManagerBase implements OAuth2AuthManager, Manager, Configurable {
-    @Inject
-    private UserDao _userDao;
 
     @Inject
     protected OauthProviderDao _oauthProviderDao;
@@ -55,7 +54,7 @@ public class OAuth2AuthManagerImpl extends ManagerBase implements OAuth2AuthMana
 
     @Override
     public List<Class<?>> getAuthCommands() {
-        List<Class<?>> cmdList = new ArrayList<Class<?>>();
+        List<Class<?>> cmdList = new ArrayList<>();
         cmdList.add(OauthLoginAPIAuthenticatorCmd.class);
         cmdList.add(ListOAuthProvidersCmd.class);
         cmdList.add(VerifyOAuthCodeAndGetUserCmd.class);
@@ -84,7 +83,7 @@ public boolean stop() {
 
     @Override
     public List<Class<?>> getCommands() {
-        List<Class<?>> cmdList = new ArrayList<Class<?>>();
+        List<Class<?>> cmdList = new ArrayList<>();
         cmdList.add(RegisterOAuthProviderCmd.class);
         cmdList.add(DeleteOAuthProviderCmd.class);
         cmdList.add(UpdateOAuthProviderCmd.class);
@@ -127,9 +126,7 @@ protected void initializeUserOAuth2AuthenticationProvidersMap() {
     @Override
     public String verifyCodeAndFetchEmail(String code, String provider) {
         UserOAuth2Authenticator authenticator = getUserOAuth2AuthenticationProvider(provider);
-        String email = authenticator.verifyCodeAndFetchEmail(code);
-
-        return email;
+        return authenticator.verifyCodeAndFetchEmail(code);
     }
 
     @Override
@@ -139,6 +136,8 @@ public OauthProviderVO registerOauthProvider(RegisterOAuthProviderCmd cmd) {
         String clientId = StringUtils.trim(cmd.getClientId());
         String redirectUri = StringUtils.trim(cmd.getRedirectUri());
         String secretKey = StringUtils.trim(cmd.getSecretKey());
+        String authorizeUrl = StringUtils.trim(cmd.getAuthorizeUrl());
+        String tokenUrl = StringUtils.trim(cmd.getTokenUrl());
 
         if (!isOAuthPluginEnabled()) {
             throw new CloudRuntimeException("OAuth is not enabled, please enable to register");
@@ -148,7 +147,7 @@ public OauthProviderVO registerOauthProvider(RegisterOAuthProviderCmd cmd) {
             throw new CloudRuntimeException(String.format("Provider with the name %s is already registered", provider));
         }
 
-        return saveOauthProvider(provider, description, clientId, secretKey, redirectUri);
+        return saveOauthProvider(provider, description, clientId, secretKey, redirectUri, authorizeUrl, tokenUrl);
     }
 
     @Override
@@ -171,6 +170,8 @@ public OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd) {
         String clientId = StringUtils.trim(cmd.getClientId());
         String redirectUri = StringUtils.trim(cmd.getRedirectUri());
         String secretKey = StringUtils.trim(cmd.getSecretKey());
+        String authorizeUrl = StringUtils.trim(cmd.getAuthorizeUrl());
+        String tokenUrl = StringUtils.trim(cmd.getTokenUrl());
         Boolean enabled = cmd.getEnabled();
 
         OauthProviderVO providerVO = _oauthProviderDao.findById(id);
@@ -190,6 +191,12 @@ public OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd) {
         if (StringUtils.isNotEmpty(secretKey)) {
             providerVO.setSecretKey(secretKey);
         }
+        if (StringUtils.isNotEmpty(authorizeUrl)) {
+            providerVO.setAuthorizeUrl(authorizeUrl);
+        }
+        if (StringUtils.isNotEmpty(tokenUrl)) {
+            providerVO.setTokenUrl(tokenUrl);
+        }
         if (enabled != null) {
             providerVO.setEnabled(enabled);
         }
@@ -199,7 +206,7 @@ public OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd) {
         return _oauthProviderDao.findById(id);
     }
 
-    private OauthProviderVO saveOauthProvider(String provider, String description, String clientId, String secretKey, String redirectUri) {
+    private OauthProviderVO saveOauthProvider(String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl) {
         final OauthProviderVO oauthProviderVO = new OauthProviderVO();
 
         oauthProviderVO.setProvider(provider);
@@ -207,6 +214,8 @@ private OauthProviderVO saveOauthProvider(String provider, String description, S
         oauthProviderVO.setClientId(clientId);
         oauthProviderVO.setSecretKey(secretKey);
         oauthProviderVO.setRedirectUri(redirectUri);
+        oauthProviderVO.setAuthorizeUrl(authorizeUrl);
+        oauthProviderVO.setTokenUrl(tokenUrl);
         oauthProviderVO.setEnabled(true);
 
         _oauthProviderDao.persist(oauthProviderVO);
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
index abdbf65dbb42..9b91a1d879c2 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
@@ -21,8 +21,10 @@
 import java.util.List;
 import java.util.Map;
 
-import com.cloud.api.response.ApiResponseSerializer;
-import com.cloud.user.Account;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
@@ -40,9 +42,8 @@
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 import org.apache.commons.lang.ArrayUtils;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.user.Account;
 
 @APICommand(name = "listOauthProvider", description = "List OAuth providers registered", responseObject = OauthProviderResponse.class, entityType = {},
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
@@ -108,7 +109,7 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
         List<OauthProviderResponse> responses = new ArrayList<>();
         for (OauthProviderVO result : resultList) {
             OauthProviderResponse r = new OauthProviderResponse(result.getUuid(), result.getProvider(),
-                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri());
+                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri(), result.getAuthorizeUrl(), result.getTokenUrl());
             if (OAuth2AuthManager.OAuth2IsPluginEnabled.value() && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
                 r.setEnabled(true);
             } else {
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
index b31cbde97c52..8eb4493d76d8 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
@@ -14,26 +14,29 @@
 // limitations under the License.
 package org.apache.cloudstack.oauth2.api.command;
 
+import java.util.Collection;
+import java.util.Map;
+
 import javax.inject.Inject;
 import javax.persistence.EntityExistsException;
 
-import org.apache.cloudstack.api.response.SuccessResponse;
-import org.apache.cloudstack.oauth2.OAuth2AuthManager;
-import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
-import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
-import org.apache.commons.collections.MapUtils;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
 import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.oauth2.OAuth2AuthManager;
+import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
+import org.apache.cloudstack.oauth2.keycloak.KeycloakOAuth2Provider;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.exception.ConcurrentOperationException;
 
-import java.util.Collection;
-import java.util.Map;
-
 @APICommand(name = "registerOauthProvider", responseObject = SuccessResponse.class, description = "Register the OAuth2 provider in CloudStack", since = "4.19.0")
 public class RegisterOAuthProviderCmd extends BaseCmd {
 
@@ -56,6 +59,12 @@ public class RegisterOAuthProviderCmd extends BaseCmd {
     @Parameter(name = ApiConstants.REDIRECT_URI, type = CommandType.STRING, description = "Redirect URI pre-registered in the specific OAuth provider", required = true)
     private String redirectUri;
 
+    @Parameter(name = ApiConstants.AUTHORIZE_URL, type = CommandType.STRING, description = "Authorize URL for OAuth initialization (only required for keycloak provider)")
+    private String authorizeUrl;
+
+    @Parameter(name = ApiConstants.TOKEN_URL, type = CommandType.STRING, description = "Token URL for OAuth finalization (only required for keycloak provider)")
+    private String tokenUrl;
+
     @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP,
             description = "Any OAuth provider details in key/value pairs using format details[i].keyname=keyvalue. Example: details[0].clientsecret=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")
     protected Map details;
@@ -85,6 +94,14 @@ public String getRedirectUri() {
         return redirectUri;
     }
 
+    public String getAuthorizeUrl() {
+        return authorizeUrl;
+    }
+
+    public String getTokenUrl() {
+        return tokenUrl;
+    }
+
     public Map getDetails() {
         if (MapUtils.isEmpty(details)) {
             return null;
@@ -98,10 +115,20 @@ public Map getDetails() {
 
     @Override
     public void execute() throws ServerApiException, ConcurrentOperationException, EntityExistsException {
+        if (StringUtils.equals(KeycloakOAuth2Provider.KEYCLOAK_PROVIDER, getProvider())) {
+            if (StringUtils.isBlank(getAuthorizeUrl())) {
+                throw new ServerApiException(ApiErrorCode.BAD_REQUEST, "Parameter authorizeurl is mandatory for keycloak OAuth Provider");
+            }
+            if (StringUtils.isBlank(getTokenUrl())) {
+                throw new ServerApiException(ApiErrorCode.BAD_REQUEST, "Parameter tokenurl is mandatory for keycloak OAuth Provider");
+            }
+        }
+
         OauthProviderVO provider = _oauth2mgr.registerOauthProvider(this);
 
         OauthProviderResponse response = new OauthProviderResponse(provider.getUuid(), provider.getProvider(),
-                provider.getDescription(), provider.getClientId(), provider.getSecretKey(), provider.getRedirectUri());
+                provider.getDescription(), provider.getClientId(), provider.getSecretKey(), provider.getRedirectUri(),
+                provider.getAuthorizeUrl(), provider.getTokenUrl());
         response.setResponseName(getCommandName());
         response.setObjectName(ApiConstants.OAUTH_PROVIDER);
         setResponseObject(response);
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
index 1c79b7b144c8..a8b0604a9bba 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
@@ -16,23 +16,23 @@
 // under the License.
 package org.apache.cloudstack.oauth2.api.command;
 
-import org.apache.cloudstack.api.ApiCommandResourceType;
-import org.apache.cloudstack.auth.UserOAuth2Authenticator;
-import org.apache.cloudstack.oauth2.OAuth2AuthManager;
-import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
-import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.inject.Inject;
 
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.context.CallContext;
-
-import javax.inject.Inject;
-import java.util.ArrayList;
-import java.util.List;
+import org.apache.cloudstack.oauth2.OAuth2AuthManager;
+import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
 @APICommand(name = "updateOauthProvider", description = "Updates the registered OAuth provider details", responseObject = OauthProviderResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, since = "4.19.0")
@@ -57,6 +57,12 @@ public final class UpdateOAuthProviderCmd extends BaseCmd {
     @Parameter(name = ApiConstants.REDIRECT_URI, type = CommandType.STRING, description = "Redirect URI pre-registered in the specific OAuth provider")
     private String redirectUri;
 
+    @Parameter(name = ApiConstants.AUTHORIZE_URL, type = CommandType.STRING, description = "Authorize URL pre-registered in the specific OAuth provider")
+    private String authorizeUrl;
+
+    @Parameter(name = ApiConstants.TOKEN_URL, type = CommandType.STRING, description = "Token URL pre-registered in the specific OAuth provider")
+    private String tokenUrl;
+
     @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "OAuth provider will be enabled or disabled based on this value")
     private Boolean enabled;
 
@@ -87,6 +93,14 @@ public String getRedirectUri() {
         return redirectUri;
     }
 
+    public String getAuthorizeUrl() {
+        return authorizeUrl;
+    }
+
+    public String getTokenUrl() {
+        return tokenUrl;
+    }
+
     public Boolean getEnabled() {
         return enabled;
     }
@@ -115,7 +129,8 @@ public void execute() {
         OauthProviderVO result = _oauthMgr.updateOauthProvider(this);
         if (result != null) {
             OauthProviderResponse r = new OauthProviderResponse(result.getUuid(), result.getProvider(),
-                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri());
+                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri(),
+                    result.getAuthorizeUrl(), result.getTokenUrl());
 
             List<UserOAuth2Authenticator> userOAuth2AuthenticatorPlugins = _oauthMgr.listUserOAuth2AuthenticationProviders();
             List<String> authenticatorPluginNames = new ArrayList<>();
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
index e0c40bef9b4d..289dc6650137 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
@@ -16,13 +16,14 @@
 // under the License.
 package org.apache.cloudstack.oauth2.api.response;
 
-import com.cloud.serializer.Param;
-import com.google.gson.annotations.SerializedName;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseResponse;
 import org.apache.cloudstack.api.EntityReference;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
 @EntityReference(value = OauthProviderVO.class)
 public class OauthProviderResponse extends BaseResponse {
 
@@ -54,18 +55,28 @@ public class OauthProviderResponse extends BaseResponse {
     @Param(description = "Redirect URI registered in the OAuth provider")
     private String redirectUri;
 
+    @SerializedName(ApiConstants.AUTHORIZE_URL)
+    @Param(description = "Authorize URL registered in the OAuth provider")
+    private String authorizeUrl;
+
+    @SerializedName(ApiConstants.TOKEN_URL)
+    @Param(description = "Token URL registered in the OAuth provider")
+    private String tokenUrl;
+
     @SerializedName(ApiConstants.ENABLED)
     @Param(description = "Whether the OAuth provider is enabled or not")
     private boolean enabled;
 
-    public OauthProviderResponse(String id, String provider, String description, String clientId, String secretKey, String redirectUri) {
+    public OauthProviderResponse(String id, String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl) {
         this.id = id;
         this.provider = provider;
         this.name = provider;
         this.description = description;
         this.clientId = clientId;
         this.secretKey = secretKey;
-        this.redirectUri =  redirectUri;
+        this.redirectUri = redirectUri;
+        this.authorizeUrl = authorizeUrl;
+        this.tokenUrl = tokenUrl;
     }
 
     public String getId() {
@@ -117,6 +128,22 @@ public void setRedirectUri(String redirectUri) {
         this.redirectUri = redirectUri;
     }
 
+    public String getAuthorizeUrl() {
+        return authorizeUrl;
+    }
+
+    public void setAuthorizeUrl(String authorizeUrl) {
+        this.authorizeUrl = authorizeUrl;
+    }
+
+    public String getTokenUrl() {
+        return tokenUrl;
+    }
+
+    public void setTokenUrl(String tokenUrl) {
+        this.tokenUrl = tokenUrl;
+    }
+
     public String getSecretKey() {
         return secretKey;
     }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
index e4a7fae101f0..4d426181a94b 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
@@ -16,17 +16,6 @@
 //under the License.
 package org.apache.cloudstack.oauth2.github;
 
-import com.cloud.utils.component.AdapterBase;
-import com.cloud.utils.exception.CloudRuntimeException;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import org.apache.cloudstack.auth.UserOAuth2Authenticator;
-import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
-import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
-import org.apache.commons.lang3.StringUtils;
-
-import javax.inject.Inject;
-
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -36,6 +25,18 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import javax.inject.Inject;
+
+import org.apache.cloudstack.auth.UserOAuth2Authenticator;
+import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
 public class GithubOAuth2Provider extends AdapterBase implements UserOAuth2Authenticator {
 
     @Inject
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
index 42ed1451ccd5..885930181c91 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
@@ -16,6 +16,17 @@
 //under the License.
 package org.apache.cloudstack.oauth2.google;
 
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.auth.UserOAuth2Authenticator;
+import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import org.apache.commons.lang3.StringUtils;
+
 import com.cloud.exception.CloudAuthenticationException;
 import com.cloud.utils.component.AdapterBase;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -28,15 +39,6 @@
 import com.google.api.client.json.jackson2.JacksonFactory;
 import com.google.api.services.oauth2.Oauth2;
 import com.google.api.services.oauth2.model.Userinfo;
-import org.apache.cloudstack.auth.UserOAuth2Authenticator;
-import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
-import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
-import org.apache.commons.lang3.StringUtils;
-
-import javax.inject.Inject;
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.List;
 
 public class GoogleOAuth2Provider extends AdapterBase implements UserOAuth2Authenticator {
 
@@ -78,10 +80,10 @@ public boolean verifyUser(String email, String secretCode) {
 
     @Override
     public String verifyCodeAndFetchEmail(String secretCode) {
-        OauthProviderVO githubProvider = _oauthProviderDao.findByProvider(getName());
-        String clientId = githubProvider.getClientId();
-        String secret = githubProvider.getSecretKey();
-        String redirectURI = githubProvider.getRedirectUri();
+        OauthProviderVO googleProvider = _oauthProviderDao.findByProvider(getName());
+        String clientId = googleProvider.getClientId();
+        String secret = googleProvider.getSecretKey();
+        String redirectURI = googleProvider.getRedirectUri();
         GoogleClientSecrets clientSecrets = new GoogleClientSecrets()
                 .setWeb(new GoogleClientSecrets.Details()
                         .setClientId(clientId)
@@ -122,7 +124,7 @@ public String verifyCodeAndFetchEmail(String secretCode) {
         try {
             userinfo = oauth2.userinfo().get().execute();
         } catch (IOException e) {
-            throw new CloudRuntimeException(String.format("Failed to fetch the email address with the provided secret: %s" + e.getMessage()));
+            throw new CloudRuntimeException(String.format("Failed to fetch the email address with the provided secret: %s", e.getMessage()));
         }
         return userinfo.getEmail();
     }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java
new file mode 100644
index 000000000000..3f537b1984d0
--- /dev/null
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java
@@ -0,0 +1,184 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.oauth2.keycloak;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.ws.rs.core.HttpHeaders;
+
+import org.apache.cloudstack.auth.UserOAuth2Authenticator;
+import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.cxf.rs.security.jose.jws.JwsJwtCompactConsumer;
+import org.apache.cxf.rs.security.jose.jwt.JwtClaims;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
+
+import com.cloud.exception.CloudAuthenticationException;
+import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+public class KeycloakOAuth2Provider extends AdapterBase implements UserOAuth2Authenticator {
+
+    public static final String KEYCLOAK_PROVIDER = "keycloak";
+
+    protected String idToken = null;
+
+    @Inject
+    OauthProviderDao oauthProviderDao;
+
+    private CloseableHttpClient httpClient;
+
+    public KeycloakOAuth2Provider() {
+        this(HttpClientBuilder.create().build());
+    }
+
+    public KeycloakOAuth2Provider(CloseableHttpClient httpClient) {
+        this.httpClient = httpClient;
+    }
+
+    @Override
+    public String getName() {
+        return KEYCLOAK_PROVIDER;
+    }
+
+    @Override
+    public String getDescription() {
+        return "Keycloak OAuth2 Provider Plugin";
+    }
+
+    @Override
+    public boolean verifyUser(String email, String secretCode) {
+        if (StringUtils.isAnyEmpty(email, secretCode)) {
+            throw new CloudAuthenticationException("Either email or secret code should not be null/empty");
+        }
+
+        OauthProviderVO providerVO = oauthProviderDao.findByProvider(getName());
+        if (providerVO == null) {
+            throw new CloudAuthenticationException("Keycloak provider is not registered, so user cannot be verified");
+        }
+
+        String verifiedEmail = verifyCodeAndFetchEmail(secretCode);
+        if (StringUtils.isBlank(verifiedEmail) || !email.equals(verifiedEmail)) {
+            throw new CloudRuntimeException("Unable to verify the email address with the provided secret");
+        }
+        clearIdToken();
+
+        return true;
+    }
+
+    @Override
+    public String verifyCodeAndFetchEmail(String secretCode) {
+        OauthProviderVO provider = oauthProviderDao.findByProvider(getName());
+        if (provider == null) {
+            throw new CloudAuthenticationException("Keycloak provider is not registered, so user cannot be verified");
+        }
+
+        if (StringUtils.isBlank(idToken)) {
+            String auth = provider.getClientId() + ":" + provider.getSecretKey();
+            String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
+
+            List<NameValuePair> params = new ArrayList<>();
+            params.add(new BasicNameValuePair("grant_type", "authorization_code"));
+            params.add(new BasicNameValuePair("code", secretCode));
+            params.add(new BasicNameValuePair("redirect_uri", provider.getRedirectUri()));
+
+            HttpPost post = new HttpPost(provider.getTokenUrl());
+            post.setHeader(HttpHeaders.AUTHORIZATION, "Basic " + encodedAuth);
+
+            try {
+                post.setEntity(new UrlEncodedFormEntity(params));
+            } catch (UnsupportedEncodingException e) {
+                throw new CloudRuntimeException("Unable to generate URL parameters: " + e.getMessage());
+            }
+
+            try (CloseableHttpResponse response = httpClient.execute(post)) {
+                String body = EntityUtils.toString(response.getEntity());
+
+                if (response.getStatusLine().getStatusCode() != 200) {
+                    throw new CloudRuntimeException("Keycloak error during token generation: " + body);
+                }
+
+                JsonObject json = JsonParser.parseString(body).getAsJsonObject();
+                JsonElement fetchedIdToken = json.get("id_token");
+                if (fetchedIdToken == null) {
+                    throw new CloudRuntimeException("No id_token found in token");
+                }
+                String idTokenAsString = fetchedIdToken.getAsString();
+                validateIdToken(idTokenAsString , provider);
+
+                this.idToken = idTokenAsString ;
+            } catch (IOException e) {
+                throw new CloudRuntimeException("Unable to connect to Keycloak server", e);
+            }
+        }
+
+        return obtainEmail(idToken, provider);
+    }
+
+    @Override
+    public String getUserEmailAddress() throws CloudRuntimeException {
+        return null;
+    }
+
+    private void validateIdToken(String idTokenStr, OauthProviderVO provider) {
+        JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idTokenStr);
+        JwtClaims claims = jwtConsumer.getJwtToken().getClaims();
+
+        if (!claims.getAudiences().contains(provider.getClientId())) {
+            throw new CloudAuthenticationException("Audience mismatch");
+        }
+    }
+
+    private String obtainEmail(String idTokenStr, OauthProviderVO provider) {
+        JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idTokenStr);
+        JwtClaims claims = jwtConsumer.getJwtToken().getClaims();
+
+        if (!claims.getAudiences().contains(provider.getClientId())) {
+            throw new CloudAuthenticationException("Audience mismatch");
+        }
+
+        return (String) claims.getClaim("email");
+    }
+
+    protected void clearIdToken() {
+        idToken = null;
+    }
+
+    public void setHttpClient(CloseableHttpClient httpClient) {
+        this.httpClient = httpClient;
+    }
+
+}
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
index efd6004e8f97..54d667bc9143 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
@@ -16,9 +16,8 @@
 // under the License.
 package org.apache.cloudstack.oauth2.vo;
 
-import com.cloud.utils.db.GenericDao;
-import org.apache.cloudstack.api.Identity;
-import org.apache.cloudstack.api.InternalIdentity;
+import java.util.Date;
+import java.util.UUID;
 
 import javax.persistence.Column;
 import javax.persistence.Entity;
@@ -26,8 +25,11 @@
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
-import java.util.Date;
-import java.util.UUID;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+import com.cloud.utils.db.GenericDao;
 
 @Entity
 @Table(name = "oauth_provider")
@@ -55,6 +57,12 @@ public class OauthProviderVO implements Identity, InternalIdentity {
     @Column(name = "redirect_uri")
     private String redirectUri;
 
+    @Column(name = "authorize_url")
+    private String authorizeUrl;
+
+    @Column(name = "token_url")
+    private String tokenUrl;
+
     @Column(name = GenericDao.CREATED_COLUMN)
     private Date created;
 
@@ -110,6 +118,22 @@ public void setRedirectUri(String redirectUri) {
         this.redirectUri = redirectUri;
     }
 
+    public String getAuthorizeUrl() {
+        return authorizeUrl;
+    }
+
+    public void setAuthorizeUrl(String authorizeUrl) {
+        this.authorizeUrl = authorizeUrl;
+    }
+
+    public String getTokenUrl() {
+        return tokenUrl;
+    }
+
+    public void setTokenUrl(String tokenUrl) {
+        this.tokenUrl = tokenUrl;
+    }
+
     public String getSecretKey() {
         return secretKey;
     }
diff --git a/plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml b/plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml
index 04a6c8dabfe7..06fe60f4c25e 100644
--- a/plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml
+++ b/plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml
@@ -35,6 +35,9 @@
     <bean id="GithubOAuth2Provider" class="org.apache.cloudstack.oauth2.github.GithubOAuth2Provider">
         <property name="name" value="github" />
     </bean>
+    <bean id="KeycloakOAuth2Provider" class="org.apache.cloudstack.oauth2.keycloak.KeycloakOAuth2Provider">
+        <property name="name" value="keycloak" />
+    </bean>
 
     <bean id="OAuth2AuthManager" class="org.apache.cloudstack.oauth2.OAuth2AuthManagerImpl">
         <property name="name" value="OAUTH2Auth" />
@@ -45,7 +48,7 @@
           class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
         <property name="orderConfigKey" value="user.oauth2.providers.order" />
         <property name="excludeKey" value="oauth2.plugins.exclude" />
-        <property name="orderConfigDefault" value="google,github" />
+        <property name="orderConfigDefault" value="google,github,keycloak" />
     </bean>
 
     <bean class="org.apache.cloudstack.spring.lifecycle.registry.RegistryLifecycle">
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java
new file mode 100644
index 000000000000..df390f449cab
--- /dev/null
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java
@@ -0,0 +1,225 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.oauth2.keycloak;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+import org.apache.cloudstack.oauth2.dao.OauthProviderDao;
+import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
+import org.apache.http.HttpEntity;
+import org.apache.http.StatusLine;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import com.cloud.exception.CloudAuthenticationException;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class KeycloakOAuth2ProviderTest {
+
+    @Mock
+    private OauthProviderDao oauthProviderDao;
+
+    @Mock
+    private CloseableHttpClient httpClient;
+
+    private KeycloakOAuth2Provider provider;
+
+    private OauthProviderVO mockProviderVO;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+
+        provider = new KeycloakOAuth2Provider(httpClient);
+        provider.oauthProviderDao = oauthProviderDao;
+
+        mockProviderVO = new OauthProviderVO();
+        mockProviderVO.setClientId("test-client");
+        mockProviderVO.setSecretKey("test-secret");
+        mockProviderVO.setTokenUrl("http://localhost/token");
+        mockProviderVO.setRedirectUri("http://localhost/redirect");
+    }
+
+    @Test
+    public void testGetName() {
+        assertEquals("keycloak", provider.getName());
+    }
+
+    @Test(expected = CloudAuthenticationException.class)
+    public void testVerifyUserEmptyParams() {
+        provider.verifyUser("", "");
+    }
+
+    @Test(expected = CloudAuthenticationException.class)
+    public void testVerifyUserProviderNotFound() {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(null);
+        provider.verifyUser("test@example.com", "code123");
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testVerifyCodeAndFetchEmailHttpError() throws IOException {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+
+        CloseableHttpResponse response = mock(CloseableHttpResponse.class);
+        StatusLine statusLine = mock(StatusLine.class);
+
+        when(statusLine.getStatusCode()).thenReturn(400);
+        when(response.getStatusLine()).thenReturn(statusLine);
+
+        HttpEntity entity = mock(HttpEntity.class);
+        when(entity.getContent()).thenReturn(new ByteArrayInputStream("error".getBytes()));
+        when(response.getEntity()).thenReturn(entity);
+
+        when(httpClient.execute(any(HttpPost.class))).thenReturn(response);
+
+        provider.verifyCodeAndFetchEmail("invalid-code");
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testVerifyCodeAndFetchEmailNetworkFailure() throws IOException {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(httpClient.execute(any(HttpPost.class))).thenThrow(new IOException("Connection refused"));
+
+        provider.verifyCodeAndFetchEmail("code");
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testVerifyUserWithMismatchedEmail() throws IOException {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+
+        String testEmail = "anotheruser@example.com";
+        String secretCode = "valid-auth-code";
+
+        String header = "{\"alg\":\"none\"}";
+        String payload = "{" +
+                "\"aud\":[\"test-client\"]," +
+                "\"email\":\"" + testEmail + "\"," +
+                "\"iss\":\"http://keycloak\"," +
+                "\"sub\":\"12345\"" +
+                "}";
+
+        String encodedHeader = Base64.getUrlEncoder().withoutPadding().encodeToString(header.getBytes());
+        String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payload.getBytes());
+        String fakeJwt = encodedHeader + "." + encodedPayload + ".not-checked-signature";
+
+        CloseableHttpResponse response = mock(CloseableHttpResponse.class);
+        StatusLine statusLine = mock(StatusLine.class);
+        HttpEntity entity = mock(HttpEntity.class);
+
+        when(statusLine.getStatusCode()).thenReturn(200);
+        when(response.getStatusLine()).thenReturn(statusLine);
+
+        String jsonResponseBody = "{\"id_token\":\"" + fakeJwt + "\", \"access_token\":\"acc-123\"}";
+        when(entity.getContent()).thenReturn(new ByteArrayInputStream(jsonResponseBody.getBytes(StandardCharsets.UTF_8)));
+        when(response.getEntity()).thenReturn(entity);
+
+        when(httpClient.execute(any(HttpPost.class))).thenReturn(response);
+
+        provider.verifyUser("user@example.com", secretCode);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testVerifyUserWithMismatchedClient() throws IOException {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+
+        String testEmail = "anotheruser@example.com";
+        String secretCode = "valid-auth-code";
+
+        String header = "{\"alg\":\"none\"}";
+        String payload = "{" +
+                "\"aud\":[\"anothertest-client\"]," +
+                "\"email\":\"" + testEmail + "\"," +
+                "\"iss\":\"http://keycloak\"," +
+                "\"sub\":\"12345\"" +
+                "}";
+
+        String encodedHeader = Base64.getUrlEncoder().withoutPadding().encodeToString(header.getBytes());
+        String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payload.getBytes());
+        String fakeJwt = encodedHeader + "." + encodedPayload + ".not-checked-signature";
+
+        CloseableHttpResponse response = mock(CloseableHttpResponse.class);
+        StatusLine statusLine = mock(StatusLine.class);
+        HttpEntity entity = mock(HttpEntity.class);
+
+        when(statusLine.getStatusCode()).thenReturn(200);
+        when(response.getStatusLine()).thenReturn(statusLine);
+
+        String jsonResponseBody = "{\"id_token\":\"" + fakeJwt + "\", \"access_token\":\"acc-123\"}";
+        when(entity.getContent()).thenReturn(new ByteArrayInputStream(jsonResponseBody.getBytes(StandardCharsets.UTF_8)));
+        when(response.getEntity()).thenReturn(entity);
+
+        when(httpClient.execute(any(HttpPost.class))).thenReturn(response);
+
+        provider.verifyUser(testEmail, secretCode);
+    }
+
+    @Test
+    public void testVerifyUserEmail() throws IOException {
+        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+
+        String testEmail = "user@example.com";
+        String secretCode = "valid-auth-code";
+
+        String header = "{\"alg\":\"none\"}";
+        String payload = "{" +
+                "\"aud\":[\"test-client\"]," +
+                "\"email\":\"" + testEmail + "\"," +
+                "\"iss\":\"http://keycloak\"," +
+                "\"sub\":\"12345\"" +
+                "}";
+
+        String encodedHeader = Base64.getUrlEncoder().withoutPadding().encodeToString(header.getBytes());
+        String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payload.getBytes());
+        String fakeJwt = encodedHeader + "." + encodedPayload + ".not-checked-signature";
+
+        CloseableHttpResponse response = mock(CloseableHttpResponse.class);
+        StatusLine statusLine = mock(StatusLine.class);
+        HttpEntity entity = mock(HttpEntity.class);
+
+        when(statusLine.getStatusCode()).thenReturn(200);
+        when(response.getStatusLine()).thenReturn(statusLine);
+
+        String jsonResponseBody = "{\"id_token\":\"" + fakeJwt + "\", \"access_token\":\"acc-123\"}";
+        when(entity.getContent()).thenReturn(new ByteArrayInputStream(jsonResponseBody.getBytes(StandardCharsets.UTF_8)));
+        when(response.getEntity()).thenReturn(entity);
+
+        when(httpClient.execute(any(HttpPost.class))).thenReturn(response);
+
+        boolean result = provider.verifyUser(testEmail, secretCode);
+
+        assertTrue("User successfully verified", result);
+    }
+
+    @Test
+    public void testGetDescription() {
+        assertEquals("Keycloak OAuth2 Provider Plugin", provider.getDescription());
+    }
+}
diff --git a/pom.xml b/pom.xml
index a29a656ce512..38a559ba831e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,6 +55,10 @@
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <sonar.exclusions>engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingDetailsVO.java</sonar.exclusions>
         <sonar.exclusions>api/src/main/java/org/apache/cloudstack/api/response/BackupOfferingResponse.java</sonar.exclusions>
+        <sonar.exclusions>core/src/main/java/com/cloud/agent/api/PostMigrationAnswer.java</sonar.exclusions>
+        <sonar.exclusions>core/src/main/java/com/cloud/agent/api/PostMigrationCommand.java</sonar.exclusions>
+        <sonar.exclusions>core/src/main/java/com/cloud/agent/api/PreMigrationCommand.java</sonar.exclusions>
+        <sonar.exclusions>core/src/main/java/org/apache/cloudstack/storage/command/ClvmLockTransferCommand.java</sonar.exclusions>
 
         <!-- Build properties -->
         <cs.jdk.version>11</cs.jdk.version>
diff --git a/scripts/coverage-grade.sh b/scripts/coverage-grade.sh
new file mode 100755
index 000000000000..fc7edc8dcb99
--- /dev/null
+++ b/scripts/coverage-grade.sh
@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# coverage-grade.sh
+#
+# Parses the JaCoCo aggregate XML report and outputs an A–F coverage grade.
+#
+# Usage:
+#   ./scripts/coverage-grade.sh [path/to/jacoco.xml]
+#
+# Exit codes:
+#   0 – grade is D or above  (line coverage >= 20%)
+#   1 – grade is F            (line coverage <  20%)
+#
+# Environment variables (optional, used when writing GitHub outputs):
+#   GITHUB_OUTPUT       – set automatically by GitHub Actions
+#   GITHUB_STEP_SUMMARY – set automatically by GitHub Actions
+
+set -euo pipefail
+
+JACOCO_XML="${1:-client/target/site/jacoco-aggregate/jacoco.xml}"
+
+if [[ ! -f "$JACOCO_XML" ]]; then
+  echo "ERROR: JaCoCo report not found at: $JACOCO_XML" >&2
+  exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Parse LINE and BRANCH counters from the top-level <report> element using
+# Python's built-in xml.etree.ElementTree (no extra dependencies needed).
+# ---------------------------------------------------------------------------
+read -r LINE_COVERED LINE_MISSED BRANCH_COVERED BRANCH_MISSED < <(python3 - "$JACOCO_XML" <<'PYEOF'
+import sys, xml.etree.ElementTree as ET
+
+tree = ET.parse(sys.argv[1])
+root = tree.getroot()
+
+lc = lm = bc = bm = 0
+# Sum counters from all <package> children so we get the true aggregate,
+# avoiding any duplicate top-level counter that some JaCoCo versions emit.
+for pkg in root.iter('package'):
+    for counter in pkg.findall('counter'):
+        t = counter.get('type')
+        if t == 'LINE':
+            lc += int(counter.get('covered', 0))
+            lm += int(counter.get('missed',  0))
+        elif t == 'BRANCH':
+            bc += int(counter.get('covered', 0))
+            bm += int(counter.get('missed',  0))
+
+print(lc, lm, bc, bm)
+PYEOF
+)
+
+# ---------------------------------------------------------------------------
+# Compute percentages
+# ---------------------------------------------------------------------------
+line_total=$(( LINE_COVERED + LINE_MISSED ))
+branch_total=$(( BRANCH_COVERED + BRANCH_MISSED ))
+
+if (( line_total == 0 )); then
+  echo "ERROR: No LINE counters found in $JACOCO_XML – was the build run with -P quality?" >&2
+  exit 2
+fi
+
+# Use awk for floating-point arithmetic
+LINE_PCT=$(awk "BEGIN { printf \"%.2f\", ($LINE_COVERED / $line_total) * 100 }")
+
+if (( branch_total > 0 )); then
+  BRANCH_PCT=$(awk "BEGIN { printf \"%.2f\", ($BRANCH_COVERED / $branch_total) * 100 }")
+else
+  BRANCH_PCT="N/A"
+fi
+
+# ---------------------------------------------------------------------------
+# Assign grade based on LINE coverage
+#
+#  A  ≥ 80%   Excellent
+#  B  60–79%  Good
+#  C  40–59%  Acceptable
+#  D  20–39%  Marginal (meets minimum gate)
+#  F  < 20%   Failing
+# ---------------------------------------------------------------------------
+LINE_INT=$(awk "BEGIN { printf \"%d\", $LINE_PCT }")   # truncate, not round
+
+if   (( LINE_INT >= 80 )); then GRADE="A"; EMOJI="🟢"; LABEL="Excellent"
+elif (( LINE_INT >= 60 )); then GRADE="B"; EMOJI="🟡"; LABEL="Good"
+elif (( LINE_INT >= 40 )); then GRADE="C"; EMOJI="🟠"; LABEL="Acceptable"
+elif (( LINE_INT >= 20 )); then GRADE="D"; EMOJI="🔴"; LABEL="Marginal"
+else                             GRADE="F"; EMOJI="⛔"; LABEL="Failing"
+fi
+
+# ---------------------------------------------------------------------------
+# Human-readable output (always printed to stdout)
+# ---------------------------------------------------------------------------
+echo "┌─────────────────────────────────────────────────┐"
+echo "│          CloudStack Test Coverage Report         │"
+echo "├─────────────────────────────────────────────────┤"
+printf  "│  Grade        : %s %-5s  %-20s     │\n" "$EMOJI" "$GRADE" "($LABEL)"
+printf  "│  Line coverage: %6s%%  (%d / %d lines)%*s│\n" \
+        "$LINE_PCT" "$LINE_COVERED" "$line_total" \
+        $(( 14 - ${#LINE_COVERED} - ${#line_total} )) " "
+if [[ "$BRANCH_PCT" != "N/A" ]]; then
+  printf "│  Branch cov.  : %6s%%  (%d / %d branches)%*s│\n" \
+         "$BRANCH_PCT" "$BRANCH_COVERED" "$branch_total" \
+         $(( 11 - ${#BRANCH_COVERED} - ${#branch_total} )) " "
+else
+  printf "│  Branch cov.  : N/A (no branch data)           │\n"
+fi
+echo "└─────────────────────────────────────────────────┘"
+echo ""
+echo "Grade scale:  A ≥80%  B 60-79%  C 40-59%  D 20-39%  F <20%  (line coverage)"
+
+# ---------------------------------------------------------------------------
+# GitHub Actions: write outputs and step summary
+# ---------------------------------------------------------------------------
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  {
+    echo "coverage_grade=$GRADE"
+    echo "coverage_grade_label=$LABEL"
+    echo "line_coverage=$LINE_PCT"
+    echo "branch_coverage=$BRANCH_PCT"
+  } >> "$GITHUB_OUTPUT"
+fi
+
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+  {
+    echo "## $EMOJI Test Coverage Grade: **$GRADE** — $LABEL"
+    echo ""
+    echo "| Metric | Covered | Total | Percentage |"
+    echo "|--------|---------|-------|------------|"
+    echo "| Line coverage | $LINE_COVERED | $line_total | **${LINE_PCT}%** |"
+    if [[ "$BRANCH_PCT" != "N/A" ]]; then
+      echo "| Branch coverage | $BRANCH_COVERED | $branch_total | **${BRANCH_PCT}%** |"
+    fi
+    echo ""
+    echo "### Grade Scale"
+    echo "| Grade | Line Coverage | Meaning |"
+    echo "|-------|--------------|---------|"
+    echo "| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |"
+    echo "| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |"
+    echo "| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |"
+    echo "| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |"
+    echo "| ⛔ F | < 20% | tests? what tests? 🔥 |"
+    echo ""
+    echo "> Branch coverage is shown as a secondary signal. Grade is based on line coverage."
+  } >> "$GITHUB_STEP_SUMMARY"
+fi
+
+# ---------------------------------------------------------------------------
+# Exit non-zero for grade F so the CI job can be configured to fail
+# ---------------------------------------------------------------------------
+if [[ "$GRADE" == "F" ]]; then
+  echo ""
+  echo "⛔  FAIL: Line coverage ${LINE_PCT}% is below the minimum threshold of 20%." >&2
+  exit 1
+fi
+
+exit 0
diff --git a/scripts/storage/qcow2/managesnapshot.sh b/scripts/storage/qcow2/managesnapshot.sh
index 3650bdd9b6f6..a575fdd4ca2a 100755
--- a/scripts/storage/qcow2/managesnapshot.sh
+++ b/scripts/storage/qcow2/managesnapshot.sh
@@ -58,15 +58,25 @@ is_lv() {
 }
 
 get_vg() {
-	lvm lvs --noheadings --unbuffered --separator=/ "${1}" | cut -d '/' -f 2
+	lvm lvs --noheadings --unbuffered --separator=/ "${1}" | cut -d '/' -f 2 | tr -d ' '
 }
 
 get_lv() {
-	lvm lvs --noheadings --unbuffered --separator=/ "${1}" | cut -d '/' -f 1
+	lvm lvs --noheadings --unbuffered --separator=/ "${1}" | cut -d '/' -f 1 | tr -d ' '
 }
 
-double_hyphens() {
-	echo ${1} | sed -e "s/-/--/g"
+# Check if a block device contains QCOW2 data (CLVM_NG)
+is_qcow2_on_block_device() {
+	local disk=$1
+
+	# Must be a block device
+	if [ ! -b "${disk}" ]; then
+		return 1
+	fi
+
+	# Check if it contains QCOW2 data using qemu-img info
+	${qemu_img} info "${disk}" 2>/dev/null | grep -q "file format: qcow2"
+	return $?
 }
 
 create_snapshot() {
@@ -79,28 +89,36 @@ create_snapshot() {
   if [ ${dmsnapshot} = "yes" ] && [ "$islv_ret" == "1" ]; then
     local lv=`get_lv ${disk}`
     local vg=`get_vg ${disk}`
-    local lv_dm=`double_hyphens ${lv}`
-    local vg_dm=`double_hyphens ${vg}`
-    local lvdevice=/dev/mapper/${vg_dm}-${lv_dm}
-    local lv_bytes=`blockdev --getsize64 ${lvdevice}`
-    local lv_sectors=`blockdev --getsz ${lvdevice}`
-
-    lvm lvcreate --size ${lv_bytes}b --name "${snapshotname}-cow" ${vg} >&2 || return 2
-    dmsetup suspend ${vg_dm}-${lv_dm} >&2
-    if dmsetup info -c --noheadings -o name ${vg_dm}-${lv_dm}-real > /dev/null 2>&1; then
-      echo "0 ${lv_sectors} snapshot ${lvdevice}-real /dev/mapper/${vg_dm}-${snapshotname}--cow p 64" | \
-       dmsetup create "${vg_dm}-${snapshotname}" >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-      dmsetup resume "${vg_dm}-${snapshotname}" >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-    else
-      dmsetup table ${vg_dm}-${lv_dm} | dmsetup create ${vg_dm}-${lv_dm}-real >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-      dmsetup resume ${vg_dm}-${lv_dm}-real >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-      echo "0 ${lv_sectors} snapshot ${lvdevice}-real /dev/mapper/${vg_dm}-${snapshotname}--cow p 64" | \
-       dmsetup create "${vg_dm}-${snapshotname}" >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-      echo "0 ${lv_sectors} snapshot-origin ${lvdevice}-real" | \
-       dmsetup load ${vg_dm}-${lv_dm} >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
-      dmsetup resume "${vg_dm}-${snapshotname}" >&2 || ( destroy_snapshot ${disk} "${snapshotname}"; return 2 )
+    local lv_bytes=`blockdev --getsize64 ${disk}`
+
+    # Calculate snapshot size (10% of origin size, minimum 100MB, maximum 10GB)
+    local snapshot_size=$((lv_bytes / 10))
+    local min_size=$((100 * 1024 * 1024))  # 100MB
+    local max_size=$((10 * 1024 * 1024 * 1024))  # 10GB
+
+    if [ ${snapshot_size} -lt ${min_size} ]; then
+      snapshot_size=${min_size}
+    elif [ ${snapshot_size} -gt ${max_size} ]; then
+      snapshot_size=${max_size}
+    fi
+
+    # Round to nearest 512-byte multiple (LVM requirement)
+    snapshot_size=$(((snapshot_size + 511) / 512 * 512))
+
+    # Create LVM snapshot using native command
+    lvm lvcreate -L ${snapshot_size}b -s -n "${snapshotname}" "${vg}/${lv}" >&2
+    if [ $? -gt 0 ]; then
+      printf "***Failed to create LVM snapshot ${snapshotname} for ${vg}/${lv}\n" >&2
+      return 2
+    fi
+
+    # Activate the snapshot
+    lvm lvchange --yes -ay "${vg}/${snapshotname}" >&2
+    if [ $? -gt 0 ]; then
+      printf "***Failed to activate LVM snapshot ${snapshotname}\n" >&2
+      lvm lvremove -f "${vg}/${snapshotname}" >&2
+      return 2
     fi
-    dmsetup resume "${vg_dm}-${lv_dm}" >&2
   elif [ -f "${disk}" ]; then
      $qemu_img snapshot -c "$snapshotname" $disk
 
@@ -128,29 +146,32 @@ destroy_snapshot() {
   local disk=$1
   local snapshotname="$2"
   local failed=0
+
+  # If the disk path does not exist any more, assume volume was deleted and
+  # the snapshot is already gone — return success to let caller proceed.
+  if [ ! -e "${disk}" ]; then
+    printf "Disk %s does not exist; assuming volume removed and snapshot %s is deleted\n" "${disk}" "${snapshotname}" >&2
+    return 0
+  fi
+
   is_lv ${disk}
   islv_ret=$?
 
   if [ "$islv_ret" == "1" ]; then
     local lv=`get_lv ${disk}`
     local vg=`get_vg ${disk}`
-    local lv_dm=`double_hyphens ${lv}`
-    local vg_dm=`double_hyphens ${vg}`
-    if [ -e /dev/mapper/${vg_dm}-${lv_dm}-real ]; then
-      local dm_refcount=`dmsetup info -c --noheadings -o open ${vg_dm}-${lv_dm}-real`
-      if [ ${dm_refcount} -le 2 ]; then
-        dmsetup suspend ${vg_dm}-${lv_dm} >&2
-        dmsetup table ${vg_dm}-${lv_dm}-real | dmsetup load ${vg_dm}-${lv_dm} >&2
-        dmsetup resume ${vg_dm}-${lv_dm}
-        dmsetup remove "${vg_dm}-${snapshotname}"
-        dmsetup remove ${vg_dm}-${lv_dm}-real
-      else
-        dmsetup remove "${vg_dm}-${snapshotname}"
-      fi
-    else
-      dmsetup remove "${vg_dm}-${snapshotname}"
+
+    # Check if snapshot exists
+    if ! lvm lvs "${vg}/${snapshotname}" > /dev/null 2>&1; then
+      printf "Snapshot ${vg}/${snapshotname} does not exist or was already deleted\n" >&2
+      return 0
+    fi
+
+    lvm lvremove -f "${vg}/${snapshotname}" >&2
+    if [ $? -gt 0 ]; then
+      printf "***Failed to remove LVM snapshot ${vg}/${snapshotname}\n" >&2
+      return 2
     fi
-    lvm lvremove -f "${vg}/${snapshotname}-cow"
   elif [ -f $disk ]; then
      #delete all the existing snapshots
      $qemu_img snapshot -l $disk |tail -n +3|awk '{print $1}'|xargs -I {} $qemu_img snapshot -d {} $disk >&2
@@ -170,12 +191,36 @@ rollback_snapshot() {
   local disk=$1
   local snapshotname="$2"
   local failed=0
+  is_lv ${disk}
+  islv_ret=$?
 
-  $qemu_img snapshot -a $snapshotname $disk
+  if [ ${dmrollback} = "yes" ] && [ "$islv_ret" == "1" ]; then
+    local lv=`get_lv ${disk}`
+    local vg=`get_vg ${disk}`
 
-  if [ $? -gt 0 ]
-  then
-    printf "***Failed to apply snapshot $snapshotname for path $disk\n" >&2
+    # Check if snapshot exists
+    if ! lvm lvs "${vg}/${snapshotname}" > /dev/null 2>&1; then
+      printf "***Snapshot ${vg}/${snapshotname} does not exist\n" >&2
+      return 1
+    fi
+
+    # Use lvconvert --merge to rollback
+    lvm lvconvert --merge "${vg}/${snapshotname}" >&2
+    if [ $? -gt 0 ]; then
+      printf "***Failed to merge/rollback snapshot ${snapshotname} for ${vg}/${lv}\n" >&2
+      return 1
+    fi
+  elif [ -f ${disk} ]; then
+    # File-based snapshot rollback using qemu-img
+    $qemu_img snapshot -a $snapshotname $disk
+
+    if [ $? -gt 0 ]
+    then
+      printf "***Failed to apply snapshot $snapshotname for path $disk\n" >&2
+      failed=1
+    fi
+  else
+    printf "***Failed to rollback snapshot $snapshotname, undefined type $disk\n" >&2
     failed=1
   fi
 
@@ -202,22 +247,31 @@ backup_snapshot() {
   is_lv ${disk}
   islv_ret=$?
 
+  # Both CLVM and CLVM_NG use LVM snapshot backup, but with different formats
   if [ ${dmsnapshot} = "yes" ] && [ "$islv_ret" == "1" ] ; then
     local vg=`get_vg ${disk}`
-    local vg_dm=`double_hyphens ${vg}`
     local scriptdir=`dirname ${0}`
+    local input_format="raw"
 
-    if ! dmsetup info -c --noheadings -o name ${vg_dm}-${snapshotname} > /dev/null 2>&1; then
+    # Check if snapshot exists using native LVM command
+    if ! lvm lvs "${vg}/${snapshotname}" > /dev/null 2>&1; then
       printf "Disk ${disk} has no snapshot called ${snapshotname}.\n" >&2
       return 1
     fi
 
-    qemuimg_ret=$($qemu_img $forceShareFlag -f raw -O qcow2 "/dev/mapper/${vg_dm}-${snapshotname}" "${destPath}/${destName}")
+    # Detect if this is CLVM_NG (QCOW2 on block device)
+    if is_qcow2_on_block_device "${disk}"; then
+      input_format="qcow2"
+      printf "Detected CLVM_NG volume, using qcow2 format for backup\n" >&2
+    fi
+
+    # Use native LVM path for backup with appropriate format
+    qemuimg_ret=$($qemu_img convert $forceShareFlag -f ${input_format} -O qcow2 "/dev/${vg}/${snapshotname}" "${destPath}/${destName}" 2>&1)
     ret_code=$?
-    if [ $ret_code -gt 0 ] && [[ $qemuimg_ret == *"snapshot: invalid option -- 'U'"* ]]
+    if [ $ret_code -gt 0 ] && ([[ $qemuimg_ret == *"invalid option"*"'U'"* ]] || [[ $qemuimg_ret == *"unrecognized option"*"'-U'"* ]])
     then
       forceShareFlag=""
-      $qemu_img $forceShareFlag -f raw -O qcow2 "/dev/mapper/${vg_dm}-${snapshotname}" "${destPath}/${destName}"
+      $qemu_img convert $forceShareFlag -f ${input_format} -O qcow2 "/dev/${vg}/${snapshotname}" "${destPath}/${destName}"
       ret_code=$?
     fi
     if [ $ret_code -gt 0 ]
@@ -240,9 +294,9 @@ backup_snapshot() {
       # Backup VM snapshot
       qemuimg_ret=$($qemu_img snapshot $forceShareFlag -l $disk 2>&1)
       ret_code=$?
-      if [ $ret_code -gt 0 ] && [[ $qemuimg_ret == *"snapshot: invalid option -- 'U'"* ]]; then
+      if [ $ret_code -gt 0 ] && ([[ $qemuimg_ret == *"invalid option"*"'U'"* ]] || [[ $qemuimg_ret == *"unrecognized option"*"'-U'"* ]]); then
         forceShareFlag=""
-        qemuimg_ret=$($qemu_img snapshot $forceShareFlag -l $disk)
+        qemuimg_ret=$($qemu_img snapshot $forceShareFlag -l $disk 2>&1)
         ret_code=$?
       fi
 
@@ -251,11 +305,11 @@ backup_snapshot() {
         return 1
       fi
 
-      qemuimg_ret=$($qemu_img convert $forceShareFlag -f qcow2 -O qcow2 -l snapshot.name=$snapshotname $disk $destPath/$destName 2>&1 > /dev/null)
+      qemuimg_ret=$($qemu_img convert $forceShareFlag -f qcow2 -O qcow2 -l snapshot.name=$snapshotname $disk $destPath/$destName 2>&1)
       ret_code=$?
-      if [ $ret_code -gt 0 ] && [[ $qemuimg_ret == *"convert: invalid option -- 'U'"* ]]; then
+      if [ $ret_code -gt 0 ] && ([[ $qemuimg_ret == *"invalid option"*"'U'"* ]] || [[ $qemuimg_ret == *"unrecognized option"*"'-U'"* ]]); then
         forceShareFlag=""
-        qemuimg_ret=$($qemu_img convert $forceShareFlag -f qcow2 -O qcow2 -l snapshot.name=$snapshotname $disk $destPath/$destName 2>&1 > /dev/null)
+        qemuimg_ret=$($qemu_img convert $forceShareFlag -f qcow2 -O qcow2 -l snapshot.name=$snapshotname $disk $destPath/$destName 2>&1)
         ret_code=$?
       fi
 
@@ -279,7 +333,19 @@ backup_snapshot() {
 revert_snapshot() {
   local snapshotPath=$1
   local destPath=$2
-  ${qemu_img} convert -f qcow2 -O qcow2 "$snapshotPath" "$destPath" || \
+  local output_format="qcow2"
+
+  # Check if destination is a block device
+  if [ -b "$destPath" ]; then
+    if is_qcow2_on_block_device "${destPath}"; then
+      output_format="qcow2"
+      printf "Detected CLVM_NG volume %s, preserving QCOW2 format for revert\n" "${destPath}" >&2
+    else
+      output_format="raw"
+    fi
+  fi
+
+  ${qemu_img} convert -f qcow2 -O ${output_format} "$snapshotPath" "$destPath" || \
    ( printf "${qemu_img} failed to revert snapshot ${snapshotPath} to disk ${destPath}.\n" >&2; return 2 )
   return 0
 }
diff --git a/scripts/storage/qcow2/resizevolume.sh b/scripts/storage/qcow2/resizevolume.sh
index a45f2e1151a7..f7721e5bb3de 100755
--- a/scripts/storage/qcow2/resizevolume.sh
+++ b/scripts/storage/qcow2/resizevolume.sh
@@ -156,6 +156,147 @@ resizelvm() {
   log "performed successful resize - dm:$dmname currentsize:$currentsize newsize:$newsize path:$path type:$ptype vmname:$vmname live:$liveresize shrink:$shrink"
 }
 
+resizeclvmng() {
+  local liveresize='false'
+
+  if ! `lvresize --version > /dev/null 2>&1`
+  then
+    log "unable to resolve executable 'lvresize'" 1
+    exit 1
+  fi
+
+  if ! `qemu-img info /dev/null > /dev/null 2>&1`
+  then
+    log "unable to resolve executable 'qemu-img'" 1
+    exit 1
+  fi
+
+  if ! `virsh --version > /dev/null 2>&1`
+  then
+    log "unable to resolve executable 'virsh'" 1
+    exit 1
+  fi
+
+  vgname=$(echo "$path" | awk -F'/' '{print $3}')
+  if [[ -z "$vgname" ]]
+  then
+    log "unable to derive VG name from path $path" 1
+    exit 1
+  fi
+
+  # Query PE size in bytes (strip trailing 'B' if present)
+  pe_size_raw=$(vgdisplay --units b -C --noheadings -o vg_extent_size "$vgname" 2>/dev/null | tr -d ' ')
+  pe_size_raw="${pe_size_raw%B}"
+  if [[ -z "$pe_size_raw" || ! "$pe_size_raw" =~ ^[0-9]+$ ]]
+  then
+    log "could not query PE size for VG $vgname, defaulting to 4MiB"
+    pe_size=$((4 * 1024 * 1024))
+  else
+    pe_size=$pe_size_raw
+  fi
+
+  # Calculate new LV size: newsize (virtual) + QCOW2 metadata overhead, rounded up to PE
+  # QCOW2 cluster size = 64KiB, L2 table covers 4096 clusters each
+  cluster_size=$((64 * 1024))
+  l2_multiplier=4096
+  num_data_clusters=$(( (newsize + cluster_size - 1) / cluster_size ))
+  num_l2_clusters=$(( (num_data_clusters + l2_multiplier - 1) / l2_multiplier ))
+  l2_table_size=$(( num_l2_clusters * cluster_size ))
+  refcount_table_size=$l2_table_size
+  header_overhead=$(( 2 * 1024 * 1024 ))
+  metadata_overhead=$(( l2_table_size + refcount_table_size + header_overhead ))
+  target_lv_size=$(( newsize + metadata_overhead ))
+  # Round up to PE boundary
+  lv_size=$(( ((target_lv_size + pe_size - 1) / pe_size) * pe_size ))
+  pe_aligned_newsize=$(( ((newsize + pe_size - 1) / pe_size) * pe_size ))
+
+  log "CLVM_NG resize: path=$path vg=$vgname pe_size=${pe_size}B virtual=${newsize}B pe_aligned_virtual=${pe_aligned_newsize}B metadata=${metadata_overhead}B lv_size=${lv_size}B"
+
+  # Use -U (force-share) if qemu-img >= 2.10 so we can read info even when
+  # QEMU has the file open with an exclusive lock (VM running case)
+  qemu_force_share_flag=""
+  regex=".*version\s([0-9]+)\.([0-9]+).*"
+  content=$(qemu-img --version | grep version)
+  if [[ $content =~ $regex ]]
+  then
+    ver_major="${BASH_REMATCH[1]}"
+    ver_minor="${BASH_REMATCH[2]}"
+    if [[ ${ver_major} -gt 2 ]] || [[ ${ver_major} -eq 2 && ${ver_minor} -ge 10 ]]
+    then
+      qemu_force_share_flag="-U"
+    fi
+  fi
+
+  actualsize=`qemu-img info $qemu_force_share_flag $path | grep "virtual size" | sed -re 's/^.*\(([0-9]+).*$/\1/g'`
+  if [[ -z "$actualsize" ]]
+  then
+    log "unable to determine current QCOW2 virtual size for $path" 1
+    exit 1
+  fi
+
+  if [ $actualsize -ne $currentsize ]
+  then
+    log "disk isn't the size we think it is: cloudstack said $currentsize, disk said $actualsize."
+  fi
+
+  # Shrink guard on virtual size
+  if [ $actualsize -gt $newsize ]
+  then
+    if [ "$shrink" == "false" ]
+    then
+      log "result would shrink the volume from $actualsize to $newsize, but shrink wasn't confirmed" 1
+      exit 1
+    fi
+  fi
+
+  # Step 1: resize the LV to accommodate new virtual size + overhead
+  output=`lvresize -f -L ${lv_size}B $path 2>&1`
+  retval=$?
+  if [ -z $retval ] || [ $retval -ne 0 ]
+  then
+    log "lvresize failed: $output" 1
+    exit 1
+  fi
+  log "lvresize succeeded: $path to ${lv_size}B"
+
+  # Step 2: resize the QCOW2 virtual disk.
+  # If the VM is running QEMU has the file open, calling qemu-img resize on an open file
+  # is unsafe. Instead use virsh blockresize which tells QEMU to resize the virtual disk
+  # safely from within. If the VM is stopped, qemu-img resize is safe to use directly.
+  if `virsh domstate $vmname >/dev/null 2>&1`
+  then
+    log "VM $vmname is running, using virsh blockresize for safe live QCOW2 resize"
+    sizeinkb=$(($pe_aligned_newsize/1024))
+    devicepath=$(virsh domblklist $vmname | grep $path | awk '{print $1}')
+    if [[ -z "$devicepath" ]]
+    then
+      log "could not find device alias for $path in VM $vmname domblklist" 1
+      exit 1
+    fi
+    output=`virsh blockresize --path $devicepath --size $sizeinkb $vmname 2>&1`
+    retval=$?
+    if [ -z $retval ] || [ $retval -ne 0 ]
+    then
+      log "virsh blockresize failed: $output" 1
+      exit 1
+    fi
+    liveresize='true'
+    log "virsh blockresize succeeded: $vmname $devicepath to ${sizeinkb}KiB virtual"
+  else
+    log "VM $vmname is not running, using qemu-img resize"
+    output=`qemu-img resize $path $pe_aligned_newsize 2>&1`
+    retval=$?
+    if [ -z $retval ] || [ $retval -ne 0 ]
+    then
+      log "qemu-img resize failed: $output" 1
+      exit 1
+    fi
+    log "qemu-img resize succeeded: $path to ${pe_aligned_newsize}B virtual"
+  fi
+
+  log "performed successful CLVM_NG resize - currentsize:$currentsize newsize:$newsize lv_size:$lv_size path:$path vmname:$vmname live:$liveresize shrink:$shrink"
+}
+
 resizeqcow2() {
 
    ##### sanity checks #####
@@ -271,6 +412,9 @@ shouldwelog=1 #set this to 1 while debugging to get output in /var/log/cloudstac
 if [ "$ptype" == "CLVM" ]
 then
   resizelvm
+elif [ "$ptype" == "CLVM_NG" ]
+then
+  resizeclvmng
 elif [ "$ptype" == "QCOW2" ]
 then
   resizeqcow2
diff --git a/scripts/util/keystore-cert-import b/scripts/util/keystore-cert-import
index cf355e098454..447dcd71745f 100755
--- a/scripts/util/keystore-cert-import
+++ b/scripts/util/keystore-cert-import
@@ -137,18 +137,19 @@ if [ -f "$SYSTEM_FILE" ]; then
     chmod 644 /usr/local/share/ca-certificates/cloudstack/ca.crt
     update-ca-certificates > /dev/null 2>&1 || true
 
-    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
-    # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
-    # can trust servers signed by the CloudStack CA
-    REALHOSTIP_KS_FILE="$(dirname "$(dirname "$PROPS_FILE")")/certs/realhostip.keystore"
-    REALHOSTIP_PASS="vmops.com"
-    if [ -f "$REALHOSTIP_KS_FILE" ]; then
+    # Also import CA cert(s) into systemvm.keystore. KS_FILE (cloud.jks) above
+    # is the agent's mTLS keystore; the SSVM JVM, however, reads its truststore
+    # from systemvm.keystore (see -Djavax.net.ssl.trustStore in _run.sh), so the
+    # CA must be added here too for the SSVM to trust CloudStack-CA-signed servers.
+    SYSTEMVM_KS_FILE="$(dirname "$(dirname "$PROPS_FILE")")/certs/systemvm.keystore"
+    SYSTEMVM_PASS="vmops.com"
+    if [ -f "$SYSTEMVM_KS_FILE" ]; then
         awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
         for caChain in $(ls cloudca.* 2>/dev/null); do
-            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
-                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -delete -noprompt -alias "$caChain" -keystore "$SYSTEMVM_KS_FILE" \
+                -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1 || true
             keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
-                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+                -keystore "$SYSTEMVM_KS_FILE" -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1
         done
         rm -f cloudca.*
     fi
diff --git a/scripts/vm/hypervisor/kvm/imageserver/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/__init__.py
new file mode 100644
index 000000000000..7392dfd3b756
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/__init__.py
@@ -0,0 +1,32 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+CloudStack image server — HTTP server backed by NBD over Unix socket or a local file.
+
+Transfer configs are registered/unregistered by the cloudstack-agent via a
+Unix domain control socket (default: /var/run/cloudstack/image-server.sock)
+and stored in-memory for the lifetime of the server process.
+
+Supports two backends (configured per-transfer at registration time):
+- nbd: proxy to an NBD server via Unix socket; supports range reads/writes
+  (GET/PUT/PATCH), extents, zero, flush.
+- file: read/write a local qcow2/raw file; full PUT only, GET with optional
+  ranges, flush.
+
+Run as a systemd service by the CreateImageTransfer CloudStack Agent Command
+"""
diff --git a/scripts/vm/hypervisor/kvm/imageserver/__main__.py b/scripts/vm/hypervisor/kvm/imageserver/__main__.py
new file mode 100644
index 000000000000..e64bd5f65205
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/__main__.py
@@ -0,0 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from .server import main
+
+main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py
new file mode 100644
index 000000000000..36080b4cbe73
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from typing import Any, Dict
+
+from .base import BackendSession, ImageBackend
+from .file import FileBackend
+from .nbd import NbdBackend
+
+__all__ = ["BackendSession", "ImageBackend", "FileBackend", "NbdBackend", "create_backend"]
+
+
+def create_backend(cfg: Dict[str, Any]) -> ImageBackend:
+    """Factory: build the correct ImageBackend from a transfer config dict."""
+    backend_type = cfg.get("backend", "nbd")
+    if backend_type == "file":
+        return FileBackend(cfg["file"])
+    return NbdBackend(
+        cfg["socket"],
+        export=cfg.get("export"),
+        export_bitmap=cfg.get("export_bitmap"),
+    )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/base.py b/scripts/vm/hypervisor/kvm/imageserver/backends/base.py
new file mode 100644
index 000000000000..b081640e2d38
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/base.py
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from abc import ABC, abstractmethod
+from typing import Any, Dict, List
+
+
+class BackendSession(ABC):
+    """
+    A session that holds an open connection/file handle for the duration of
+    an operation (e.g. a full GET streaming read).  Use as a context manager.
+    """
+
+    @abstractmethod
+    def size(self) -> int:
+        """Return the image size in bytes."""
+        ...
+
+    @abstractmethod
+    def read(self, offset: int, length: int) -> bytes:
+        """
+        Read *length* bytes starting at *offset*.
+
+        For NBD backends, raises RuntimeError if the server returns empty data.
+        For file backends, returns empty bytes at EOF.
+        """
+        ...
+
+    @abstractmethod
+    def close(self) -> None:
+        """Release the underlying connection or file handle."""
+        ...
+
+    def __enter__(self) -> "BackendSession":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
+
+
+class ImageBackend(ABC):
+    """
+    Abstract base class for image storage backends.
+
+    Each backend (NBD, file, etc.) implements this interface so the HTTP handler
+    can operate uniformly without backend-specific branching.
+    """
+
+    @property
+    @abstractmethod
+    def supports_extents(self) -> bool:
+        """Whether this backend supports querying allocation/dirty extents."""
+        ...
+
+    @property
+    @abstractmethod
+    def supports_range_write(self) -> bool:
+        """Whether this backend supports writing at arbitrary byte offsets."""
+        ...
+
+    @abstractmethod
+    def size(self) -> int:
+        """Return the image size in bytes."""
+        ...
+
+    @abstractmethod
+    def read(self, offset: int, length: int) -> bytes:
+        """Read *length* bytes starting at *offset*."""
+        ...
+
+    @abstractmethod
+    def write(self, data: bytes, offset: int) -> None:
+        """Write *data* at *offset*."""
+        ...
+
+    @abstractmethod
+    def write_full(self, stream, content_length: int, flush: bool) -> int:
+        """
+        Consume *content_length* bytes from *stream* and write the full image.
+        Returns bytes written.  Raises on short read.
+        """
+        ...
+
+    @abstractmethod
+    def flush(self) -> None:
+        """Flush pending data to stable storage."""
+        ...
+
+    @abstractmethod
+    def zero(self, offset: int, length: int) -> None:
+        """Zero *length* bytes starting at *offset*."""
+        ...
+
+    @abstractmethod
+    def get_capabilities(self) -> Dict[str, bool]:
+        """
+        Return backend capabilities dict with keys:
+        read_only, can_flush, can_zero.
+        """
+        ...
+
+    @abstractmethod
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        """
+        Return allocation extents as [{"start": int, "length": int, "zero": bool}, ...].
+        """
+        ...
+
+    @abstractmethod
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        """
+        Return merged dirty+zero extents as
+        [{"start": int, "length": int, "dirty": bool, "zero": bool}, ...].
+        """
+        ...
+
+    @abstractmethod
+    def open_session(self) -> BackendSession:
+        """
+        Open a session that holds a single connection/file handle for the
+        duration of a streaming operation (e.g. GET).
+        """
+        ...
+
+    @abstractmethod
+    def close(self) -> None:
+        """Release any resources held by this backend."""
+        ...
+
+    def __enter__(self) -> "ImageBackend":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/file.py b/scripts/vm/hypervisor/kvm/imageserver/backends/file.py
new file mode 100644
index 000000000000..9e55bf21fdef
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/file.py
@@ -0,0 +1,123 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import os
+from io import BufferedReader
+from typing import Any, Dict, List, Optional
+
+from ..constants import CHUNK_SIZE
+from .base import BackendSession, ImageBackend
+
+
+class FileSession(BackendSession):
+    """
+    Holds a single file handle open for the duration of a streaming read.
+    Returns empty bytes at EOF (file semantics).
+    """
+
+    def __init__(self, path: str):
+        self._path = path
+        self._fh: Optional[BufferedReader] = open(path, "rb")
+        self._size = os.path.getsize(path)
+
+    def size(self) -> int:
+        return self._size
+
+    def read(self, offset: int, length: int) -> bytes:
+        if self._fh is None:
+            raise RuntimeError("session is closed")
+        self._fh.seek(offset)
+        return self._fh.read(length)
+
+    def close(self) -> None:
+        if self._fh is not None:
+            self._fh.close()
+            self._fh = None
+
+
+class FileBackend(ImageBackend):
+    """
+    ImageBackend implementation backed by a local file (qcow2 or raw).
+    Supports full read/write and flush.  Does not support extents or range writes.
+    """
+
+    def __init__(self, file_path: str):
+        self._path = file_path
+
+    @property
+    def supports_extents(self) -> bool:
+        return False
+
+    @property
+    def supports_range_write(self) -> bool:
+        return False
+
+    def size(self) -> int:
+        return os.path.getsize(self._path)
+
+    def read(self, offset: int, length: int) -> bytes:
+        with open(self._path, "rb") as f:
+            f.seek(offset)
+            return f.read(length)
+
+    def write(self, data: bytes, offset: int) -> None:
+        raise NotImplementedError("file backend does not support range writes")
+
+    def write_full(self, stream: Any, content_length: int, flush: bool) -> int:
+        bytes_written = 0
+        remaining = content_length
+        with open(self._path, "wb") as f:
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {bytes_written} bytes"
+                    )
+                f.write(chunk)
+                bytes_written += len(chunk)
+                remaining -= len(chunk)
+            if flush:
+                f.flush()
+                os.fsync(f.fileno())
+        return bytes_written
+
+    def flush(self) -> None:
+        with open(self._path, "rb") as f:
+            f.flush()
+            os.fsync(f.fileno())
+
+    def zero(self, offset: int, length: int) -> None:
+        raise NotImplementedError("file backend does not support zero")
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        return {
+            "read_only": False,
+            "can_flush": True,
+            "can_zero": False,
+        }
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        raise NotImplementedError("file backend does not support extents")
+
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        raise NotImplementedError("file backend does not support extents")
+
+    def open_session(self) -> FileSession:
+        return FileSession(self._path)
+
+    def close(self) -> None:
+        pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
new file mode 100644
index 000000000000..c68a3b5188b6
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
@@ -0,0 +1,471 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+import socket
+from typing import Any, Dict, List, Optional, Tuple
+
+import nbd
+
+from ..constants import (
+    CHUNK_SIZE,
+    NBD_BLOCK_STATUS_CHUNK,
+    NBD_STATE_DIRTY,
+    NBD_STATE_HOLE,
+    NBD_STATE_ZERO,
+)
+from ..util import coalesce_allocation_extents, merge_dirty_zero_extents
+from .base import BackendSession, ImageBackend
+
+
+class NbdConnection:
+    """
+    Low-level helper to connect to an NBD server over a Unix socket.
+    Opens a fresh handle per connection.
+    """
+
+    def __init__(
+        self,
+        socket_path: str,
+        export: Optional[str],
+        need_block_status: bool = False,
+        extra_meta_contexts: Optional[List[str]] = None,
+    ):
+        self._nbd = nbd.NBD()
+
+        if export and hasattr(self._nbd, "set_export_name"):
+            self._nbd.set_export_name(export)
+
+        if need_block_status and hasattr(self._nbd, "add_meta_context"):
+            for ctx in ["base:allocation"] + (extra_meta_contexts or []):
+                try:
+                    self._nbd.add_meta_context(ctx)
+                except Exception as e:
+                    logging.warning("add_meta_context %r failed: %r", ctx, e)
+
+        self._nbd.connect_unix(socket_path)
+
+    def _connect_existing_socket(self, sock: socket.socket) -> None:
+        last_err: Optional[BaseException] = None
+        if hasattr(self._nbd, "connect_socket"):
+            try:
+                self._nbd.connect_socket(sock)
+                return
+            except Exception as e:
+                last_err = e
+                try:
+                    self._nbd.connect_socket(sock.fileno())
+                    return
+                except Exception as e2:
+                    last_err = e2
+        if hasattr(self._nbd, "connect_fd"):
+            try:
+                self._nbd.connect_fd(sock.fileno())
+                return
+            except Exception as e:
+                last_err = e
+        raise RuntimeError(
+            "Unable to connect libnbd using existing socket/fd; "
+            f"binding missing connect_socket/connect_fd or call failed: {last_err!r}"
+        )
+
+    def size(self) -> int:
+        return int(self._nbd.get_size())
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        """
+        Query NBD export capabilities (read_only, can_flush, can_zero) from the
+        server handshake.  Uses getattr for binding name variations.
+        """
+        out: Dict[str, bool] = {
+            "read_only": True,
+            "can_flush": False,
+            "can_zero": False,
+        }
+        for name, keys in [
+            ("read_only", ("is_read_only", "get_read_only")),
+            ("can_flush", ("can_flush", "get_can_flush")),
+            ("can_zero", ("can_zero", "get_can_zero")),
+        ]:
+            for attr in keys:
+                if hasattr(self._nbd, attr):
+                    try:
+                        val = getattr(self._nbd, attr)()
+                        out[name] = bool(val)
+                    except Exception:
+                        pass
+                    break
+        return out
+
+    def pread(self, length: int, offset: int) -> bytes:
+        try:
+            return self._nbd.pread(length, offset)
+        except TypeError:
+            return self._nbd.pread(offset, length)
+
+    def pwrite(self, buf: bytes, offset: int) -> None:
+        try:
+            self._nbd.pwrite(buf, offset)
+        except TypeError:
+            self._nbd.pwrite(offset, buf)
+
+    def pzero(self, offset: int, size: int) -> None:
+        """
+        Zero a byte range.  Uses NBD WRITE_ZEROES when available,
+        otherwise falls back to writing zero bytes via pwrite.
+        """
+        if size <= 0:
+            return
+        for fn_name in ("pwrite_zeros", "zero"):
+            if not hasattr(self._nbd, fn_name):
+                continue
+            fn = getattr(self._nbd, fn_name)
+            try:
+                fn(size, offset)
+                return
+            except TypeError:
+                try:
+                    fn(offset, size)
+                    return
+                except TypeError:
+                    pass
+        remaining = size
+        pos = offset
+        zero_buf = b"\x00" * min(CHUNK_SIZE, size)
+        while remaining > 0:
+            chunk = min(len(zero_buf), remaining)
+            self.pwrite(zero_buf[:chunk], pos)
+            pos += chunk
+            remaining -= chunk
+
+    def flush(self) -> None:
+        if hasattr(self._nbd, "flush"):
+            self._nbd.flush()
+            return
+        if hasattr(self._nbd, "fsync"):
+            self._nbd.fsync()
+            return
+        raise RuntimeError("libnbd binding has no flush/fsync method")
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        """
+        Query base:allocation and return all extents as
+        [{"start": ..., "length": ..., "zero": bool}, ...].
+        """
+        size = self.size()
+        if size == 0:
+            return []
+        if not hasattr(self._nbd, "block_status") and not hasattr(
+            self._nbd, "block_status_64"
+        ):
+            return [{"start": 0, "length": size, "zero": False}]
+        if hasattr(self._nbd, "can_meta_context") and not self._nbd.can_meta_context(
+            "base:allocation"
+        ):
+            return [{"start": 0, "length": size, "zero": False}]
+
+        allocation_extents: List[Dict[str, Any]] = []
+        chunk = min(size, NBD_BLOCK_STATUS_CHUNK)
+        offset = 0
+
+        def extent_cb(*args: Any, **kwargs: Any) -> int:
+            if len(args) < 3:
+                return 0
+            metacontext, off, entries = args[0], args[1], args[2]
+            if metacontext != "base:allocation" or entries is None:
+                return 0
+            current = off
+            try:
+                flat = list(entries)
+                for i in range(0, len(flat), 2):
+                    if i + 1 >= len(flat):
+                        break
+                    length = int(flat[i])
+                    flags = int(flat[i + 1])
+                    zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
+                    allocation_extents.append(
+                        {"start": current, "length": length, "zero": zero}
+                    )
+                    current += length
+            except (TypeError, ValueError, IndexError):
+                pass
+            return 0
+
+        block_status_fn = getattr(
+            self._nbd, "block_status_64", getattr(self._nbd, "block_status", None)
+        )
+        if block_status_fn is None:
+            return [{"start": 0, "length": size, "zero": False}]
+        try:
+            while offset < size:
+                count = min(chunk, size - offset)
+                try:
+                    block_status_fn(count, offset, extent_cb)
+                except TypeError:
+                    block_status_fn(offset, count, extent_cb)
+                offset += count
+        except Exception as e:
+            logging.warning("get_allocation_extents block_status failed: %r", e)
+            return [{"start": 0, "length": size, "zero": False}]
+        if not allocation_extents:
+            return [{"start": 0, "length": size, "zero": False}]
+        return coalesce_allocation_extents(allocation_extents)
+
+    def get_extents_dirty_and_zero(
+        self, dirty_bitmap_context: str
+    ) -> List[Dict[str, Any]]:
+        """
+        Query block status for base:allocation and a dirty bitmap context,
+        merge boundaries, and return extents with dirty and zero flags.
+        """
+        size = self.size()
+        if size == 0:
+            return []
+        if not hasattr(self._nbd, "block_status") and not hasattr(
+            self._nbd, "block_status_64"
+        ):
+            return self._fallback_dirty_zero_extents(size)
+        if hasattr(self._nbd, "can_meta_context"):
+            if not self._nbd.can_meta_context("base:allocation"):
+                return self._fallback_dirty_zero_extents(size)
+            if not self._nbd.can_meta_context(dirty_bitmap_context):
+                logging.warning(
+                    "dirty bitmap context %r not negotiated", dirty_bitmap_context
+                )
+                return self._fallback_dirty_zero_extents(size)
+
+        allocation_extents: List[Tuple[int, int, bool]] = []
+        dirty_extents: List[Tuple[int, int, bool]] = []
+        chunk = min(size, NBD_BLOCK_STATUS_CHUNK)
+        offset = 0
+
+        def extent_cb(*args: Any, **kwargs: Any) -> int:
+            if len(args) < 3:
+                return 0
+            metacontext, off, entries = args[0], args[1], args[2]
+            if entries is None or not hasattr(entries, "__iter__"):
+                return 0
+            current = off
+            try:
+                flat = list(entries)
+                for i in range(0, len(flat), 2):
+                    if i + 1 >= len(flat):
+                        break
+                    length = int(flat[i])
+                    flags = int(flat[i + 1])
+                    if metacontext == "base:allocation":
+                        zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
+                        allocation_extents.append((current, length, zero))
+                    elif metacontext == dirty_bitmap_context:
+                        dirty = (flags & NBD_STATE_DIRTY) != 0
+                        dirty_extents.append((current, length, dirty))
+                    current += length
+            except (TypeError, ValueError, IndexError):
+                pass
+            return 0
+
+        block_status_fn = getattr(
+            self._nbd, "block_status_64", getattr(self._nbd, "block_status", None)
+        )
+        if block_status_fn is None:
+            return self._fallback_dirty_zero_extents(size)
+        try:
+            while offset < size:
+                count = min(chunk, size - offset)
+                try:
+                    block_status_fn(count, offset, extent_cb)
+                except TypeError:
+                    block_status_fn(offset, count, extent_cb)
+                offset += count
+        except Exception as e:
+            logging.warning("get_extents_dirty_and_zero block_status failed: %r", e)
+            return self._fallback_dirty_zero_extents(size)
+        return merge_dirty_zero_extents(allocation_extents, dirty_extents, size)
+
+    @staticmethod
+    def _fallback_dirty_zero_extents(size: int) -> List[Dict[str, Any]]:
+        return [{"start": 0, "length": size, "dirty": False, "zero": False}]
+
+    def close(self) -> None:
+        try:
+            if hasattr(self._nbd, "shutdown"):
+                self._nbd.shutdown()
+        except Exception:
+            pass
+
+    def __enter__(self) -> "NbdConnection":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
+
+
+class NbdSession(BackendSession):
+    """
+    Holds a single NbdConnection open for the duration of a streaming operation.
+    Raises RuntimeError if pread returns empty data (NBD should never do this).
+    """
+
+    def __init__(self, conn: NbdConnection):
+        self._conn = conn
+
+    def size(self) -> int:
+        return self._conn.size()
+
+    def read(self, offset: int, length: int) -> bytes:
+        data = self._conn.pread(length, offset)
+        if not data:
+            raise RuntimeError("backend returned empty read")
+        return data
+
+    def close(self) -> None:
+        self._conn.close()
+
+
+class NbdBackend(ImageBackend):
+    """
+    ImageBackend implementation that proxies to an NBD server via Unix socket.
+    Each public method opens a fresh NbdConnection (per the original design).
+    """
+
+    def __init__(
+        self,
+        socket_path: str,
+        export: Optional[str] = None,
+        export_bitmap: Optional[str] = None,
+    ):
+        self._socket_path = socket_path
+        self._export = export
+        self._export_bitmap = export_bitmap
+
+    @property
+    def supports_extents(self) -> bool:
+        return True
+
+    @property
+    def supports_range_write(self) -> bool:
+        return True
+
+    @property
+    def export_bitmap(self) -> Optional[str]:
+        return self._export_bitmap
+
+    def _connect(
+        self,
+        need_block_status: bool = False,
+        extra_meta_contexts: Optional[List[str]] = None,
+    ) -> NbdConnection:
+        return NbdConnection(
+            self._socket_path,
+            self._export,
+            need_block_status=need_block_status,
+            extra_meta_contexts=extra_meta_contexts,
+        )
+
+    def size(self) -> int:
+        with self._connect() as conn:
+            return conn.size()
+
+    def read(self, offset: int, length: int) -> bytes:
+        with self._connect() as conn:
+            return conn.pread(length, offset)
+
+    def write(self, data: bytes, offset: int) -> None:
+        with self._connect() as conn:
+            conn.pwrite(data, offset)
+
+    def write_full(self, stream: Any, content_length: int, flush: bool) -> int:
+        bytes_written = 0
+        with self._connect() as conn:
+            offset = 0
+            remaining = content_length
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {offset} bytes"
+                    )
+                conn.pwrite(chunk, offset)
+                offset += len(chunk)
+                remaining -= len(chunk)
+                bytes_written += len(chunk)
+            if flush:
+                conn.flush()
+        return bytes_written
+
+    def write_range(self, stream: Any, start_off: int, content_length: int) -> int:
+        """
+        Write *content_length* bytes from *stream* to the image starting at *start_off*.
+        Returns bytes written.  Raises ValueError if offset/length is out of bounds.
+        """
+        bytes_written = 0
+        with self._connect() as conn:
+            image_size = conn.size()
+            if start_off >= image_size:
+                raise ValueError(f"offset {start_off} >= image size {image_size}")
+            max_len = image_size - start_off
+            if content_length > max_len:
+                raise ValueError(
+                    f"content_length {content_length} exceeds available space {max_len}"
+                )
+            offset = start_off
+            remaining = content_length
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {bytes_written} bytes"
+                    )
+                conn.pwrite(chunk, offset)
+                n = len(chunk)
+                offset += n
+                remaining -= n
+                bytes_written += n
+        return bytes_written
+
+    def flush(self) -> None:
+        with self._connect() as conn:
+            conn.flush()
+
+    def zero(self, offset: int, length: int) -> None:
+        with self._connect() as conn:
+            image_size = conn.size()
+            if offset >= image_size:
+                raise ValueError("offset must be less than image size")
+            zero_size = min(length, image_size - offset)
+            conn.pzero(offset, zero_size)
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        with self._connect() as conn:
+            return conn.get_capabilities()
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        with self._connect(need_block_status=True) as conn:
+            return conn.get_allocation_extents()
+
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        extra_contexts: List[str] = [dirty_bitmap_context]
+        with self._connect(
+            need_block_status=True, extra_meta_contexts=extra_contexts
+        ) as conn:
+            return conn.get_extents_dirty_and_zero(dirty_bitmap_context)
+
+    def open_session(self) -> NbdSession:
+        return NbdSession(self._connect())
+
+    def close(self) -> None:
+        pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/config.py b/scripts/vm/hypervisor/kvm/imageserver/config.py
new file mode 100644
index 000000000000..4bd41c2db56e
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/config.py
@@ -0,0 +1,204 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+import os
+import threading
+import time
+from contextlib import contextmanager
+from typing import Any, Dict, Iterator, List, Optional
+
+from .constants import DEFAULT_IDLE_TIMEOUT_SECONDS
+
+
+def parse_idle_timeout_seconds(obj: dict) -> int:
+    """Seconds of idle time (no completed HTTP requests) before unregister."""
+    v = obj.get("idle_timeout_seconds", DEFAULT_IDLE_TIMEOUT_SECONDS)
+    if not isinstance(v, int):
+        raise ValueError("idle_timeout_seconds must be an integer")
+    v = int(v)
+    if v < 1:
+        v = 86400
+    return v
+
+
+def validate_transfer_config(obj: dict) -> dict:
+    """
+    Validate and normalize a transfer config dict received over the control
+    socket. Returns the cleaned config or raises ValueError.
+    """
+    idle_sec = parse_idle_timeout_seconds(obj)
+
+    backend = obj.get("backend")
+    if backend is None:
+        backend = "nbd"
+    if not isinstance(backend, str):
+        raise ValueError("invalid backend type")
+    backend = backend.lower()
+    if backend not in ("nbd", "file"):
+        raise ValueError(f"unsupported backend: {backend}")
+
+    if backend == "file":
+        file_path = obj.get("file")
+        if not isinstance(file_path, str) or not file_path.strip():
+            raise ValueError("missing/invalid file path for file backend")
+        return {"backend": "file", "file": file_path.strip(), "idle_timeout_seconds": idle_sec}
+
+    socket_path = obj.get("socket")
+    export = obj.get("export")
+    export_bitmap = obj.get("export_bitmap")
+    if not isinstance(socket_path, str) or not socket_path.strip():
+        raise ValueError("missing/invalid socket path for nbd backend")
+    if export is not None and (not isinstance(export, str) or not export):
+        raise ValueError("invalid export name")
+    return {
+        "backend": "nbd",
+        "socket": socket_path.strip(),
+        "export": export,
+        "export_bitmap": export_bitmap,
+        "idle_timeout_seconds": idle_sec,
+    }
+
+
+def safe_transfer_id(image_id: str) -> Optional[str]:
+    """
+    Only allow a single filename component to avoid path traversal.
+    Rejects anything containing '/' or '\\'.
+    """
+    if not image_id:
+        return None
+    if image_id != os.path.basename(image_id):
+        return None
+    if "/" in image_id or "\\" in image_id:
+        return None
+    if image_id in (".", ".."):
+        return None
+    return image_id
+
+
+class TransferRegistry:
+    """
+    Thread-safe in-memory registry for active image transfer configurations.
+
+    The cloudstack-agent registers/unregisters transfers via the Unix domain
+    control socket.  The HTTP handler looks up configs through get().
+
+    Each transfer may specify idle_timeout_seconds (default DEFAULT_IDLE_TIMEOUT_SECONDS).
+    After no in-flight HTTP requests have completed for that idle period, the transfer
+    is removed (same effect as unregister).
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._cv = threading.Condition(self._lock)
+        self._transfers: Dict[str, Dict[str, Any]] = {}
+        self._last_activity: Dict[str, float] = {}
+        self._inflight: Dict[str, int] = {}
+
+    def register(self, transfer_id: str, config: Dict[str, Any]) -> bool:
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            logging.error("register rejected invalid transfer_id=%r", transfer_id)
+            return False
+        with self._lock:
+            self._transfers[safe_id] = config
+            self._last_activity[safe_id] = time.monotonic()
+            self._inflight.pop(safe_id, None)
+            logging.info("registered transfer_id=%s active=%d", safe_id, len(self._transfers))
+            return True
+
+    def unregister(self, transfer_id: str) -> int:
+        """Remove a transfer and return the number of remaining active transfers."""
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            logging.error("unregister rejected invalid transfer_id=%r", transfer_id)
+            with self._lock:
+                return len(self._transfers)
+        with self._cv:
+            while self._inflight.get(safe_id, 0) > 0:
+                self._cv.wait()
+            self._transfers.pop(safe_id, None)
+            self._last_activity.pop(safe_id, None)
+            self._inflight.pop(safe_id, None)
+            remaining = len(self._transfers)
+            logging.info("unregistered transfer_id=%s active=%d", safe_id, remaining)
+            return remaining
+
+    def get(self, transfer_id: str) -> Optional[Dict[str, Any]]:
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            return None
+        with self._lock:
+            return self._transfers.get(safe_id)
+
+    def active_count(self) -> int:
+        with self._lock:
+            return len(self._transfers)
+
+    @contextmanager
+    def request_lifecycle(self, transfer_id: str) -> Iterator[None]:
+        """
+        Track an HTTP request for idle-timeout purposes.
+
+        Expiry is based on time since the last request *completed* (all in-flight
+        work for this transfer_id finished). Transfers with active requests are
+        never expired.
+        """
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            yield
+            return
+        with self._lock:
+            if safe_id not in self._transfers:
+                yield
+                return
+            self._inflight[safe_id] = self._inflight.get(safe_id, 0) + 1
+        try:
+            yield
+        finally:
+            now = time.monotonic()
+            with self._cv:
+                count = self._inflight.get(safe_id, 1) - 1
+                if count <= 0:
+                    self._inflight.pop(safe_id, None)
+                    if safe_id in self._transfers:
+                        self._last_activity[safe_id] = now
+                    self._cv.notify_all()
+                else:
+                    self._inflight[safe_id] = count
+
+    def sweep_expired_transfers(self) -> None:
+        """Remove transfers that exceeded idle_timeout_seconds with no in-flight HTTP work."""
+        now = time.monotonic()
+        with self._lock:
+            expired: List[str] = []
+            for tid, cfg in list(self._transfers.items()):
+                if self._inflight.get(tid, 0) > 0:
+                    continue
+                timeout = int(cfg.get("idle_timeout_seconds", DEFAULT_IDLE_TIMEOUT_SECONDS))
+                last = self._last_activity.get(tid, now)
+                if now - last >= timeout:
+                    expired.append(tid)
+            for tid in expired:
+                self._transfers.pop(tid, None)
+                self._last_activity.pop(tid, None)
+                self._inflight.pop(tid, None)
+                logging.info(
+                    "idle expiry: unregistered transfer_id=%s active=%d",
+                    tid,
+                    len(self._transfers),
+                )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/constants.py b/scripts/vm/hypervisor/kvm/imageserver/constants.py
new file mode 100644
index 000000000000..86d33d57d22c
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/constants.py
@@ -0,0 +1,55 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+
+# Logging level
+LOGGING_LEVEL = logging.INFO
+
+# Read/Write chunk size for NBD backend
+CHUNK_SIZE = 256 * 1024  # 256 KiB
+
+# NBD base:allocation flags (hole=1, zero=2; hole|zero=3)
+NBD_STATE_HOLE = 1
+NBD_STATE_ZERO = 2
+# NBD qemu:dirty-bitmap flags (dirty=1)
+NBD_STATE_DIRTY = 1
+
+MAX_PARALLEL_READS = 4
+MAX_PARALLEL_WRITES = 4
+
+# HTTP server defaults
+DEFAULT_LISTEN_ADDRESS = "127.0.0.1"
+DEFAULT_HTTP_PORT = 54322
+
+# Control socket
+CONTROL_SOCKET = "/var/run/cloudstack/image-server.sock"
+CONTROL_SOCKET_BACKLOG = 32
+CONTROL_SOCKET_PERMISSIONS = 0o660
+CONTROL_RECV_BUFFER = 4096
+
+# Transfer idle timeout (seconds). A transfer is expired when no in-flight HTTP
+# requests have completed for this duration.
+DEFAULT_IDLE_TIMEOUT_SECONDS = 600
+
+# Maximum size of a JSON body in a PATCH request (zero / flush ops)
+MAX_PATCH_JSON_SIZE = 64 * 1024  # 64 KiB
+
+# Byte range requested per block_status call for NBD extent queries
+NBD_BLOCK_STATUS_CHUNK = 64 * 1024 * 1024  # 64 MiB
+
+CFG_DIR = "/tmp/imagetransfer"
diff --git a/scripts/vm/hypervisor/kvm/imageserver/handler.py b/scripts/vm/hypervisor/kvm/imageserver/handler.py
new file mode 100644
index 000000000000..53bef34b95e4
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/handler.py
@@ -0,0 +1,899 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import json
+import logging
+import re
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler
+from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import parse_qs
+
+from .backends import NbdBackend, create_backend
+from .config import TransferRegistry
+from .constants import CHUNK_SIZE, MAX_PARALLEL_READS, MAX_PARALLEL_WRITES, MAX_PATCH_JSON_SIZE
+from .util import is_fallback_dirty_response, json_bytes, now_s
+
+
+class Handler(BaseHTTPRequestHandler):
+    """
+    HTTP request handler for the image server.
+
+    Routing, HTTP parsing, and response formatting live here.
+    All backend I/O is delegated to ImageBackend implementations via the
+    create_backend() factory.
+
+    Class-level attribute _registry is injected
+    by the server at startup (see server.py / make_handler()).
+    """
+
+    server_version = "cloudstack-image-server/1.0"
+    protocol_version = "HTTP/1.1"
+
+    _registry: TransferRegistry
+
+    _CONTENT_RANGE_RE = re.compile(r"^bytes\s+(\d+)-(\d+)/(?:\*|\d+)$")
+
+    def log_message(self, fmt: str, *args: Any) -> None:
+        logging.debug("%s - - %s", self.client_address[0], fmt % args)
+
+    # ------------------------------------------------------------------
+    # Response helpers
+    # ------------------------------------------------------------------
+
+    def _send_imageio_headers(
+        self, allowed_methods: Optional[str] = None
+    ) -> None:
+        if allowed_methods is None:
+            allowed_methods = "GET, PUT, OPTIONS"
+        self.send_header("Access-Control-Allow-Methods", allowed_methods)
+        self.send_header("Accept-Ranges", "bytes")
+
+    def _send_json(
+        self,
+        status: int,
+        obj: Any,
+        allowed_methods: Optional[str] = None,
+    ) -> None:
+        body = json_bytes(obj)
+        self.send_response(status)
+        self._send_imageio_headers(allowed_methods)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        try:
+            self.wfile.write(body)
+        except BrokenPipeError:
+            logging.error(
+                "HTTP response write failure status=%s method=%s path=%s err=%s",
+                int(status),
+                self.command,
+                self.path,
+                "client disconnected",
+            )
+
+    def _send_error_json(self, status: int, message: str) -> None:
+        logging.error(
+            "HTTP failure status=%s method=%s path=%s message=%s",
+            int(status),
+            self.command,
+            self.path,
+            message,
+        )
+        self._send_json(status, {"error": message})
+
+    def _send_range_not_satisfiable(self, size: int) -> None:
+        logging.error(
+            "HTTP failure status=%s method=%s path=%s message=%s size=%s",
+            int(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE),
+            self.command,
+            self.path,
+            "range not satisfiable",
+            size,
+        )
+        self.send_response(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE)
+        self._send_imageio_headers()
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Range", f"bytes */{size}")
+        body = json_bytes({"error": "range not satisfiable"})
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        try:
+            self.wfile.write(body)
+        except BrokenPipeError:
+            logging.error(
+                "HTTP response write failure status=%s method=%s path=%s err=%s",
+                int(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE),
+                self.command,
+                self.path,
+                "client disconnected",
+            )
+
+    # ------------------------------------------------------------------
+    # Parsing helpers
+    # ------------------------------------------------------------------
+
+    def _parse_single_range(self, range_header: str, size: int) -> Tuple[int, int]:
+        """
+        Parse a single HTTP byte range (RFC 7233) and return (start, end_inclusive).
+        Raises ValueError for invalid headers.
+        """
+        if size < 0:
+            raise ValueError("invalid size")
+        if not range_header:
+            raise ValueError("empty Range")
+        if "," in range_header:
+            raise ValueError("multiple ranges not supported")
+
+        prefix = "bytes="
+        if not range_header.startswith(prefix):
+            raise ValueError("only bytes ranges supported")
+        spec = range_header[len(prefix):].strip()
+        if "-" not in spec:
+            raise ValueError("invalid bytes range")
+
+        left, right = spec.split("-", 1)
+        left = left.strip()
+        right = right.strip()
+
+        if left == "":
+            if right == "":
+                raise ValueError("invalid suffix range")
+            try:
+                suffix_len = int(right, 10)
+            except ValueError as e:
+                raise ValueError("invalid suffix length") from e
+            if suffix_len <= 0:
+                raise ValueError("invalid suffix length")
+            if size == 0:
+                raise ValueError("unsatisfiable")
+            if suffix_len >= size:
+                return 0, size - 1
+            return size - suffix_len, size - 1
+
+        try:
+            start = int(left, 10)
+        except ValueError as e:
+            raise ValueError("invalid range start") from e
+        if start < 0:
+            raise ValueError("invalid range start")
+        if start >= size:
+            raise ValueError("unsatisfiable")
+
+        if right == "":
+            return start, size - 1
+
+        try:
+            end = int(right, 10)
+        except ValueError as e:
+            raise ValueError("invalid range end") from e
+        if end < start:
+            raise ValueError("unsatisfiable")
+        if end >= size:
+            end = size - 1
+        return start, end
+
+    def _parse_route(self) -> Tuple[Optional[str], Optional[str]]:
+        path = self.path.split("?", 1)[0]
+        parts = [p for p in path.split("/") if p]
+        if len(parts) < 2 or parts[0] != "images":
+            return None, None
+        image_id = parts[1]
+        tail = parts[2] if len(parts) >= 3 else None
+        if len(parts) > 3:
+            return None, None
+        return image_id, tail
+
+    def _parse_content_range(self, header: str) -> Tuple[int, int]:
+        """
+        Parse Content-Range header "bytes start-end/*" or "bytes start-end/size".
+        Returns (start, end_inclusive).
+        """
+        if not header:
+            raise ValueError("empty Content-Range")
+        m = self._CONTENT_RANGE_RE.match(header.strip())
+        if not m:
+            raise ValueError("invalid Content-Range")
+        start_s, end_s = m.groups()
+        start = int(start_s, 10)
+        end = int(end_s, 10)
+        if start < 0 or end < start:
+            raise ValueError("invalid Content-Range range")
+        return start, end
+
+    def _parse_query(self) -> Dict[str, List[str]]:
+        if "?" not in self.path:
+            return {}
+        query = self.path.split("?", 1)[1]
+        return parse_qs(query, keep_blank_values=True)
+
+    def _image_cfg(self, image_id: str) -> Optional[Dict[str, Any]]:
+        return self._registry.get(image_id)
+
+    # ------------------------------------------------------------------
+    # HTTP verb dispatchers
+    # ------------------------------------------------------------------
+
+    def do_OPTIONS(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            backend = create_backend(cfg)
+            try:
+                max_writers = MAX_PARALLEL_WRITES
+                if not backend.supports_range_write:
+                    max_writers = 1
+
+                if not backend.supports_extents:
+                    allowed_methods = "GET, PUT, POST, OPTIONS"
+                    features = ["flush"]
+                    response = {
+                        "unix_socket": None,
+                        "features": features,
+                        "max_readers": MAX_PARALLEL_READS,
+                        "max_writers": max_writers,
+                    }
+                    self._send_json(HTTPStatus.OK, response, allowed_methods=allowed_methods)
+                    return
+
+                read_only = True
+                can_flush = False
+                can_zero = False
+                try:
+                    caps = backend.get_capabilities()
+                    read_only = caps["read_only"]
+                    can_flush = caps["can_flush"]
+                    can_zero = caps["can_zero"]
+                except Exception as e:
+                    logging.warning("OPTIONS: could not query backend capabilities: %r", e)
+                    read_only = bool(cfg.get("read_only"))
+                    if not read_only:
+                        can_flush = True
+                        can_zero = True
+
+                if read_only:
+                    allowed_methods = "GET, OPTIONS"
+                    features = ["extents"]
+                    max_writers = 0
+                else:
+                    allowed_methods = "GET, PUT, PATCH, OPTIONS"
+                    features = ["extents"]
+                    if can_zero:
+                        features.append("zero")
+                    if can_flush:
+                        features.append("flush")
+
+                response = {
+                    "unix_socket": None,
+                    "features": features,
+                    "max_readers": MAX_PARALLEL_READS,
+                    "max_writers": max_writers,
+                }
+                self._send_json(HTTPStatus.OK, response, allowed_methods=allowed_methods)
+            finally:
+                backend.close()
+
+    def do_GET(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        if tail == "extents":
+            with self._registry.request_lifecycle(image_id):
+                query = self._parse_query()
+                context = (query.get("context") or [None])[0]
+                self._handle_get_extents(image_id, cfg, context=context)
+            return
+        if tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        range_header = self.headers.get("Range")
+        with self._registry.request_lifecycle(image_id):
+            self._handle_get_image(image_id, cfg, range_header)
+
+    def do_PUT(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            if self.headers.get("Range") is not None:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST,
+                    "Range header not supported for PUT; use Content-Range or PATCH",
+                )
+                return
+
+            content_length_hdr = self.headers.get("Content-Length")
+            if content_length_hdr is None:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                return
+            try:
+                content_length = int(content_length_hdr)
+            except ValueError:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                return
+            if content_length < 0:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                return
+
+            query = self._parse_query()
+            flush_param = (query.get("flush") or ["n"])[0].lower()
+            flush = flush_param in ("y", "yes", "true", "1")
+
+            content_range_hdr = self.headers.get("Content-Range")
+            if content_range_hdr is not None:
+                backend = create_backend(cfg)
+                try:
+                    if not backend.supports_range_write:
+                        self._send_error_json(
+                            HTTPStatus.BAD_REQUEST,
+                            "Content-Range PUT not supported for file backend; use full PUT",
+                        )
+                        return
+                    self._handle_put_range_with_backend(
+                        image_id,
+                        backend,
+                        content_range_hdr,
+                        content_length,
+                        flush,
+                    )
+                finally:
+                    backend.close()
+                return
+
+            self._handle_put_image(image_id, cfg, content_length, flush)
+
+    def do_POST(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        if tail == "flush":
+            with self._registry.request_lifecycle(image_id):
+                self._handle_post_flush(image_id, cfg)
+            return
+        self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+
+    def do_PATCH(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            backend = create_backend(cfg)
+            try:
+                if not backend.supports_range_write:
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        "range writes and PATCH not supported for file backend; use PUT for full upload",
+                    )
+                    return
+                content_type = self.headers.get("Content-Type", "").split(";")[0].strip().lower()
+                range_header = self.headers.get("Range")
+
+                if range_header is not None and content_type != "application/json":
+                    content_length_hdr = self.headers.get("Content-Length")
+                    if content_length_hdr is None:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                        return
+                    try:
+                        content_length = int(content_length_hdr)
+                    except ValueError:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                        return
+                    if content_length <= 0:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length must be positive")
+                        return
+                    self._handle_patch_range_with_backend(
+                        image_id,
+                        backend,
+                        range_header,
+                        content_length,
+                    )
+                    return
+
+                if content_type != "application/json":
+                    self._send_error_json(
+                        HTTPStatus.UNSUPPORTED_MEDIA_TYPE,
+                        "PATCH requires Content-Type: application/json (for zero/flush) or Range with binary body",
+                    )
+                    return
+
+                content_length_hdr = self.headers.get("Content-Length")
+                if content_length_hdr is None:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                    return
+                try:
+                    content_length = int(content_length_hdr)
+                except ValueError:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                    return
+                if content_length <= 0 or content_length > MAX_PATCH_JSON_SIZE:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                    return
+
+                body = self.rfile.read(content_length)
+                if len(body) != content_length:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "request body truncated")
+                    return
+
+                try:
+                    payload = json.loads(body.decode("utf-8"))
+                except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, f"invalid JSON: {e}")
+                    return
+
+                if not isinstance(payload, dict):
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "body must be a JSON object")
+                    return
+
+                op = payload.get("op")
+                if op == "flush":
+                    self._handle_post_flush_with_backend(image_id, backend)
+                    return
+                if op != "zero":
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        "unsupported op; only \"zero\" and \"flush\" are supported",
+                    )
+                    return
+
+                try:
+                    size = int(payload.get("size"))
+                except (TypeError, ValueError):
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "missing or invalid \"size\"")
+                    return
+                if size <= 0:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "\"size\" must be positive")
+                    return
+
+                offset = payload.get("offset")
+                if offset is None:
+                    offset = 0
+                else:
+                    try:
+                        offset = int(offset)
+                    except (TypeError, ValueError):
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "invalid \"offset\"")
+                        return
+                    if offset < 0:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "\"offset\" must be non-negative")
+                        return
+
+                flush = bool(payload.get("flush", False))
+                self._handle_patch_zero_with_backend(
+                    image_id,
+                    backend,
+                    offset=offset,
+                    size=size,
+                    flush=flush,
+                )
+            finally:
+                backend.close()
+
+    # ------------------------------------------------------------------
+    # Operation handlers
+    # ------------------------------------------------------------------
+
+    def _handle_get_image(
+        self, image_id: str, cfg: Dict[str, Any], range_header: Optional[str]
+    ) -> None:
+        start = now_s()
+        bytes_sent = 0
+        expected_bytes = 0
+        try:
+            logging.debug("GET start image_id=%s range=%s", image_id, range_header or "-")
+            backend = create_backend(cfg)
+            session = None
+            try:
+                session = backend.open_session()
+                size = session.size()
+            except OSError as e:
+                logging.error("GET size error image_id=%s err=%r", image_id, e)
+                self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "failed to access image")
+                if session is not None:
+                    session.close()
+                backend.close()
+                return
+
+            try:
+                start_off = 0
+                end_off_incl = size - 1 if size > 0 else -1
+                status = HTTPStatus.OK
+                content_length = size
+                if range_header is not None:
+                    try:
+                        start_off, end_off_incl = self._parse_single_range(range_header, size)
+                    except ValueError as e:
+                        if "unsatisfiable" in str(e):
+                            self._send_range_not_satisfiable(size)
+                            return
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "invalid Range header")
+                        return
+                    status = HTTPStatus.PARTIAL_CONTENT
+                    content_length = (end_off_incl - start_off) + 1
+                expected_bytes = content_length
+
+                self.send_response(status)
+                self._send_imageio_headers()
+                self.send_header("Content-Type", "application/octet-stream")
+                self.send_header("Content-Length", str(content_length))
+                if status == HTTPStatus.PARTIAL_CONTENT:
+                    self.send_header("Content-Range", f"bytes {start_off}-{end_off_incl}/{size}")
+                self.end_headers()
+
+                offset = start_off
+                end_excl = end_off_incl + 1
+                while offset < end_excl:
+                    to_read = min(CHUNK_SIZE, end_excl - offset)
+                    data = session.read(offset, to_read)
+                    if not data:
+                        logging.error(
+                            "GET short read image_id=%s expected_bytes=%d sent_bytes=%d offset=%d",
+                            image_id,
+                            expected_bytes,
+                            bytes_sent,
+                            offset,
+                        )
+                        self.close_connection = True
+                        break
+                    try:
+                        self.wfile.write(data)
+                    except BrokenPipeError:
+                        logging.error(
+                            "GET client disconnected image_id=%s at=%d expected_bytes=%d sent_bytes=%d",
+                            image_id,
+                            offset,
+                            expected_bytes,
+                            bytes_sent,
+                        )
+                        self.close_connection = True
+                        break
+                    offset += len(data)
+                    bytes_sent += len(data)
+            finally:
+                session.close()
+                backend.close()
+        except Exception as e:
+            logging.error("GET error image_id=%s err=%r", image_id, e)
+            try:
+                if not self.wfile.closed:
+                    self.close_connection = True
+            except Exception:
+                pass
+        finally:
+            if expected_bytes > 0 and bytes_sent < expected_bytes:
+                logging.error(
+                    "GET incomplete image_id=%s expected_bytes=%d sent_bytes=%d",
+                    image_id,
+                    expected_bytes,
+                    bytes_sent,
+                )
+            dur = now_s() - start
+            logging.debug(
+                "GET end image_id=%s bytes=%d duration_s=%.3f", image_id, bytes_sent, dur
+            )
+
+    def _handle_put_image(
+        self, image_id: str, cfg: Dict[str, Any], content_length: int, flush: bool
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug("PUT start image_id=%s content_length=%d", image_id, content_length)
+            backend = create_backend(cfg)
+            try:
+                bytes_written = backend.write_full(self.rfile, content_length, flush)
+                self._send_json(
+                    HTTPStatus.OK,
+                    {"ok": True, "bytes_written": bytes_written, "flushed": flush},
+                )
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+            finally:
+                backend.close()
+        except Exception as e:
+            logging.error("PUT error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PUT end image_id=%s bytes=%d duration_s=%.3f", image_id, bytes_written, dur
+            )
+
+    def _handle_put_range(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        content_range: str,
+        content_length: int,
+        flush: bool,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_put_range_with_backend(
+                image_id,
+                backend,
+                content_range,
+                content_length,
+                flush,
+            )
+        finally:
+            backend.close()
+
+    def _handle_put_range_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        content_range: str,
+        content_length: int,
+        flush: bool,
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug(
+                "PUT range start image_id=%s Content-Range=%s content_length=%d flush=%s",
+                image_id, content_range, content_length, flush,
+            )
+            try:
+                start_off, _end_inclusive = self._parse_content_range(content_range)
+            except ValueError as e:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST, f"invalid Content-Range header: {e}"
+                )
+                return
+
+            try:
+                bytes_written = backend.write_range(self.rfile, start_off, content_length)
+                if flush:
+                    backend.flush()
+                self._send_json(
+                    HTTPStatus.OK,
+                    {"ok": True, "bytes_written": bytes_written, "flushed": flush},
+                )
+            except ValueError:
+                image_size = backend.size()
+                self._send_range_not_satisfiable(image_size)
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PUT range error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PUT range end image_id=%s bytes=%d duration_s=%.3f flush=%s",
+                image_id, bytes_written, dur, flush,
+            )
+
+    def _handle_get_extents(
+        self, image_id: str, cfg: Dict[str, Any], context: Optional[str] = None
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_get_extents_with_backend(image_id, backend, context=context)
+        finally:
+            backend.close()
+
+    def _handle_get_extents_with_backend(
+        self, image_id: str, backend: NbdBackend, context: Optional[str] = None
+    ) -> None:
+        start = now_s()
+        try:
+            logging.info("EXTENTS start image_id=%s context=%s", image_id, context)
+            if not backend.supports_extents:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST, "extents not supported for file backend"
+                )
+                return
+            if context == "dirty":
+                export_bitmap = backend.export_bitmap
+                if not export_bitmap:
+                    allocation = backend.get_allocation_extents()
+                    extents: List[Dict[str, Any]] = [
+                        {"start": e["start"], "length": e["length"], "dirty": True, "zero": e["zero"]}
+                        for e in allocation
+                    ]
+                else:
+                    dirty_bitmap_ctx = f"qemu:dirty-bitmap:{export_bitmap}"
+                    extents = backend.get_dirty_extents(dirty_bitmap_ctx)
+                    if is_fallback_dirty_response(extents):
+                        allocation = backend.get_allocation_extents()
+                        extents = [
+                            {
+                                "start": e["start"],
+                                "length": e["length"],
+                                "dirty": True,
+                                "zero": e["zero"],
+                            }
+                            for e in allocation
+                        ]
+            else:
+                extents = backend.get_allocation_extents()
+            self._send_json(HTTPStatus.OK, extents)
+        except Exception as e:
+            logging.error("EXTENTS error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.info("EXTENTS end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_post_flush(self, image_id: str, cfg: Dict[str, Any]) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_post_flush_with_backend(image_id, backend)
+        finally:
+            backend.close()
+
+    def _handle_post_flush_with_backend(self, image_id: str, backend: NbdBackend) -> None:
+        start = now_s()
+        try:
+            logging.info("FLUSH start image_id=%s", image_id)
+            backend.flush()
+            self._send_json(HTTPStatus.OK, {"ok": True})
+        except Exception as e:
+            logging.error("FLUSH error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.info("FLUSH end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_patch_zero(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        offset: int,
+        size: int,
+        flush: bool,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_patch_zero_with_backend(image_id, backend, offset, size, flush)
+        finally:
+            backend.close()
+
+    def _handle_patch_zero_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        offset: int,
+        size: int,
+        flush: bool,
+    ) -> None:
+        start = now_s()
+        try:
+            logging.debug(
+                "PATCH zero start image_id=%s offset=%d size=%d flush=%s",
+                image_id, offset, size, flush,
+            )
+            backend.zero(offset, size)
+            if flush:
+                backend.flush()
+            self._send_json(HTTPStatus.OK, {"ok": True})
+        except ValueError as e:
+            self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PATCH zero error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug("PATCH zero end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_patch_range(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        range_header: str,
+        content_length: int,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_patch_range_with_backend(
+                image_id,
+                backend,
+                range_header,
+                content_length,
+            )
+        finally:
+            backend.close()
+
+    def _handle_patch_range_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        range_header: str,
+        content_length: int,
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug(
+                "PATCH range start image_id=%s range=%s content_length=%d",
+                image_id, range_header, content_length,
+            )
+            try:
+                image_size = backend.size()
+                try:
+                    start_off, end_inclusive = self._parse_single_range(
+                        range_header, image_size
+                    )
+                except ValueError as e:
+                    if "unsatisfiable" in str(e).lower():
+                        self._send_range_not_satisfiable(image_size)
+                    else:
+                        self._send_error_json(
+                            HTTPStatus.BAD_REQUEST, f"invalid Range header: {e}"
+                        )
+                    return
+                expected_len = end_inclusive - start_off + 1
+                if content_length != expected_len:
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        f"Content-Length ({content_length}) must equal range length ({expected_len})",
+                    )
+                    return
+                nbd_backend: NbdBackend = backend  # type: ignore[assignment]
+                bytes_written = nbd_backend.write_range(self.rfile, start_off, content_length)
+                self._send_json(HTTPStatus.OK, {"ok": True, "bytes_written": bytes_written})
+            except ValueError:
+                image_size = backend.size()
+                self._send_range_not_satisfiable(image_size)
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PATCH range error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PATCH range end image_id=%s bytes=%d duration_s=%.3f",
+                image_id, bytes_written, dur,
+            )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/server.py b/scripts/vm/hypervisor/kvm/imageserver/server.py
new file mode 100644
index 000000000000..d842c263bb7f
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/server.py
@@ -0,0 +1,222 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import argparse
+import json
+import logging
+import os
+import socket
+import ssl
+import threading
+import time
+from http.server import HTTPServer
+from socketserver import ThreadingMixIn
+from typing import Type
+
+try:
+    from http.server import ThreadingHTTPServer
+except ImportError:
+    class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):  # type: ignore[no-redef]
+        pass
+
+from .config import TransferRegistry, validate_transfer_config
+from .constants import (
+    CONTROL_RECV_BUFFER,
+    CONTROL_SOCKET,
+    CONTROL_SOCKET_BACKLOG,
+    CONTROL_SOCKET_PERMISSIONS,
+    DEFAULT_HTTP_PORT,
+    DEFAULT_LISTEN_ADDRESS,
+    LOGGING_LEVEL
+)
+from .handler import Handler
+
+
+def make_handler(
+    registry: TransferRegistry,
+) -> Type[Handler]:
+    """
+    Create a Handler subclass with injected dependencies.
+
+    BaseHTTPRequestHandler is instantiated per-request by the server, so we
+    cannot pass constructor args. Instead, we set class-level attributes.
+    """
+
+    class ConfiguredHandler(Handler):
+        _registry = registry
+
+    return ConfiguredHandler
+
+
+def _handle_control_conn(conn: socket.socket, registry: TransferRegistry) -> None:
+    """Handle a single control-socket connection (one JSON request/response)."""
+    try:
+        data = b""
+        while True:
+            chunk = conn.recv(CONTROL_RECV_BUFFER)
+            if not chunk:
+                break
+            data += chunk
+            if b"\n" in data:
+                break
+
+        msg = json.loads(data.strip())
+        action = msg.get("action")
+
+        if action == "register":
+            transfer_id = msg.get("transfer_id")
+            raw_config = msg.get("config")
+            if not transfer_id or not isinstance(raw_config, dict):
+                resp = {"status": "error", "message": "missing transfer_id or config"}
+            else:
+                try:
+                    config = validate_transfer_config(raw_config)
+                except ValueError as e:
+                    resp = {"status": "error", "message": str(e)}
+                else:
+                    if registry.register(transfer_id, config):
+                        resp = {"status": "ok", "active_transfers": registry.active_count()}
+                    else:
+                        resp = {"status": "error", "message": "invalid transfer_id"}
+        elif action == "unregister":
+            transfer_id = msg.get("transfer_id")
+            if not transfer_id:
+                resp = {"status": "error", "message": "missing transfer_id"}
+            else:
+                remaining = registry.unregister(transfer_id)
+                resp = {"status": "ok", "active_transfers": remaining}
+        elif action == "status":
+            resp = {"status": "ok", "active_transfers": registry.active_count()}
+        else:
+            resp = {"status": "error", "message": f"unknown action: {action}"}
+
+        conn.sendall((json.dumps(resp) + "\n").encode("utf-8"))
+    except Exception as e:
+        logging.error("control socket error: %r", e)
+        try:
+            conn.sendall((json.dumps({"status": "error", "message": str(e)}) + "\n").encode("utf-8"))
+        except Exception:
+            pass
+    finally:
+        conn.close()
+
+
+def _idle_sweep_loop(registry: TransferRegistry, interval_s: float = 10.0) -> None:
+    while True:
+        time.sleep(interval_s)
+        try:
+            registry.sweep_expired_transfers()
+        except Exception:
+            logging.exception("idle sweep error")
+
+
+def _control_listener(registry: TransferRegistry, sock_path: str) -> None:
+    """Accept loop for the Unix domain control socket (runs in a daemon thread)."""
+    if os.path.exists(sock_path):
+        os.unlink(sock_path)
+    os.makedirs(os.path.dirname(sock_path), exist_ok=True)
+
+    srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    srv.bind(sock_path)
+    os.chmod(sock_path, CONTROL_SOCKET_PERMISSIONS)
+    srv.listen(CONTROL_SOCKET_BACKLOG)
+    logging.info("control socket listening on %s", sock_path)
+
+    while True:
+        conn, _ = srv.accept()
+        threading.Thread(
+            target=_handle_control_conn,
+            args=(conn, registry),
+            daemon=True,
+        ).start()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="CloudStack image server backed by NBD / local file"
+    )
+    parser.add_argument("--listen", default=DEFAULT_LISTEN_ADDRESS, help="Address to bind")
+    parser.add_argument("--port", type=int, default=DEFAULT_HTTP_PORT, help="Port to listen on")
+    parser.add_argument(
+        "--control-socket",
+        default=CONTROL_SOCKET,
+        help="Path to the Unix domain control socket",
+    )
+    parser.add_argument(
+        "--tls-enabled",
+        action="store_true",
+        help="Enable TLS for the HTTP transfer endpoint",
+    )
+    parser.add_argument(
+        "--tls-cert-file",
+        default=None,
+        help="Path to PEM certificate file used when TLS is enabled",
+    )
+    parser.add_argument(
+        "--tls-key-file",
+        default=None,
+        help="Path to PEM private key file used when TLS is enabled",
+    )
+    args = parser.parse_args()
+
+    if args.tls_enabled and (not args.tls_cert_file or not args.tls_key_file):
+        parser.error("--tls-enabled requires --tls-cert-file and --tls-key-file")
+
+    logging.basicConfig(
+        level=LOGGING_LEVEL,
+        format="%(asctime)s %(levelname)s %(message)s",
+    )
+
+    registry = TransferRegistry()
+    handler_cls = make_handler(registry)
+
+    ctrl_thread = threading.Thread(
+        target=_control_listener,
+        args=(registry, args.control_socket),
+        daemon=True,
+    )
+    ctrl_thread.start()
+
+    sweep_thread = threading.Thread(
+        target=_idle_sweep_loop,
+        args=(registry,),
+        daemon=True,
+    )
+    sweep_thread.start()
+
+    addr = (args.listen, args.port)
+    httpd = ThreadingHTTPServer(addr, handler_cls)
+
+    scheme = "http"
+    if args.tls_enabled:
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+
+        if hasattr(ssl, "TLSVersion") and hasattr(context, "minimum_version"):
+            context.minimum_version = ssl.TLSVersion.TLSv1_2
+        else:
+            if hasattr(ssl, "OP_NO_TLSv1"):
+                context.options |= ssl.OP_NO_TLSv1
+            if hasattr(ssl, "OP_NO_TLSv1_1"):
+                context.options |= ssl.OP_NO_TLSv1_1
+
+        context.load_cert_chain(certfile=args.tls_cert_file, keyfile=args.tls_key_file)
+
+        httpd.socket = context.wrap_socket(httpd.socket, server_side=True)
+        scheme = "https"
+
+    logging.info("listening on %s://%s:%d", scheme, args.listen, args.port)
+    httpd.serve_forever()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py
new file mode 100644
index 000000000000..f8d0ff6d0061
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py
@@ -0,0 +1,22 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Run:
+cd to the directory containing the imageserver folder
+python3 -m unittest discover -s imageserver/tests -t . -v
+"""
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py
new file mode 100644
index 000000000000..c8703f8a1082
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py
@@ -0,0 +1,568 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Shared infrastructure for the image-server test suite (stdlib unittest only).
+
+Provides:
+- A singleton image server process started once for the entire test run.
+- Server stdout/stderr appended to ``<tmp>/imageserver.log``.
+- On shutdown: stop the child process, close the log handle, unlink the control socket;
+  the temp directory and ``imageserver.log`` are left on disk.
+- Control-socket helpers using pure-Python AF_UNIX.
+- qemu-nbd server management.
+- Transfer registration / teardown helpers.
+- HTTP helper functions.
+"""
+
+import atexit
+import functools
+import json
+import logging
+import os
+import random
+import signal
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import uuid
+from pathlib import Path
+from typing import Any, Dict, Optional, TextIO
+
+IMAGE_SIZE = 1 * 1024 * 1024  # 1 MiB
+SERVER_STARTUP_TIMEOUT = 10
+QEMU_NBD_STARTUP_TIMEOUT = 5
+HTTP_TIMEOUT = 30  # seconds per HTTP request
+
+logging.basicConfig(
+    level=logging.INFO,
+    stream=sys.stderr,
+    format="%(asctime)s [TEST] %(message)s",
+)
+log = logging.getLogger(__name__)
+
+
+def randbytes(seed, n):
+    """Generate n deterministic pseudo-random bytes (works on Python 3.6+)."""
+    rng = random.Random(seed)
+    return rng.getrandbits(8 * n).to_bytes(n, "big")
+
+
+def test_timeout(seconds):
+    """Decorator that fails a test if it exceeds *seconds* (SIGALRM, Unix only)."""
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            def _alarm(signum, frame):
+                raise TimeoutError(
+                    "{} timed out after {}s".format(func.__qualname__, seconds)
+                )
+            prev = signal.signal(signal.SIGALRM, _alarm)
+            signal.alarm(seconds)
+            try:
+                return func(*args, **kwargs)
+            finally:
+                signal.alarm(0)
+                signal.signal(signal.SIGALRM, prev)
+        return wrapper
+    return decorator
+
+# ── Singleton state shared across all test modules ──────────────────────
+
+_tmp_dir: Optional[str] = None
+_server_proc: Optional[subprocess.Popen] = None
+_server_info: Optional[Dict[str, Any]] = None
+_server_log_fp: Optional[TextIO] = None
+_server_log_path: Optional[str] = None
+_atexit_registered: bool = False
+
+
+def _free_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def control_socket_send(sock_path: str, message: dict, retries: int = 5) -> dict:
+    """Send a JSON message to the control socket and return the parsed response."""
+    payload = (json.dumps(message) + "\n").encode("utf-8")
+    last_err = None
+    for attempt in range(retries):
+        try:
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+                s.settimeout(5)
+                s.connect(sock_path)
+                s.sendall(payload)
+                s.shutdown(socket.SHUT_WR)
+                data = b""
+                while True:
+                    chunk = s.recv(4096)
+                    if not chunk:
+                        break
+                    data += chunk
+            return json.loads(data.strip())
+        except (BlockingIOError, ConnectionRefusedError, OSError) as e:
+            last_err = e
+            time.sleep(0.1 * (attempt + 1))
+    raise last_err
+
+
+def _wait_for_control_socket(sock_path: str, timeout: float = SERVER_STARTUP_TIMEOUT) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            resp = control_socket_send(sock_path, {"action": "status"})
+            if resp.get("status") == "ok":
+                return
+        except (ConnectionRefusedError, FileNotFoundError, OSError):
+            pass
+        time.sleep(0.2)
+    raise RuntimeError(
+        f"Image server control socket at {sock_path} not ready within {timeout}s"
+    )
+
+
+def _wait_for_nbd_socket(sock_path: str, timeout: float = QEMU_NBD_STARTUP_TIMEOUT) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if os.path.exists(sock_path):
+            try:
+                with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+                    s.settimeout(1)
+                    s.connect(sock_path)
+                    return
+            except (ConnectionRefusedError, OSError):
+                pass
+        time.sleep(0.2)
+    raise RuntimeError(
+        f"qemu-nbd socket at {sock_path} not ready within {timeout}s"
+    )
+
+
+def get_tmp_dir() -> str:
+    global _tmp_dir
+    if _tmp_dir is None:
+        _tmp_dir = tempfile.mkdtemp(prefix="imageserver_test_")
+    return _tmp_dir
+
+
+def _read_log_tail(path: str, max_bytes: int = 65536) -> str:
+    """Return up to *max_bytes* of UTF-8 text from the end of *path*."""
+    try:
+        with open(path, "rb") as f:
+            f.seek(0, os.SEEK_END)
+            size = f.tell()
+            f.seek(max(0, size - max_bytes))
+            return f.read().decode("utf-8", errors="replace")
+    except OSError as e:
+        return f"(could not read log: {e})"
+
+
+def get_image_server() -> Dict[str, Any]:
+    """Return the singleton image-server info dict, starting it if needed."""
+    global _server_proc, _server_info, _server_log_fp, _server_log_path, _atexit_registered
+
+    if _server_info is not None:
+        return _server_info
+
+    tmp = get_tmp_dir()
+    port = _free_port()
+    ctrl_sock = os.path.join(tmp, "ctrl.sock")
+    log_path = os.path.join(tmp, "imageserver.log")
+    _server_log_path = log_path
+
+    imageserver_pkg = str(Path(__file__).resolve().parent.parent)
+    parent_dir = str(Path(imageserver_pkg).parent)
+
+    env = os.environ.copy()
+    env["PYTHONPATH"] = parent_dir + os.pathsep + env.get("PYTHONPATH", "")
+
+    _server_log_fp = open(
+        log_path, "a", encoding="utf-8", buffering=1, errors="replace"
+    )
+    try:
+        _server_log_fp.write(
+            "\n========== imageserver test subprocess log ==========\n"
+        )
+        _server_log_fp.flush()
+    except OSError:
+        pass
+
+    proc = subprocess.Popen(
+        [
+            sys.executable, "-m", "imageserver",
+            "--listen", "127.0.0.1",
+            "--port", str(port),
+            "--control-socket", ctrl_sock,
+        ],
+        cwd=parent_dir,
+        env=env,
+        stdout=_server_log_fp,
+        stderr=_server_log_fp,
+    )
+    _server_proc = proc
+
+    try:
+        _wait_for_control_socket(ctrl_sock)
+    except RuntimeError:
+        proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+            proc.wait(timeout=5)
+        try:
+            _server_log_fp.flush()
+        except OSError:
+            pass
+        tail = _read_log_tail(log_path)
+        try:
+            _server_log_fp.close()
+        except OSError:
+            pass
+        _server_log_fp = None
+        _server_proc = None
+        raise RuntimeError(
+            "Image server failed to start.\n"
+            f"Log file: {log_path}\n"
+            f"--- log tail ---\n{tail}"
+        )
+
+    def send(msg: dict) -> dict:
+        return control_socket_send(ctrl_sock, msg)
+
+    _server_info = {
+        "base_url": f"http://127.0.0.1:{port}",
+        "port": port,
+        "ctrl_sock": ctrl_sock,
+        "send": send,
+        "imageserver_log": log_path,
+    }
+    if not _atexit_registered:
+        atexit.register(shutdown_image_server)
+        _atexit_registered = True
+    sys.stdout.write(
+        "\n[IMAGESERVER_TEST] child image server log file: %s\n\n" % log_path
+    )
+    sys.stdout.flush()
+    return _server_info
+
+
+def shutdown_image_server() -> None:
+    global _server_proc, _server_info, _tmp_dir, _server_log_fp, _server_log_path
+    ctrl_sock: Optional[str] = None
+    if _server_info is not None:
+        ctrl_sock = _server_info.get("ctrl_sock")
+
+    if _server_proc is not None:
+        _server_proc.terminate()
+        try:
+            _server_proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            _server_proc.kill()
+            _server_proc.wait(timeout=5)
+        _server_proc = None
+    if _server_log_fp is not None:
+        try:
+            _server_log_fp.flush()
+            _server_log_fp.close()
+        except OSError:
+            pass
+        _server_log_fp = None
+    _server_info = None
+    _server_log_path = None
+
+    if ctrl_sock:
+        try:
+            os.unlink(ctrl_sock)
+        except FileNotFoundError:
+            pass
+
+    # Leave temp dir and imageserver.log on disk for debugging; clear pointer only.
+    _tmp_dir = None
+
+
+# ── qemu-nbd server ────────────────────────────────────────────────────
+
+class QemuNbdServer:
+    """Manages a qemu-nbd process exporting a disk image over a Unix socket."""
+
+    def __init__(
+        self,
+        image_path: str,
+        socket_path: str,
+        image_size: int = IMAGE_SIZE,
+        image_format: str = "raw",
+    ):
+        self.image_path = image_path
+        self.socket_path = socket_path
+        self.image_size = image_size
+        self.image_format = image_format
+        self._proc: Optional[subprocess.Popen] = None
+
+    def start(self) -> None:
+        if not os.path.exists(self.image_path):
+            if self.image_format == "raw":
+                with open(self.image_path, "wb") as f:
+                    f.truncate(self.image_size)
+            else:
+                raise FileNotFoundError(
+                    f"disk image not found for format {self.image_format!r}: {self.image_path}"
+                )
+
+        self._proc = subprocess.Popen(
+            [
+                "qemu-nbd",
+                "--socket", self.socket_path,
+                "--format", self.image_format,
+                "--persistent",
+                "--shared=0",
+                "--cache=none",
+                self.image_path,
+            ],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        _wait_for_nbd_socket(self.socket_path)
+
+    def stop(self) -> None:
+        if self._proc is not None:
+            for pipe in (self._proc.stdout, self._proc.stderr):
+                if pipe:
+                    try:
+                        pipe.close()
+                    except Exception:
+                        pass
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+                self._proc.wait(timeout=5)
+            self._proc = None
+
+
+# ── Factory helpers ─────────────────────────────────────────────────────
+
+def make_tmp_image(data=None, image_size=IMAGE_SIZE) -> str:
+    """Create a temp raw image file in the shared tmp dir; return path."""
+    tmp = get_tmp_dir()
+    path = os.path.join(tmp, f"img_{uuid.uuid4().hex[:8]}.raw")
+    if data is not None:
+        with open(path, "wb") as f:
+            f.write(data)
+    else:
+        with open(path, "wb") as f:
+            f.write(randbytes(42, image_size))
+    return path
+
+
+def make_file_transfer(data=None, image_size=IMAGE_SIZE, idle_timeout_seconds=None):
+    """
+    Create a temp file + register a file-backend transfer.
+    Returns (transfer_id, url, file_path, cleanup_callable).
+
+    If *idle_timeout_seconds* is set, it is sent in the transfer config (for idle expiry tests).
+    """
+    srv = get_image_server()
+    path = make_tmp_image(data=data, image_size=image_size)
+    transfer_id = f"file-{uuid.uuid4().hex[:8]}"
+    cfg = {"backend": "file", "file": path}
+    if idle_timeout_seconds is not None:
+        cfg["idle_timeout_seconds"] = idle_timeout_seconds
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": cfg,
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        try:
+            os.unlink(path)
+        except FileNotFoundError:
+            pass
+
+    return transfer_id, url, path, cleanup
+
+
+def make_nbd_transfer(image_size=IMAGE_SIZE):
+    """
+    Create a qemu-nbd server + register an NBD-backend transfer.
+    Returns (transfer_id, url, QemuNbdServer, cleanup_callable).
+    """
+    srv = get_image_server()
+    tmp = get_tmp_dir()
+    img_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.raw")
+    sock_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.sock")
+
+    server = QemuNbdServer(img_path, sock_path, image_size=image_size)
+    server.start()
+
+    transfer_id = f"nbd-{uuid.uuid4().hex[:8]}"
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": {"backend": "nbd", "socket": sock_path},
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        server.stop()
+        for p in (img_path, sock_path):
+            try:
+                os.unlink(p)
+            except FileNotFoundError:
+                pass
+
+    return transfer_id, url, server, cleanup
+
+
+def make_nbd_transfer_existing_disk(image_path: str, image_format: str = "qcow2"):
+    """
+    Start qemu-nbd for an existing on-disk image (e.g. qcow2) and register a transfer.
+
+    Does not delete *image_path* on cleanup (only the Unix socket under tmp).
+
+    Returns (transfer_id, url, QemuNbdServer, cleanup_callable).
+    """
+    srv = get_image_server()
+    tmp = get_tmp_dir()
+    sock_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.sock")
+
+    server = QemuNbdServer(
+        image_path, sock_path, image_format=image_format
+    )
+    server.start()
+
+    transfer_id = f"nbd-{uuid.uuid4().hex[:8]}"
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": {"backend": "nbd", "socket": sock_path},
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        server.stop()
+        try:
+            os.unlink(sock_path)
+        except FileNotFoundError:
+            pass
+
+    return transfer_id, url, server, cleanup
+
+
+# ── HTTP helpers ────────────────────────────────────────────────────────
+
+import urllib.request
+import urllib.error
+
+
+def http_get(url, headers=None, timeout=HTTP_TIMEOUT):
+    req = urllib.request.Request(url, headers=headers or {})
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_put(url, data, headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {"Content-Length": str(len(data))}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="PUT")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_post(url, data=b"", headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="POST")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_options(url, timeout=HTTP_TIMEOUT):
+    req = urllib.request.Request(url, method="OPTIONS")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_patch(url, data, headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="PATCH")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+# ── Base TestCase with shared setUp/tearDown ────────────────────────────
+
+class ImageServerTestCase(unittest.TestCase):
+    """
+    Base class for image-server tests.
+
+    Ensures the image server is running before any test method.
+    Subclasses that need a file or NBD transfer should set them up
+    in setUp() and tear down in tearDown().
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.server = get_image_server()
+        cls.base_url = cls.server["base_url"]
+
+    def ctrl(self, msg):
+        """Send a control-socket message; wraps server['send'] to avoid descriptor issues."""
+        return self.server["send"](msg)
+
+    def _make_tmp_image(self, data=None):
+        return make_tmp_image(data=data)
+
+    def _register_file_transfer(self, data=None):
+        return make_file_transfer(data=data)
+
+    def _register_nbd_transfer(self):
+        return make_nbd_transfer()
+
+    @staticmethod
+    def dump_server_logs(max_bytes: int = 256 * 1024):
+        """Print a tail of the image-server log file (shared by all tests in the run)."""
+        path = _server_log_path
+        if not path or not os.path.isfile(path):
+            return
+        try:
+            if _server_log_fp is not None:
+                _server_log_fp.flush()
+        except OSError:
+            pass
+        try:
+            data = _read_log_tail(path, max_bytes=max_bytes)
+            if data.strip():
+                sys.stderr.write("\n=== IMAGE SERVER LOG (tail) ===\n")
+                sys.stderr.write(data)
+                if not data.endswith("\n"):
+                    sys.stderr.write("\n")
+                sys.stderr.write("=== END IMAGE SERVER LOG ===\n")
+        except Exception:
+            pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py
new file mode 100644
index 000000000000..509f9fde05a5
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py
@@ -0,0 +1,397 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Multi-operation sequences, parallel reads across multiple transfer objects,
+cross-backend scenarios, and edge cases.
+"""
+
+import json
+import logging
+import unittest
+import urllib.error
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    http_get,
+    http_patch,
+    http_post,
+    http_put,
+    make_file_transfer,
+    make_nbd_transfer,
+    randbytes,
+    shutdown_image_server,
+    test_timeout,
+)
+
+log = logging.getLogger(__name__)
+FUTURES_TIMEOUT = 60  # seconds for as_completed to collect all results
+
+
+def _fetch(url, headers=None):
+    """GET *url* and return the body bytes, properly closing the response."""
+    resp = http_get(url, headers=headers)
+    try:
+        return resp.read()
+    finally:
+        resp.close()
+
+
+class TestParallelReadsFileBackend(ImageServerTestCase):
+    """Multiple concurrent GET requests to multiple file-backed transfers."""
+
+    @test_timeout(120)
+    def test_parallel_reads_single_file_transfer(self):
+        data = randbytes(500, IMAGE_SIZE)
+        tid, url, path, cleanup = make_file_transfer(data=data)
+        try:
+            results = {}
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for i in range(8):
+                    start = i * (IMAGE_SIZE // 8)
+                    end = start + (IMAGE_SIZE // 8) - 1
+                    f = pool.submit(
+                        _fetch, url, headers={"Range": f"bytes={start}-{end}"}
+                    )
+                    futures[f] = (start, end)
+
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    start, end = futures[f]
+                    results[(start, end)] = f.result()
+
+            for (start, end), chunk in sorted(results.items()):
+                self.assertEqual(chunk, data[start:end + 1], f"Mismatch at {start}-{end}")
+        finally:
+            cleanup()
+
+    @test_timeout(120)
+    def test_parallel_reads_multiple_file_transfers(self):
+        """Parallel reads across 4 different file-backed transfer objects."""
+        transfers = []
+        try:
+            for i in range(4):
+                data = randbytes(600 + i, IMAGE_SIZE)
+                tid, url, path, cleanup = make_file_transfer(data=data)
+                transfers.append((tid, url, data, cleanup))
+
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, data)
+
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, expected_data = futures[f]
+                    got = f.result()
+                    self.assertEqual(got, expected_data, f"Transfer {idx} mismatch")
+        finally:
+            for _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestParallelReadsNbdBackend(ImageServerTestCase):
+    """Multiple concurrent GET requests to multiple NBD-backed transfers."""
+
+    @test_timeout(120)
+    def test_parallel_reads_single_nbd_transfer(self):
+        data = randbytes(700, IMAGE_SIZE)
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            log.info("Writing %d bytes to NBD transfer %s", IMAGE_SIZE, tid)
+            http_put(url, data)
+            log.info("NBD write done, starting 8 parallel range reads")
+
+            results = {}
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for i in range(8):
+                    start = i * (IMAGE_SIZE // 8)
+                    end = start + (IMAGE_SIZE // 8) - 1
+                    f = pool.submit(
+                        _fetch, url, headers={"Range": f"bytes={start}-{end}"}
+                    )
+                    futures[f] = (start, end)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    start, end = futures[f]
+                    results[(start, end)] = f.result()
+                    completed += 1
+                    log.info("NBD range read %d/8 done: bytes=%d-%d", completed, start, end)
+
+            for (start, end), chunk in sorted(results.items()):
+                self.assertEqual(chunk, data[start:end + 1], f"Mismatch at {start}-{end}")
+        finally:
+            cleanup()
+
+    @test_timeout(120)
+    def test_parallel_reads_multiple_nbd_transfers(self):
+        """Parallel reads across 4 different NBD-backed transfer objects."""
+        transfers = []
+        try:
+            for i in range(4):
+                data = randbytes(800 + i, IMAGE_SIZE)
+                log.info("Setting up NBD transfer %d", i)
+                tid, url, nbd_server, cleanup = make_nbd_transfer()
+                log.info("Writing data to NBD transfer %d (tid=%s)", i, tid)
+                http_put(url, data)
+                transfers.append((tid, url, data, cleanup))
+                log.info("NBD transfer %d ready", i)
+
+            log.info("Starting parallel reads across %d NBD transfers", len(transfers))
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, data)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, expected_data = futures[f]
+                    got = f.result()
+                    completed += 1
+                    log.info("Read %d/%d done: NBD transfer idx=%d, %d bytes",
+                             completed, len(futures), idx, len(got))
+                    self.assertEqual(got, expected_data, f"NBD transfer {idx} mismatch")
+        finally:
+            for _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestParallelReadsMixedBackends(ImageServerTestCase):
+    """Parallel reads across a mix of file and NBD transfers simultaneously."""
+
+    @test_timeout(120)
+    def test_parallel_reads_file_and_nbd_mixed(self):
+        transfers = []
+        try:
+            for i in range(2):
+                log.info("Setting up file transfer %d", i)
+                data = randbytes(900 + i, IMAGE_SIZE)
+                tid, url, path, cleanup = make_file_transfer(data=data)
+                transfers.append(("file", tid, url, data, cleanup))
+                log.info("File transfer %d ready: tid=%s", i, tid)
+
+            for i in range(2):
+                log.info("Setting up NBD transfer %d", i)
+                data = randbytes(950 + i, IMAGE_SIZE)
+                tid, url, nbd_server, cleanup = make_nbd_transfer()
+                log.info("NBD transfer %d registered: tid=%s, writing data...", i, tid)
+                http_put(url, data)
+                transfers.append(("nbd", tid, url, data, cleanup))
+                log.info("NBD transfer %d ready", i)
+
+            log.info("Starting parallel reads across %d transfers (2 file + 2 nbd)",
+                     len(transfers))
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (backend_type, tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, backend_type, data)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, backend_type, expected = futures[f]
+                    got = f.result()
+                    completed += 1
+                    log.info("Read %d/%d done: %s transfer idx=%d, %d bytes",
+                             completed, len(futures), backend_type, idx, len(got))
+                    self.assertEqual(got, expected, f"{backend_type} transfer {idx} mismatch")
+
+            log.info("All parallel mixed reads completed successfully")
+        except TimeoutError:
+            log.error("TIMEOUT in mixed parallel reads — dumping server logs")
+            self.dump_server_logs()
+            raise
+        finally:
+            for _, _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestWriteThenReadNbd(ImageServerTestCase):
+    """Multi-step write sequences on NBD backend."""
+
+    def setUp(self):
+        self._tid, self._url, self._nbd, self._cleanup = make_nbd_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+    def test_partial_writes_then_full_read(self):
+        http_put(self._url, b"\x00" * IMAGE_SIZE)
+
+        chunk_size = IMAGE_SIZE // 4
+        for i in range(4):
+            offset = i * chunk_size
+            end = offset + chunk_size - 1
+            data = bytes([i & 0xFF]) * chunk_size
+            http_patch(self._url, data, headers={
+                "Range": f"bytes={offset}-{end}",
+                "Content-Type": "application/octet-stream",
+                "Content-Length": str(chunk_size),
+            })
+
+        resp = http_get(self._url)
+        full = resp.read()
+        for i in range(4):
+            offset = i * chunk_size
+            self.assertEqual(full[offset:offset + chunk_size], bytes([i & 0xFF]) * chunk_size)
+
+    def test_zero_then_extents(self):
+        http_put(self._url, randbytes(1000, IMAGE_SIZE))
+
+        payload = json.dumps({"op": "zero", "size": IMAGE_SIZE // 2, "offset": 0}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+    def test_write_flush_read(self):
+        data = randbytes(1001, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["flushed"])
+
+        resp2 = http_get(self._url)
+        self.assertEqual(resp2.read(), data)
+
+
+class TestWriteThenReadFile(ImageServerTestCase):
+    def setUp(self):
+        self._tid, self._url, self._path, self._cleanup = make_file_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+    def test_put_then_get_roundtrip(self):
+        data = randbytes(1100, IMAGE_SIZE)
+        http_put(self._url, data)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), data)
+
+
+class TestRegisterUseUnregisterUse(ImageServerTestCase):
+    def test_unregistered_transfer_returns_404(self):
+        data = randbytes(1200, IMAGE_SIZE)
+        tid, url, path, cleanup = make_file_transfer(data=data)
+
+        resp = http_get(url)
+        self.assertEqual(resp.read(), data)
+
+        cleanup()
+
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(url)
+        self.assertEqual(ctx.exception.code, 404)
+
+
+class TestMultipleTransfersSimultaneous(ImageServerTestCase):
+    @test_timeout(120)
+    def test_operate_on_file_and_nbd_concurrently(self):
+        file_data = randbytes(1300, IMAGE_SIZE)
+        nbd_data = randbytes(1301, IMAGE_SIZE)
+
+        ftid, furl, fpath, fcleanup = make_file_transfer(data=file_data)
+        ntid, nurl, nbd_server, ncleanup = make_nbd_transfer()
+
+        try:
+            log.info("Writing data to NBD transfer %s", ntid)
+            http_put(nurl, nbd_data)
+
+            log.info("Starting concurrent file + NBD reads")
+            with ThreadPoolExecutor(max_workers=4) as pool:
+                f_file = pool.submit(_fetch, furl)
+                f_nbd = pool.submit(_fetch, nurl)
+
+                self.assertEqual(f_file.result(timeout=FUTURES_TIMEOUT), file_data)
+                self.assertEqual(f_nbd.result(timeout=FUTURES_TIMEOUT), nbd_data)
+            log.info("Concurrent reads completed successfully")
+        finally:
+            fcleanup()
+            ncleanup()
+
+
+class TestLargeChunkedTransfer(ImageServerTestCase):
+    def test_put_larger_than_chunk_size_file(self):
+        """Upload data that spans multiple CHUNK_SIZE boundaries."""
+        tid, url, path, cleanup = make_file_transfer()
+        try:
+            data = randbytes(1400, IMAGE_SIZE)
+            http_put(url, data)
+            resp = http_get(url)
+            self.assertEqual(resp.read(), data)
+        finally:
+            cleanup()
+
+    def test_nbd_put_larger_than_chunk_size(self):
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            data = randbytes(1401, IMAGE_SIZE)
+            http_put(url, data)
+            resp = http_get(url)
+            self.assertEqual(resp.read(), data)
+        finally:
+            cleanup()
+
+
+class TestEdgeCases(ImageServerTestCase):
+    def test_get_not_found_path(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self.base_url}/not/images/path")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_post_unknown_tail(self):
+        tid, url, path, cleanup = make_file_transfer()
+        try:
+            with self.assertRaises(urllib.error.HTTPError) as ctx:
+                http_post(f"{url}/unknown")
+            self.assertEqual(ctx.exception.code, 404)
+        finally:
+            cleanup()
+
+    def test_get_extents_then_flush_nbd(self):
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            http_put(url, randbytes(1500, IMAGE_SIZE))
+
+            resp = http_get(f"{url}/extents")
+            self.assertEqual(resp.status, 200)
+            resp.read()
+
+            resp2 = http_post(f"{url}/flush")
+            body = json.loads(resp2.read())
+            self.assertTrue(body["ok"])
+        finally:
+            cleanup()
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py
new file mode 100644
index 000000000000..187592ff1070
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py
@@ -0,0 +1,258 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for the Unix domain control socket protocol (register / unregister / status)."""
+
+import json
+import socket
+import unittest
+import uuid
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from .test_base import ImageServerTestCase, make_tmp_image, shutdown_image_server, test_timeout
+
+
+class TestStatus(ImageServerTestCase):
+    def test_status_returns_ok(self):
+        resp = self.ctrl({"action": "status"})
+        self.assertEqual(resp["status"], "ok")
+        self.assertIn("active_transfers", resp)
+
+    def test_status_count_is_integer(self):
+        resp = self.ctrl({"action": "status"})
+        self.assertIsInstance(resp["active_transfers"], int)
+        self.assertGreaterEqual(resp["active_transfers"], 0)
+
+
+class TestRegister(ImageServerTestCase):
+    def test_register_file_backend(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            resp = self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            self.assertEqual(resp["status"], "ok")
+            self.assertGreaterEqual(resp["active_transfers"], 1)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_nbd_backend(self):
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            resp = self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "nbd", "socket": "/tmp/fake.sock"},
+            })
+            self.assertEqual(resp["status"], "ok")
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_increments_active_count(self):
+        img = make_tmp_image()
+        before = self.ctrl({"action": "status"})["active_transfers"]
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            after = self.ctrl({"action": "status"})["active_transfers"]
+            self.assertEqual(after, before + 1)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_missing_transfer_id(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_empty_transfer_id(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_missing_config(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_invalid_backend(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "invalid"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_file_missing_path(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "file"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_nbd_missing_socket(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "nbd"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_path_traversal_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "../etc/passwd",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_dot_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": ".",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_slash_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "a/b",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_duplicate_replaces(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            count_before = self.ctrl({"action": "status"})["active_transfers"]
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            count_after = self.ctrl({"action": "status"})["active_transfers"]
+            self.assertEqual(count_after, count_before)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+
+class TestUnregister(ImageServerTestCase):
+    def test_unregister_existing(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        self.ctrl({
+            "action": "register",
+            "transfer_id": tid,
+            "config": {"backend": "file", "file": img},
+        })
+        before = self.ctrl({"action": "status"})["active_transfers"]
+        resp = self.ctrl({"action": "unregister", "transfer_id": tid})
+        self.assertEqual(resp["status"], "ok")
+        self.assertEqual(resp["active_transfers"], before - 1)
+
+    def test_unregister_nonexistent(self):
+        resp = self.ctrl({"action": "unregister", "transfer_id": "does-not-exist"})
+        self.assertEqual(resp["status"], "ok")
+
+    def test_unregister_missing_id(self):
+        resp = self.ctrl({"action": "unregister"})
+        self.assertEqual(resp["status"], "error")
+
+
+class TestUnknownAction(ImageServerTestCase):
+    def test_unknown_action(self):
+        resp = self.ctrl({"action": "foobar"})
+        self.assertEqual(resp["status"], "error")
+        self.assertIn("unknown", resp.get("message", "").lower())
+
+
+class TestMalformed(ImageServerTestCase):
+    def test_malformed_json(self):
+        sock_path = self.server["ctrl_sock"]
+        payload = b"not valid json\n"
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+            s.settimeout(5)
+            s.connect(sock_path)
+            s.sendall(payload)
+            s.shutdown(socket.SHUT_WR)
+            data = b""
+            while True:
+                chunk = s.recv(4096)
+                if not chunk:
+                    break
+                data += chunk
+        resp = json.loads(data.strip())
+        self.assertEqual(resp["status"], "error")
+
+
+class TestConcurrentRegistrations(ImageServerTestCase):
+    @test_timeout(60)
+    def test_concurrent_registers(self):
+        img = make_tmp_image()
+        tids = [f"conc-{uuid.uuid4().hex[:8]}" for _ in range(20)]
+        results = []
+
+        def register_one(tid):
+            return self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+
+        try:
+            with ThreadPoolExecutor(max_workers=10) as pool:
+                futures = {pool.submit(register_one, tid): tid for tid in tids}
+                for f in as_completed(futures, timeout=30):
+                    results.append(f.result())
+
+            self.assertTrue(all(r["status"] == "ok" for r in results))
+        finally:
+            for tid in tids:
+                self.ctrl({"action": "unregister", "transfer_id": tid})
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py
new file mode 100644
index 000000000000..be6eb259cc38
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py
@@ -0,0 +1,230 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for HTTP operations against a file-backend transfer."""
+
+import json
+import os
+import unittest
+import urllib.error
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    http_get,
+    http_options,
+    http_patch,
+    http_post,
+    http_put,
+    make_file_transfer,
+    randbytes,
+    shutdown_image_server,
+)
+
+
+class FileBackendTestCase(ImageServerTestCase):
+    """Base that creates a file-backend transfer per test."""
+
+    def setUp(self):
+        self._tid, self._url, self._path, self._cleanup = make_file_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+
+class TestOptions(FileBackendTestCase):
+    def test_options_returns_features(self):
+        resp = http_options(self._url)
+        self.assertEqual(resp.status, 200)
+        body = json.loads(resp.read())
+        self.assertIn("flush", body["features"])
+        self.assertGreaterEqual(body["max_readers"], 1)
+        self.assertGreaterEqual(body["max_writers"], 1)
+
+    def test_options_allowed_methods(self):
+        resp = http_options(self._url)
+        methods = resp.getheader("Access-Control-Allow-Methods")
+        for m in ("GET", "PUT", "POST", "OPTIONS"):
+            self.assertIn(m, methods)
+
+
+class TestGetFull(FileBackendTestCase):
+    def test_get_full_returns_file_content(self):
+        with open(self._path, "rb") as f:
+            expected = f.read()
+        resp = http_get(self._url)
+        self.assertEqual(resp.status, 200)
+        data = resp.read()
+        self.assertEqual(len(data), len(expected))
+        self.assertEqual(data, expected)
+
+    def test_get_full_content_type(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertIn("application/octet-stream", resp.getheader("Content-Type"))
+
+    def test_get_full_content_length(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertEqual(int(resp.getheader("Content-Length")), os.path.getsize(self._path))
+
+
+class TestGetRange(FileBackendTestCase):
+    def test_get_range_partial(self):
+        with open(self._path, "rb") as f:
+            f.seek(100)
+            expected = f.read(200)
+        resp = http_get(self._url, headers={"Range": "bytes=100-299"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_content_range_header(self):
+        size = os.path.getsize(self._path)
+        resp = http_get(self._url, headers={"Range": "bytes=0-99"})
+        self.assertEqual(resp.status, 206)
+        resp.read()
+        self.assertEqual(resp.getheader("Content-Range"), f"bytes 0-99/{size}")
+
+    def test_get_range_suffix(self):
+        with open(self._path, "rb") as f:
+            expected = f.read()[-100:]
+        resp = http_get(self._url, headers={"Range": "bytes=-100"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_open_ended(self):
+        with open(self._path, "rb") as f:
+            f.seek(IMAGE_SIZE - 50)
+            expected = f.read()
+        resp = http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE - 50}-"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_unsatisfiable(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE + 100}-{IMAGE_SIZE + 200}"})
+        self.assertEqual(ctx.exception.code, 416)
+
+
+class TestPut(FileBackendTestCase):
+    def test_put_full_upload(self):
+        new_data = randbytes(99, IMAGE_SIZE)
+        resp = http_put(self._url, new_data)
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], IMAGE_SIZE)
+
+        with open(self._path, "rb") as f:
+            self.assertEqual(f.read(), new_data)
+
+    def test_put_with_flush(self):
+        new_data = randbytes(100, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", new_data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+    def test_put_verify_by_get(self):
+        new_data = randbytes(101, IMAGE_SIZE)
+        http_put(self._url, new_data)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), new_data)
+
+    def test_put_with_content_range_rejected(self):
+        data = b"x" * 100
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(self._url, data, headers={"Content-Range": "bytes 0-99/*"})
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_put_with_range_header_rejected(self):
+        data = b"x" * 100
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(self._url, data, headers={"Range": "bytes=0-99"})
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestFlush(FileBackendTestCase):
+    def test_post_flush(self):
+        resp = http_post(f"{self._url}/flush")
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestPatchRejected(FileBackendTestCase):
+    def test_patch_rejected_for_file(self):
+        data = json.dumps({"op": "zero", "size": 100}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, data, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(data)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestExtentsRejected(FileBackendTestCase):
+    def test_extents_rejected_for_file(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self._url}/extents")
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestUnknownImage(ImageServerTestCase):
+    def test_get_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self.base_url}/images/nonexistent-id")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_put_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(f"{self.base_url}/images/nonexistent-id", b"data")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_options_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_options(f"{self.base_url}/images/nonexistent-id")
+        self.assertEqual(ctx.exception.code, 404)
+
+
+class TestRoundTrip(FileBackendTestCase):
+    def test_put_then_get_roundtrip(self):
+        payload = randbytes(200, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), payload)
+
+    def test_put_then_ranged_get_roundtrip(self):
+        payload = randbytes(201, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url, headers={"Range": "bytes=512-1023"})
+        self.assertEqual(resp.read(), payload[512:1024])
+
+    def test_multiple_puts_last_wins(self):
+        first = randbytes(300, IMAGE_SIZE)
+        second = randbytes(301, IMAGE_SIZE)
+        http_put(self._url, first)
+        http_put(self._url, second)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), second)
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py
new file mode 100644
index 000000000000..99740fa13323
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Integration tests for HTTP/1.1 connection lifecycle behavior."""
+
+import http.client
+import socket
+import threading
+import time
+
+from .test_base import (
+    HTTP_TIMEOUT,
+    ImageServerTestCase,
+    make_file_transfer,
+    randbytes,
+    test_timeout,
+)
+
+
+def _read_http_headers(sock: socket.socket, timeout: float = HTTP_TIMEOUT) -> bytes:
+    sock.settimeout(timeout)
+    data = b""
+    while b"\r\n\r\n" not in data:
+        chunk = sock.recv(4096)
+        if not chunk:
+            break
+        data += chunk
+    return data
+
+
+class TestHttp11PersistentConnections(ImageServerTestCase):
+    @test_timeout(60)
+    def test_multiple_get_requests_reuse_single_socket(self):
+        data = randbytes(1111, 512 * 1024)
+        transfer_id, _url, _path, cleanup = make_file_transfer(data=data)
+        try:
+            conn = http.client.HTTPConnection("127.0.0.1", self.server["port"], timeout=HTTP_TIMEOUT)
+            try:
+                path = f"/images/{transfer_id}"
+
+                conn.request("GET", path, headers={"Range": "bytes=0-1023"})
+                resp1 = conn.getresponse()
+                body1 = resp1.read()
+                self.assertEqual(resp1.status, 206)
+                self.assertEqual(body1, data[:1024])
+                self.assertIsNotNone(conn.sock)
+                first_local_port = conn.sock.getsockname()[1]
+
+                conn.request("GET", path, headers={"Range": "bytes=1024-2047"})
+                resp2 = conn.getresponse()
+                body2 = resp2.read()
+                self.assertEqual(resp2.status, 206)
+                self.assertEqual(body2, data[1024:2048])
+                self.assertIsNotNone(conn.sock)
+                second_local_port = conn.sock.getsockname()[1]
+
+                conn.request("OPTIONS", path)
+                resp3 = conn.getresponse()
+                _ = resp3.read()
+                self.assertEqual(resp3.status, 200)
+                self.assertIsNotNone(conn.sock)
+                third_local_port = conn.sock.getsockname()[1]
+
+                self.assertEqual(first_local_port, second_local_port)
+                self.assertEqual(second_local_port, third_local_port)
+            finally:
+                conn.close()
+        finally:
+            cleanup()
+
+
+class TestTeardownTiming(ImageServerTestCase):
+    @test_timeout(60)
+    def test_unregister_waits_for_inflight_put(self):
+        transfer_id, _url, _path, cleanup = make_file_transfer(data=b"\x00" * (2 * 1024 * 1024))
+        started = threading.Event()
+        put_done = threading.Event()
+        put_result = {"status_line": "", "error": None}
+        body = randbytes(2222, 1024 * 1024)
+
+        def send_slow_put() -> None:
+            sock = None
+            try:
+                sock = socket.create_connection(("127.0.0.1", self.server["port"]), timeout=HTTP_TIMEOUT)
+                request_headers = (
+                    f"PUT /images/{transfer_id} HTTP/1.1\r\n"
+                    f"Host: 127.0.0.1:{self.server['port']}\r\n"
+                    f"Content-Length: {len(body)}\r\n"
+                    "Connection: close\r\n"
+                    "\r\n"
+                ).encode("ascii")
+                sock.sendall(request_headers)
+
+                sent = 0
+                chunk_size = 16 * 1024
+                while sent < len(body):
+                    end = min(sent + chunk_size, len(body))
+                    sock.sendall(body[sent:end])
+                    sent = end
+                    if sent >= chunk_size and not started.is_set():
+                        started.set()
+                    time.sleep(0.02)
+
+                headers = _read_http_headers(sock)
+                if headers:
+                    put_result["status_line"] = headers.split(b"\r\n", 1)[0].decode("ascii", "replace")
+            except Exception as e:
+                put_result["error"] = repr(e)
+            finally:
+                if sock is not None:
+                    try:
+                        sock.close()
+                    except OSError:
+                        pass
+                put_done.set()
+
+        sender = threading.Thread(target=send_slow_put, daemon=True)
+        sender.start()
+
+        try:
+            self.assertTrue(started.wait(5), "PUT request did not start in time")
+
+            t0 = time.monotonic()
+            unregister_resp = self.ctrl({"action": "unregister", "transfer_id": transfer_id})
+            elapsed = time.monotonic() - t0
+
+            self.assertTrue(put_done.wait(5), "PUT request did not finish in time")
+            self.assertEqual(unregister_resp.get("status"), "ok")
+            self.assertGreater(elapsed, 0.2)
+            self.assertIsNone(put_result["error"], put_result["error"])
+            self.assertIn(" 200 ", put_result["status_line"])
+        finally:
+            sender.join(timeout=1)
+            cleanup()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py
new file mode 100644
index 000000000000..da120ae6bad5
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py
@@ -0,0 +1,706 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for HTTP operations against an NBD-backend transfer (real qemu-nbd)."""
+
+import json
+import os
+import subprocess
+import unittest
+import uuid
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+
+from imageserver.constants import MAX_PARALLEL_READS, MAX_PARALLEL_WRITES
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    get_tmp_dir,
+    http_get,
+    http_options,
+    http_patch,
+    http_post,
+    http_put,
+    make_nbd_transfer,
+    make_nbd_transfer_existing_disk,
+    randbytes,
+    shutdown_image_server,
+)
+
+
+class NbdBackendTestCase(ImageServerTestCase):
+    """Base that creates an NBD-backend transfer per test."""
+
+    def setUp(self):
+        self._tid, self._url, self._nbd, self._cleanup = make_nbd_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+
+class TestOptions(NbdBackendTestCase):
+    def test_options_returns_extents_feature(self):
+        resp = http_options(self._url)
+        self.assertEqual(resp.status, 200)
+        body = json.loads(resp.read())
+        self.assertIn("extents", body["features"])
+
+    def test_options_includes_patch_method(self):
+        resp = http_options(self._url)
+        methods = resp.getheader("Access-Control-Allow-Methods")
+        self.assertIn("PATCH", methods)
+
+    def test_options_has_capabilities(self):
+        resp = http_options(self._url)
+        body = json.loads(resp.read())
+        self.assertGreaterEqual(body["max_readers"], 1)
+        self.assertGreaterEqual(body["max_writers"], 1)
+
+
+class TestGetFull(NbdBackendTestCase):
+    def test_get_full_returns_image_data(self):
+        with open(self._nbd.image_path, "rb") as f:
+            expected = f.read()
+        resp = http_get(self._url)
+        data = resp.read()
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(len(data), len(expected))
+        self.assertEqual(data, expected)
+
+    def test_get_full_content_length(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertEqual(int(resp.getheader("Content-Length")), IMAGE_SIZE)
+
+
+class TestGetRange(NbdBackendTestCase):
+    def test_get_range_partial(self):
+        test_data = randbytes(50, IMAGE_SIZE)
+        http_put(self._url, test_data)
+
+        resp = http_get(self._url, headers={"Range": "bytes=100-299"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), test_data[100:300])
+
+    def test_get_range_content_range_header(self):
+        resp = http_get(self._url, headers={"Range": "bytes=0-99"})
+        self.assertEqual(resp.status, 206)
+        resp.read()
+        self.assertEqual(resp.getheader("Content-Range"), f"bytes 0-99/{IMAGE_SIZE}")
+
+    def test_get_range_suffix(self):
+        test_data = randbytes(51, IMAGE_SIZE)
+        http_put(self._url, test_data)
+
+        resp = http_get(self._url, headers={"Range": "bytes=-100"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), test_data[-100:])
+
+    def test_get_range_unsatisfiable(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE + 100}-{IMAGE_SIZE + 200}"})
+        self.assertEqual(ctx.exception.code, 416)
+
+
+class TestPutFull(NbdBackendTestCase):
+    def test_put_full_upload(self):
+        new_data = randbytes(60, IMAGE_SIZE)
+        resp = http_put(self._url, new_data)
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], IMAGE_SIZE)
+
+        resp2 = http_get(self._url)
+        self.assertEqual(resp2.read(), new_data)
+
+    def test_put_with_flush(self):
+        new_data = randbytes(61, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", new_data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+
+class TestPutRange(NbdBackendTestCase):
+    def test_put_content_range(self):
+        base_data = randbytes(70, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch_data = b"\xAB" * 512
+        resp = http_put(self._url, patch_data, headers={
+            "Content-Range": "bytes 0-511/*",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], 512)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-511"})
+        self.assertEqual(resp2.read(), patch_data)
+
+        resp3 = http_get(self._url, headers={"Range": "bytes=512-1023"})
+        self.assertEqual(resp3.read(), base_data[512:1024])
+
+    def test_put_content_range_with_flush(self):
+        base_data = b"\x00" * IMAGE_SIZE
+        http_put(self._url, base_data)
+
+        patch_data = b"\xFF" * 256
+        resp = http_put(f"{self._url}?flush=y", patch_data, headers={
+            "Content-Range": "bytes 1024-1279/*",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+
+class TestPatchRange(NbdBackendTestCase):
+    def test_patch_binary_range(self):
+        base_data = randbytes(80, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch_data = b"\xCD" * 1024
+        resp = http_patch(self._url, patch_data, headers={
+            "Range": "bytes=2048-3071",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], 1024)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=2048-3071"})
+        self.assertEqual(resp2.read(), patch_data)
+
+    def test_patch_multiple_ranges_preserves_unwritten(self):
+        base_data = randbytes(81, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch1 = b"\x11" * 256
+        http_patch(self._url, patch1, headers={
+            "Range": "bytes=0-255",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": "256",
+        })
+
+        patch2 = b"\x22" * 256
+        http_patch(self._url, patch2, headers={
+            "Range": "bytes=512-767",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": "256",
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=0-767"})
+        got = resp.read()
+        self.assertEqual(got[:256], patch1)
+        self.assertEqual(got[256:512], base_data[256:512])
+        self.assertEqual(got[512:768], patch2)
+
+
+class TestPatchZero(NbdBackendTestCase):
+    def test_patch_zero(self):
+        data = randbytes(90, IMAGE_SIZE)
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 4096, "offset": 0}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-4095"})
+        self.assertEqual(resp2.read(), b"\x00" * 4096)
+
+    def test_patch_zero_with_flush(self):
+        data = b"\xFF" * IMAGE_SIZE
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 512, "offset": 1024, "flush": True}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=1024-1535"})
+        self.assertEqual(resp2.read(), b"\x00" * 512)
+
+    def test_patch_zero_preserves_neighbors(self):
+        data = randbytes(91, IMAGE_SIZE)
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 256, "offset": 512}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=0-1023"})
+        got = resp.read()
+        self.assertEqual(got[:512], data[:512])
+        self.assertEqual(got[512:768], b"\x00" * 256)
+        self.assertEqual(got[768:1024], data[768:1024])
+
+
+class TestPatchFlush(NbdBackendTestCase):
+    def test_patch_flush_op(self):
+        payload = json.dumps({"op": "flush"}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestPostFlush(NbdBackendTestCase):
+    def test_post_flush(self):
+        resp = http_post(f"{self._url}/flush")
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestExtents(NbdBackendTestCase):
+    def test_get_allocation_extents(self):
+        resp = http_get(f"{self._url}/extents")
+        self.assertEqual(resp.status, 200)
+        extents = json.loads(resp.read())
+        self.assertIsInstance(extents, list)
+        self.assertGreaterEqual(len(extents), 1)
+        for ext in extents:
+            self.assertIn("start", ext)
+            self.assertIn("length", ext)
+            self.assertIn("zero", ext)
+
+    def test_extents_cover_full_image(self):
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+    def test_extents_dirty_context_without_bitmap(self):
+        resp = http_get(f"{self._url}/extents?context=dirty")
+        self.assertEqual(resp.status, 200)
+        extents = json.loads(resp.read())
+        self.assertIsInstance(extents, list)
+        self.assertGreaterEqual(len(extents), 1)
+        for ext in extents:
+            self.assertIn("dirty", ext)
+            self.assertTrue(ext["dirty"])
+
+    def test_extents_after_write_and_zero(self):
+        http_put(self._url, randbytes(95, IMAGE_SIZE))
+
+        payload = json.dumps({"op": "zero", "size": 4096, "offset": 0}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        self.assertGreaterEqual(len(extents), 1)
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+
+def _allocated_subranges(extents, granularity):
+    """Split each non-hole extent (zero=False) into [start, end] inclusive byte ranges."""
+    out = []
+    for ext in extents:
+        if ext.get("zero"):
+            continue
+        start = int(ext["start"])
+        length = int(ext["length"])
+        pos = start
+        end_abs = start + length
+        while pos < end_abs:
+            chunk_end = min(pos + granularity, end_abs)
+            out.append((pos, chunk_end - 1))
+            pos = chunk_end
+    return out
+
+
+def _qemu_img_virtual_size(path: str) -> int:
+    """Return virtual size in bytes (requires ``qemu-img`` on PATH)."""
+    # stdout=PIPE + universal_newlines: Python 3.6 compatible (no capture_output/text).
+    cp = subprocess.run(
+        ["qemu-img", "info", "--output=json", path],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        universal_newlines=True,
+        check=True,
+    )
+    return int(json.loads(cp.stdout)["virtual-size"])
+
+
+def _http_error_detail(exc: urllib.error.HTTPError) -> str:
+    """Build a readable message from an ``HTTPError`` (status, url, JSON/text body)."""
+    parts = ["HTTP %s %r" % (exc.code, exc.reason), "url=%r" % getattr(exc, "url", "")]
+    try:
+        if exc.fp is not None:
+            raw = exc.fp.read()
+            if raw:
+                text = raw.decode("utf-8", errors="replace")
+                parts.append("response_body=%r" % (text,))
+    except Exception as read_err:
+        parts.append("read_body_error=%r" % (read_err,))
+    return "; ".join(parts)
+
+
+def _http_get_checked(
+    url,
+    headers=None,
+    expected_status=200,
+    label="GET",
+):
+    """
+    Like ``http_get`` but raises ``AssertionError`` with ``_http_error_detail`` on failure.
+    """
+    try:
+        resp = http_get(url, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    if resp.status != expected_status:
+        body = resp.read()
+        raise AssertionError(
+            "%s %r: expected HTTP %s, got %s; body=%r"
+            % (label, url, expected_status, resp.status, body)
+        )
+    return resp
+
+
+def _http_put_checked(url, data, headers, label="PUT"):
+    try:
+        resp = http_put(url, data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r"
+            % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _http_post_checked(url, data=b"", headers=None, label="POST"):
+    try:
+        resp = http_post(url, data=data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r"
+            % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+class TestQcow2ExtentsParallelReads(ImageServerTestCase):
+    """
+    Optional integration tests: export a user-supplied qcow2 via qemu-nbd, fetch
+    allocation extents, parallel range GETs over allocated regions, and (second
+    test) per-range GET-then-PUT pipeline with ``min(MAX_PARALLEL_READS,
+    MAX_PARALLEL_WRITES)`` workers.
+
+    Requires ``qemu-img`` and ``qemu-nbd`` on PATH.
+
+    Set IMAGESERVER_TEST_QCOW2 to the absolute path of a qcow2 file.
+    Optional: IMAGESERVER_TEST_QCOW2_READ_GRANULARITY — byte step (default 4 MiB).
+    """
+
+    def setUp(self):
+        super().setUp()
+        self._qcow2_path = os.environ.get("IMAGESERVER_TEST_QCOW2", "").strip()
+        if not self._qcow2_path or not os.path.isfile(self._qcow2_path):
+            self.skipTest(
+                "Set IMAGESERVER_TEST_QCOW2 to an existing qcow2 path to run this test"
+            )
+        raw_g = os.environ.get("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY", "").strip()
+        self._read_granularity = int(raw_g) if raw_g else 4 * 1024 * 1024
+        if self._read_granularity <= 0:
+            self.skipTest("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY must be positive")
+
+    def test_parallel_range_reads_allocated_extents(self):
+        _, url, _, cleanup = make_nbd_transfer_existing_disk(
+            self._qcow2_path, "qcow2"
+        )
+        try:
+            resp = _http_get_checked(
+                "%s/extents" % (url,),
+                expected_status=200,
+                label="GET /extents",
+            )
+            extents = json.loads(resp.read())
+            self.assertIsInstance(extents, list)
+            ranges = _allocated_subranges(extents, self._read_granularity)
+            if not ranges:
+                self.skipTest("no allocated extents (all holes/zero) in qcow2")
+
+            def fetch(span):
+                start_b, end_b = span
+                range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                r = _http_get_checked(
+                    url,
+                    headers={"Range": range_hdr},
+                    expected_status=206,
+                    label="Range GET %s" % (range_hdr,),
+                )
+                data = r.read()
+                expected_len = end_b - start_b + 1
+                if len(data) != expected_len:
+                    raise AssertionError(
+                        "Range GET %s: got %d bytes, expected %d (url=%r)"
+                        % (range_hdr, len(data), expected_len, url)
+                    )
+
+            with ThreadPoolExecutor(max_workers=MAX_PARALLEL_READS) as pool:
+                pool.map(fetch, ranges)
+        finally:
+            cleanup()
+
+    def test_parallel_reads_then_put_range_copy_matches_source(self):
+        """
+        Create an empty qcow2 with the same virtual size as the source, copy every
+        allocated range using one worker pool: for each span, Range GET from src
+        then Content-Range PUT to dest.
+        Worker count is ``min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES)`` so each
+        worker holds at most one chunk.
+        """
+        src_path = self._qcow2_path
+        try:
+            vsize = _qemu_img_virtual_size(src_path)
+        except (FileNotFoundError, subprocess.CalledProcessError, KeyError, json.JSONDecodeError, TypeError, ValueError) as e:
+            self.skipTest(f"qemu-img info failed: {e}")
+
+        tmp = get_tmp_dir()
+        dest_path = os.path.join(tmp, f"qcow2_copy_{uuid.uuid4().hex[:8]}.qcow2")
+        try:
+            subprocess.run(
+                ["qemu-img", "create", "-f", "qcow2", dest_path, str(vsize)],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                universal_newlines=True,
+                check=True,
+            )
+        except (FileNotFoundError, subprocess.CalledProcessError) as e:
+            self.skipTest(f"qemu-img create failed: {e}")
+
+        _, src_url, _, cleanup_src = make_nbd_transfer_existing_disk(
+            src_path, "qcow2"
+        )
+        _, dest_url, _, cleanup_dest = make_nbd_transfer_existing_disk(
+            dest_path, "qcow2"
+        )
+        try:
+            resp = _http_get_checked(
+                "%s/extents" % (src_url,),
+                expected_status=200,
+                label="GET src /extents",
+            )
+            extents = json.loads(resp.read())
+            ranges = _allocated_subranges(extents, self._read_granularity)
+            if not ranges:
+                self.skipTest("no allocated extents (all holes/zero) in qcow2")
+
+            transfer_workers = max(
+                1, min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES)
+            )
+
+            def transfer_span(span):
+                start_b, end_b = span
+                range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                r = _http_get_checked(
+                    src_url,
+                    headers={"Range": range_hdr},
+                    expected_status=206,
+                    label="Range GET src %s" % (range_hdr,),
+                )
+                data = r.read()
+                expected_len = end_b - start_b + 1
+                if len(data) != expected_len:
+                    raise AssertionError(
+                        "Range GET src %s: got %d bytes, expected %d (url=%r)"
+                        % (range_hdr, len(data), expected_len, src_url)
+                    )
+                end_inclusive = start_b + len(data) - 1
+                cr = "bytes %s-%s/*" % (start_b, end_inclusive)
+                _put_resp, put_body = _http_put_checked(
+                    dest_url,
+                    data,
+                    headers={
+                        "Content-Range": cr,
+                        "Content-Length": str(len(data)),
+                    },
+                    label="PUT dest %s" % (cr,),
+                )
+                try:
+                    body = json.loads(put_body)
+                except ValueError:
+                    raise AssertionError(
+                        "PUT dest %s: invalid JSON body=%r (url=%r)"
+                        % (cr, put_body, dest_url)
+                    )
+                if not body.get("ok"):
+                    raise AssertionError(
+                        "PUT dest %s: JSON ok=false, full=%r (url=%r)"
+                        % (cr, body, dest_url)
+                    )
+                if body.get("bytes_written") != len(data):
+                    raise AssertionError(
+                        "PUT dest %s: bytes_written=%r expected %d (url=%r)"
+                        % (cr, body.get("bytes_written"), len(data), dest_url)
+                    )
+
+            with ThreadPoolExecutor(max_workers=transfer_workers) as pool:
+                pool.map(transfer_span, ranges)
+
+            _flush, flush_body = _http_post_checked(
+                "%s/flush" % (dest_url,),
+                label="POST dest /flush",
+            )
+            try:
+                flush_json = json.loads(flush_body)
+            except ValueError:
+                raise AssertionError(
+                    "POST dest /flush: invalid JSON body=%r (url=%r)"
+                    % (flush_body, dest_url)
+                )
+            if not flush_json.get("ok"):
+                raise AssertionError(
+                    "POST dest /flush: ok=false, full=%r (url=%r)"
+                    % (flush_json, dest_url)
+                )
+        finally:
+            cleanup_dest()
+            cleanup_src()
+
+        try:
+            cmp = subprocess.run(
+                ["qemu-img", "compare", src_path, dest_path],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                universal_newlines=True,
+            )
+            self.assertEqual(
+                cmp.returncode,
+                0,
+                "qemu-img compare %r vs %r failed (rc=%s): stderr=%r stdout=%r"
+                % (
+                    src_path,
+                    dest_path,
+                    cmp.returncode,
+                    cmp.stderr,
+                    cmp.stdout,
+                ),
+            )
+        finally:
+            try:
+                os.unlink(dest_path)
+            except FileNotFoundError:
+                pass
+
+
+class TestErrorCases(NbdBackendTestCase):
+    def test_patch_unsupported_op(self):
+        payload = json.dumps({"op": "invalid"}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, payload, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(payload)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_patch_zero_missing_size(self):
+        payload = json.dumps({"op": "zero", "offset": 0}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, payload, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(payload)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_put_missing_content_length(self):
+        import http.client
+        from urllib.parse import urlparse
+        parsed = urlparse(self._url)
+        conn = http.client.HTTPConnection(parsed.hostname, parsed.port, timeout=30)
+        try:
+            conn.putrequest("PUT", parsed.path)
+            conn.endheaders()
+            resp = conn.getresponse()
+            self.assertEqual(resp.status, 400)
+        finally:
+            conn.close()
+
+
+class TestRoundTrip(NbdBackendTestCase):
+    def test_write_read_full_roundtrip(self):
+        payload = randbytes(110, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), payload)
+
+    def test_write_read_range_roundtrip(self):
+        payload = randbytes(111, IMAGE_SIZE)
+        http_put(self._url, payload)
+
+        for start, end in [(0, 255), (1024, 2047), (IMAGE_SIZE - 512, IMAGE_SIZE - 1)]:
+            resp = http_get(self._url, headers={"Range": f"bytes={start}-{end}"})
+            self.assertEqual(resp.read(), payload[start:end + 1])
+
+    def test_range_write_read_roundtrip(self):
+        http_put(self._url, b"\x00" * IMAGE_SIZE)
+
+        chunk = randbytes(112, 4096)
+        http_put(self._url, chunk, headers={
+            "Content-Range": "bytes 8192-12287/*",
+            "Content-Length": str(len(chunk)),
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=8192-12287"})
+        self.assertEqual(resp.read(), chunk)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-4095"})
+        self.assertEqual(resp2.read(), b"\x00" * 4096)
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py
new file mode 100644
index 000000000000..3fa592d8953a
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py
@@ -0,0 +1,101 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Unit tests for transfer idle timeout (no image server / nbd dependency)."""
+
+import unittest
+from unittest.mock import patch
+
+from imageserver.config import (
+    TransferRegistry,
+    parse_idle_timeout_seconds,
+    validate_transfer_config,
+)
+from imageserver.constants import DEFAULT_IDLE_TIMEOUT_SECONDS
+
+
+class TestParseIdleTimeout(unittest.TestCase):
+    def test_default_600(self):
+        self.assertEqual(parse_idle_timeout_seconds({}), DEFAULT_IDLE_TIMEOUT_SECONDS)
+
+    def test_explicit(self):
+        self.assertEqual(
+            parse_idle_timeout_seconds({"idle_timeout_seconds": 30}), 30
+        )
+
+    def test_zero_timeout(self):
+        self.assertEqual(
+            parse_idle_timeout_seconds({"idle_timeout_seconds": 0}), 86400
+        )
+
+
+class TestValidateTransferConfig(unittest.TestCase):
+    def test_file_merges_idle(self):
+        c = validate_transfer_config(
+            {"backend": "file", "file": "/tmp/x", "idle_timeout_seconds": 3}
+        )
+        self.assertEqual(c["idle_timeout_seconds"], 3)
+        self.assertEqual(c["backend"], "file")
+
+
+class TestRegistryIdleSweep(unittest.TestCase):
+    def test_sweep_unregisters_after_idle(self):
+        clock = [0.0]
+
+        def mono():
+            return clock[0]
+
+        with patch("imageserver.config.time.monotonic", mono):
+            r = TransferRegistry()
+            r.register(
+                "t1",
+                validate_transfer_config(
+                    {"backend": "file", "file": "/x", "idle_timeout_seconds": 2}
+                ),
+            )
+            clock[0] = 5.0
+            r.sweep_expired_transfers()
+            self.assertIsNone(r.get("t1"))
+
+    def test_inflight_prevents_sweep_until_request_ends(self):
+        clock = [0.0]
+
+        def mono():
+            return clock[0]
+
+        with patch("imageserver.config.time.monotonic", mono):
+            r = TransferRegistry()
+            r.register(
+                "t1",
+                validate_transfer_config(
+                    {"backend": "file", "file": "/x", "idle_timeout_seconds": 2}
+                ),
+            )
+            clock[0] = 1.0
+            ctx = r.request_lifecycle("t1")
+            ctx.__enter__()
+            clock[0] = 100.0
+            r.sweep_expired_transfers()
+            self.assertIsNotNone(r.get("t1"))
+            ctx.__exit__(None, None, None)
+            clock[0] = 103.0
+            r.sweep_expired_transfers()
+            self.assertIsNone(r.get("t1"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py
new file mode 100644
index 000000000000..39b24ebf39f2
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py
@@ -0,0 +1,412 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Stress IO tests
+They run only when IMAGESERVER_STRESS_TEST_QCOW_DIR is set to an existing
+directory containing qcow2 files.
+"""
+
+import json
+import os
+import subprocess
+import time
+import unittest
+import uuid
+import urllib.error
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from imageserver.constants import MAX_PARALLEL_READS, MAX_PARALLEL_WRITES
+
+from .test_base import get_tmp_dir, http_get, http_post, http_put, make_nbd_transfer_existing_disk
+
+
+def _allocated_subranges(extents, granularity):
+    """Split each non-hole extent (zero=False) into [start, end] inclusive byte ranges."""
+    out = []
+    for ext in extents:
+        if ext.get("zero"):
+            continue
+        start = int(ext["start"])
+        length = int(ext["length"])
+        pos = start
+        end_abs = start + length
+        while pos < end_abs:
+            chunk_end = min(pos + granularity, end_abs)
+            out.append((pos, chunk_end - 1))
+            pos = chunk_end
+    return out
+
+
+def _qemu_img_virtual_size(path: str) -> int:
+    """Return virtual size in bytes (requires ``qemu-img`` on PATH)."""
+    cp = subprocess.run(
+        ["qemu-img", "info", "--output=json", path],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        universal_newlines=True,
+        check=True,
+    )
+    return int(json.loads(cp.stdout)["virtual-size"])
+
+
+def _http_error_detail(exc: urllib.error.HTTPError) -> str:
+    parts = ["HTTP %s %r" % (exc.code, exc.reason), "url=%r" % getattr(exc, "url", "")]
+    try:
+        if exc.fp is not None:
+            raw = exc.fp.read()
+            if raw:
+                text = raw.decode("utf-8", errors="replace")
+                parts.append("response_body=%r" % (text,))
+    except Exception as read_err:
+        parts.append("read_body_error=%r" % (read_err,))
+    return "; ".join(parts)
+
+
+def _http_get_checked(url, headers=None, expected_status=200, label="GET"):
+    try:
+        resp = http_get(url, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    if resp.status != expected_status:
+        body = resp.read()
+        raise AssertionError(
+            "%s %r: expected HTTP %s, got %s; body=%r"
+            % (label, url, expected_status, resp.status, body)
+        )
+    return resp
+
+
+def _http_put_checked(url, data, headers, label="PUT"):
+    try:
+        resp = http_put(url, data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r" % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _http_post_checked(url, data=b"", headers=None, label="POST"):
+    try:
+        resp = http_post(url, data=data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r" % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _list_qcow2_files(dir_path: str):
+    entries = []
+    for name in os.listdir(dir_path):
+        p = os.path.join(dir_path, name)
+        if not os.path.isfile(p):
+            continue
+        # Keep this intentionally permissive; qemu-nbd can still reject invalid files.
+        if name.lower().endswith(".qcow2") or name.lower().endswith(".qcow"):
+            entries.append(p)
+    entries.sort()
+    return entries
+
+
+class TestQcow2ExtentsParallelReads(unittest.TestCase):
+    """
+    For each qcow2 in IMAGESERVER_STRESS_TEST_QCOW_DIR,
+    export it via qemu-nbd, fetch allocation extents, and perform parallel range reads
+    over allocated regions. A second test copies allocated extents into a new qcow2
+    and validates via qemu-img compare.
+
+    Env:
+    - IMAGESERVER_STRESS_TEST_QCOW_DIR: directory containing qcow2 files (required)
+    - IMAGESERVER_STRESS_TEST_READ_GRANULARITY: byte step (default 4 MiB)
+      (fallback: IMAGESERVER_TEST_QCOW2_READ_GRANULARITY for compatibility)
+    """
+
+    def setUp(self):
+        super().setUp()
+        self._qcow_dir = os.environ.get("IMAGESERVER_STRESS_TEST_QCOW_DIR", "").strip()
+        if not self._qcow_dir or not os.path.isdir(self._qcow_dir):
+            self.skipTest(
+                "Set IMAGESERVER_STRESS_TEST_QCOW_DIR to an existing directory containing qcow2 files"
+            )
+
+        self._dest_dir = self._qcow_dir.rstrip(os.sep) + ".test"
+        try:
+            os.makedirs(self._dest_dir, exist_ok=True)
+        except OSError as e:
+            self.skipTest("failed to create dest dir %r: %r" % (self._dest_dir, e))
+
+        raw_g = os.environ.get("IMAGESERVER_STRESS_TEST_READ_GRANULARITY", "").strip()
+        if not raw_g:
+            raw_g = os.environ.get("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY", "").strip()
+        self._read_granularity = int(raw_g) if raw_g else 4 * 1024 * 1024
+        if self._read_granularity <= 0:
+            self.skipTest("IMAGESERVER_STRESS_TEST_READ_GRANULARITY must be positive")
+
+        self._qcow2_files = _list_qcow2_files(self._qcow_dir)
+        if not self._qcow2_files:
+            self.skipTest("no qcow2 files found in IMAGESERVER_STRESS_TEST_QCOW_DIR")
+
+        # Avoid pathological oversubscription by default; still runs multiple files concurrently.
+        cpu = os.cpu_count() or 4
+        self._file_workers = max(1, min(len(self._qcow2_files), cpu))
+
+    def test_parallel_range_reads_allocated_extents(self):
+        """
+        For every qcow2 in the directory: GET /extents then do parallel Range GETs across
+        allocated spans. All qcow2 files are processed concurrently.
+        """
+
+        def run_one(path: str):
+            _, url, server, cleanup = make_nbd_transfer_existing_disk(path, "qcow2")
+            try:
+                resp = _http_get_checked(
+                    "%s/extents" % (url,),
+                    expected_status=200,
+                    label="GET /extents",
+                )
+                extents = json.loads(resp.read())
+                ranges = _allocated_subranges(extents, self._read_granularity)
+                if not ranges:
+                    # Not an error; some images can legitimately be all holes.
+                    return {"path": path, "ranges": 0, "skipped": True}
+
+                def fetch(span):
+                    start_b, end_b = span
+                    range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                    r = _http_get_checked(
+                        url,
+                        headers={"Range": range_hdr},
+                        expected_status=206,
+                        label="Range GET %s" % (range_hdr,),
+                    )
+                    data = r.read()
+                    expected_len = end_b - start_b + 1
+                    if len(data) != expected_len:
+                        raise AssertionError(
+                            "Range GET %s: got %d bytes, expected %d (url=%r, file=%r)"
+                            % (range_hdr, len(data), expected_len, url, path)
+                        )
+
+                with ThreadPoolExecutor(max_workers=MAX_PARALLEL_READS) as pool:
+                    list(pool.map(fetch, ranges))
+                return {"path": path, "ranges": len(ranges), "skipped": False}
+            finally:
+                cleanup()
+
+        started = time.perf_counter()
+        results = []
+        failures = []
+        with ThreadPoolExecutor(max_workers=self._file_workers) as pool:
+            futs = {pool.submit(run_one, p): p for p in self._qcow2_files}
+            for fut in as_completed(futs):
+                p = futs[fut]
+                try:
+                    results.append(fut.result())
+                except Exception as e:
+                    failures.append((p, e))
+
+        elapsed = time.perf_counter() - started
+        skipped = sum(1 for r in results if r.get("skipped"))
+        total_ranges = sum(int(r.get("ranges", 0)) for r in results)
+        print(
+            "stress_io: test_parallel_range_reads_allocated_extents: files=%d workers=%d skipped=%d total_ranges=%d elapsed=%.3fs"
+            % (len(self._qcow2_files), self._file_workers, skipped, total_ranges, elapsed)
+        )
+
+        if failures:
+            first_path, first_exc = failures[0]
+            raise AssertionError(
+                "stress_io: %d/%d files failed (first=%r): %r"
+                % (len(failures), len(self._qcow2_files), first_path, first_exc)
+            ) from first_exc
+
+    def test_parallel_reads_then_put_range_copy_matches_source(self):
+        """
+        For every qcow2 in the directory: create an empty qcow2 with same virtual size,
+        then copy every allocated range using a worker pool (Range GET then Content-Range PUT),
+        flush, and validate via qemu-img compare. All qcow2 files are processed concurrently.
+        """
+
+        def run_one(src_path: str):
+            try:
+                vsize = _qemu_img_virtual_size(src_path)
+            except (
+                FileNotFoundError,
+                subprocess.CalledProcessError,
+                KeyError,
+                json.JSONDecodeError,
+                TypeError,
+                ValueError,
+            ) as e:
+                raise AssertionError("qemu-img info failed for %r: %r" % (src_path, e)) from e
+
+            base = os.path.basename(src_path)
+            # Keep dest names unique in case the same basename appears more than once.
+            dest_name = "%s.copy.%s.qcow2" % (base, uuid.uuid4().hex[:8])
+            dest_path = os.path.join(self._dest_dir, dest_name)
+            try:
+                subprocess.run(
+                    ["qemu-img", "create", "-f", "qcow2", dest_path, str(vsize)],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    universal_newlines=True,
+                    check=True,
+                )
+            except (FileNotFoundError, subprocess.CalledProcessError) as e:
+                raise AssertionError("qemu-img create failed for %r: %r" % (dest_path, e)) from e
+
+            _, src_url, _, cleanup_src = make_nbd_transfer_existing_disk(src_path, "qcow2")
+            _, dest_url, _, cleanup_dest = make_nbd_transfer_existing_disk(dest_path, "qcow2")
+            try:
+                resp = _http_get_checked(
+                    "%s/extents" % (src_url,),
+                    expected_status=200,
+                    label="GET src /extents",
+                )
+                extents = json.loads(resp.read())
+                ranges = _allocated_subranges(extents, self._read_granularity)
+                if not ranges:
+                    return {"path": src_path, "ranges": 0, "skipped": True}
+
+                transfer_workers = max(1, min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES))
+
+                def transfer_span(span):
+                    start_b, end_b = span
+                    range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                    r = _http_get_checked(
+                        src_url,
+                        headers={"Range": range_hdr},
+                        expected_status=206,
+                        label="Range GET src %s" % (range_hdr,),
+                    )
+                    data = r.read()
+                    expected_len = end_b - start_b + 1
+                    if len(data) != expected_len:
+                        raise AssertionError(
+                            "Range GET src %s: got %d bytes, expected %d (url=%r, file=%r)"
+                            % (range_hdr, len(data), expected_len, src_url, src_path)
+                        )
+                    end_inclusive = start_b + len(data) - 1
+                    cr = "bytes %s-%s/*" % (start_b, end_inclusive)
+                    _put_resp, put_body = _http_put_checked(
+                        dest_url,
+                        data,
+                        headers={
+                            "Content-Range": cr,
+                            "Content-Length": str(len(data)),
+                        },
+                        label="PUT dest %s" % (cr,),
+                    )
+                    try:
+                        body = json.loads(put_body)
+                    except ValueError:
+                        raise AssertionError(
+                            "PUT dest %s: invalid JSON body=%r (url=%r, file=%r)"
+                            % (cr, put_body, dest_url, src_path)
+                        )
+                    if not body.get("ok"):
+                        raise AssertionError(
+                            "PUT dest %s: JSON ok=false, full=%r (url=%r, file=%r)"
+                            % (cr, body, dest_url, src_path)
+                        )
+                    if body.get("bytes_written") != len(data):
+                        raise AssertionError(
+                            "PUT dest %s: bytes_written=%r expected %d (url=%r, file=%r)"
+                            % (cr, body.get("bytes_written"), len(data), dest_url, src_path)
+                        )
+
+                with ThreadPoolExecutor(max_workers=transfer_workers) as pool:
+                    list(pool.map(transfer_span, ranges))
+
+                _flush, flush_body = _http_post_checked(
+                    "%s/flush" % (dest_url,),
+                    label="POST dest /flush",
+                )
+                try:
+                    flush_json = json.loads(flush_body)
+                except ValueError as e:
+                    raise AssertionError(
+                        "POST dest /flush: invalid JSON body=%r (url=%r, file=%r)"
+                        % (flush_body, dest_url, src_path)
+                    ) from e
+                if not flush_json.get("ok"):
+                    raise AssertionError(
+                        "POST dest /flush: ok=false, full=%r (url=%r, file=%r)"
+                        % (flush_json, dest_url, src_path)
+                    )
+            finally:
+                cleanup_dest()
+                cleanup_src()
+
+            try:
+                cmp = subprocess.run(
+                    ["qemu-img", "compare", src_path, dest_path],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    universal_newlines=True,
+                )
+                if cmp.returncode != 0:
+                    raise AssertionError(
+                        "qemu-img compare %r vs %r failed (rc=%s): stderr=%r stdout=%r"
+                        % (src_path, dest_path, cmp.returncode, cmp.stderr, cmp.stdout)
+                    )
+            finally:
+                try:
+                    os.unlink(dest_path)
+                except FileNotFoundError:
+                    pass
+
+            return {"path": src_path, "ranges": len(ranges), "skipped": False}
+
+        started = time.perf_counter()
+        results = []
+        failures = []
+        with ThreadPoolExecutor(max_workers=self._file_workers) as pool:
+            futs = {pool.submit(run_one, p): p for p in self._qcow2_files}
+            for fut in as_completed(futs):
+                p = futs[fut]
+                try:
+                    results.append(fut.result())
+                except Exception as e:
+                    failures.append((p, e))
+
+        elapsed = time.perf_counter() - started
+        skipped = sum(1 for r in results if r.get("skipped"))
+        total_ranges = sum(int(r.get("ranges", 0)) for r in results)
+        print(
+            "stress_io: test_parallel_reads_then_put_range_copy_matches_source: files=%d workers=%d skipped=%d total_ranges=%d elapsed=%.3fs"
+            % (len(self._qcow2_files), self._file_workers, skipped, total_ranges, elapsed)
+        )
+
+        if failures:
+            first_path, first_exc = failures[0]
+            raise AssertionError(
+                "stress_io: %d/%d files failed (first=%r): %r"
+                % (len(failures), len(self._qcow2_files), first_path, first_exc)
+            ) from first_exc
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py
new file mode 100644
index 000000000000..2730c8ed16ca
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py
@@ -0,0 +1,57 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Integration tests for per-transfer HTTP idle timeout (requires image server deps e.g. nbd)."""
+
+import time
+import urllib.error
+
+from .test_base import (
+    ImageServerTestCase,
+    http_options,
+    make_file_transfer,
+)
+
+
+class TestTransferIdleExpiry(ImageServerTestCase):
+    def test_transfer_expires_after_idle(self):
+        """No HTTP activity after registration: transfer is unregistered after idle_timeout_seconds."""
+        _tid, url, _path, cleanup = make_file_transfer(idle_timeout_seconds=15)
+        try:
+            time.sleep(30)
+            with self.assertRaises(urllib.error.HTTPError) as ctx:
+                http_options(url)
+            self.assertEqual(ctx.exception.code, 404)
+            st = self.ctrl({"action": "status"})
+            self.assertEqual(st.get("status"), "ok")
+        finally:
+            cleanup()
+
+    def test_http_activity_resets_idle_deadline(self):
+        """Completing a request resets the idle timer; transfer stays past a single interval."""
+        _tid, url, _path, cleanup = make_file_transfer(idle_timeout_seconds=15)
+        try:
+            http_options(url)
+            time.sleep(10)
+            http_options(url)
+            time.sleep(10)
+            http_options(url)
+            time.sleep(10)
+            resp = http_options(url)
+            self.assertEqual(resp.status, 200)
+        finally:
+            cleanup()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py
new file mode 100644
index 000000000000..159dff30a929
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py
@@ -0,0 +1,122 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Unit tests for imageserver.util extent coalescing helpers."""
+
+import unittest
+
+from imageserver.util import (
+    coalesce_allocation_extents,
+    coalesce_dirty_zero_extents,
+    merge_dirty_zero_extents,
+)
+
+
+class TestCoalesceAllocationExtents(unittest.TestCase):
+    def test_empty(self):
+        self.assertEqual(coalesce_allocation_extents([]), [])
+
+    def test_single(self):
+        inp = [{"start": 0, "length": 4096, "zero": False}]
+        out = coalesce_allocation_extents(inp)
+        self.assertEqual(out, [{"start": 0, "length": 4096, "zero": False}])
+        self.assertIsNot(out[0], inp[0])
+
+    def test_merges_contiguous_same_zero(self):
+        inp = [
+            {"start": 0, "length": 10, "zero": False},
+            {"start": 10, "length": 5, "zero": False},
+            {"start": 15, "length": 100, "zero": False},
+        ]
+        self.assertEqual(
+            coalesce_allocation_extents(inp),
+            [{"start": 0, "length": 115, "zero": False}],
+        )
+
+    def test_does_not_merge_different_zero(self):
+        inp = [
+            {"start": 0, "length": 64, "zero": False},
+            {"start": 64, "length": 64, "zero": True},
+            {"start": 128, "length": 64, "zero": False},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+    def test_does_not_merge_gap(self):
+        inp = [
+            {"start": 0, "length": 100, "zero": False},
+            {"start": 200, "length": 50, "zero": False},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+    def test_does_not_merge_same_zero_with_gap(self):
+        inp = [
+            {"start": 0, "length": 10, "zero": True},
+            {"start": 20, "length": 10, "zero": True},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+
+class TestCoalesceDirtyZeroExtents(unittest.TestCase):
+    def test_empty(self):
+        self.assertEqual(coalesce_dirty_zero_extents([]), [])
+
+    def test_single(self):
+        inp = [{"start": 0, "length": 8192, "dirty": True, "zero": False}]
+        out = coalesce_dirty_zero_extents(inp)
+        self.assertEqual(
+            out, [{"start": 0, "length": 8192, "dirty": True, "zero": False}]
+        )
+
+    def test_merges_contiguous_same_flags(self):
+        inp = [
+            {"start": 0, "length": 50, "dirty": True, "zero": False},
+            {"start": 50, "length": 50, "dirty": True, "zero": False},
+        ]
+        self.assertEqual(
+            coalesce_dirty_zero_extents(inp),
+            [{"start": 0, "length": 100, "dirty": True, "zero": False}],
+        )
+
+    def test_does_not_merge_differing_dirty(self):
+        inp = [
+            {"start": 0, "length": 32, "dirty": False, "zero": False},
+            {"start": 32, "length": 32, "dirty": True, "zero": False},
+        ]
+        self.assertEqual(coalesce_dirty_zero_extents(inp), inp)
+
+    def test_does_not_merge_differing_zero(self):
+        inp = [
+            {"start": 0, "length": 16, "dirty": False, "zero": False},
+            {"start": 16, "length": 16, "dirty": False, "zero": True},
+        ]
+        self.assertEqual(coalesce_dirty_zero_extents(inp), inp)
+
+
+class TestMergeDirtyZeroExtentsCoalescing(unittest.TestCase):
+    def test_coalesces_adjacent_identical_flags_after_boundary_merge(self):
+        """Boundary grid can split one logical run; coalesce should reunite."""
+        allocation = [(0, 200, False)]
+        dirty = [(0, 100, False), (100, 100, False)]
+        merged = merge_dirty_zero_extents(allocation, dirty, 200)
+        self.assertEqual(
+            merged,
+            [{"start": 0, "length": 200, "dirty": False, "zero": False}],
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/util.py b/scripts/vm/hypervisor/kvm/imageserver/util.py
new file mode 100644
index 000000000000..473f58a50c07
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/util.py
@@ -0,0 +1,125 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import json
+import time
+from typing import Any, Dict, List, Set, Tuple
+
+
+def coalesce_allocation_extents(
+    extents: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Merge contiguous extents that share the same ``zero`` flag."""
+    if not extents:
+        return []
+    out: List[Dict[str, Any]] = [dict(extents[0])]
+    for e in extents[1:]:
+        prev = out[-1]
+        if (
+            prev["start"] + prev["length"] == e["start"]
+            and prev["zero"] == e["zero"]
+        ):
+            prev["length"] += e["length"]
+        else:
+            out.append({"start": e["start"], "length": e["length"], "zero": e["zero"]})
+    return out
+
+
+def coalesce_dirty_zero_extents(
+    extents: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Merge contiguous extents that share the same ``dirty`` and ``zero`` flags."""
+    if not extents:
+        return []
+    out: List[Dict[str, Any]] = [dict(extents[0])]
+    for e in extents[1:]:
+        prev = out[-1]
+        if (
+            prev["start"] + prev["length"] == e["start"]
+            and prev["dirty"] == e["dirty"]
+            and prev["zero"] == e["zero"]
+        ):
+            prev["length"] += e["length"]
+        else:
+            out.append(
+                {
+                    "start": e["start"],
+                    "length": e["length"],
+                    "dirty": e["dirty"],
+                    "zero": e["zero"],
+                }
+            )
+    return out
+
+
+def json_bytes(obj: Any) -> bytes:
+    return json.dumps(obj, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def merge_dirty_zero_extents(
+    allocation_extents: List[Tuple[int, int, bool]],
+    dirty_extents: List[Tuple[int, int, bool]],
+    size: int,
+) -> List[Dict[str, Any]]:
+    """
+    Merge allocation (start, length, zero) and dirty (start, length, dirty) extents
+    into a single list of {start, length, dirty, zero} with unified boundaries.
+    """
+    boundaries: Set[int] = {0, size}
+    for start, length, _ in allocation_extents:
+        boundaries.add(start)
+        boundaries.add(start + length)
+    for start, length, _ in dirty_extents:
+        boundaries.add(start)
+        boundaries.add(start + length)
+    sorted_boundaries = sorted(boundaries)
+
+    def lookup(
+        extents: List[Tuple[int, int, bool]], offset: int, default: bool
+    ) -> bool:
+        for start, length, flag in extents:
+            if start <= offset < start + length:
+                return flag
+        return default
+
+    result: List[Dict[str, Any]] = []
+    for i in range(len(sorted_boundaries) - 1):
+        a, b = sorted_boundaries[i], sorted_boundaries[i + 1]
+        if a >= b:
+            continue
+        result.append(
+            {
+                "start": a,
+                "length": b - a,
+                "dirty": lookup(dirty_extents, a, False),
+                "zero": lookup(allocation_extents, a, False),
+            }
+        )
+    return coalesce_dirty_zero_extents(result)
+
+
+def is_fallback_dirty_response(extents: List[Dict[str, Any]]) -> bool:
+    """True if extents is the single-extent fallback (dirty=false, zero=false)."""
+    return (
+        len(extents) == 1
+        and extents[0].get("dirty") is False
+        and extents[0].get("zero") is False
+    )
+
+
+def now_s() -> float:
+    return time.monotonic()
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
index 58fcc62cdc31..ad5726e0a010 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
@@ -17,11 +17,13 @@
 package com.cloud.agent.manager.allocator.impl;
 
 import com.cloud.agent.manager.allocator.HostAllocator;
+import com.cloud.api.ApiDBUtils;
 import com.cloud.capacity.CapacityManager;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.offering.ServiceOffering;
+import com.cloud.storage.VMTemplateVO;
 import com.cloud.utils.Pair;
 import com.cloud.utils.component.AdapterBase;
 import org.apache.commons.collections.CollectionUtils;
@@ -69,6 +71,29 @@ protected void addHostsBasedOnTagRules(String hostTagOnOffering, List<HostVO> cl
         clusterHosts.addAll(hostsWithTagRules);
     }
 
+    protected void filterHostsBasedOnGuestOsRules(VMTemplateVO vmTemplate, List<? extends Host> clusterHosts) {
+        if (clusterHosts.isEmpty()) {
+            logger.info("Will not filter hosts based on guest OS as there is no available hosts left to verify.");
+            return;
+        }
+
+        String templateGuestOSName = ApiDBUtils.getTemplateGuestOSName(vmTemplate);
+        List<HostVO> incompatibleHosts = hostDao.findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(templateGuestOSName);
+
+        if (incompatibleHosts.isEmpty()) {
+            logger.info("No incompatible hosts found with guest OS rules matching the VM guest OS [{}].", templateGuestOSName);
+            return;
+        }
+
+        logger.info("Found incompatible hosts {} with guest OS rules that did not match the VM guest OS [{}]. They will be removed from the suitable hosts list.",
+                incompatibleHosts, templateGuestOSName);
+        clusterHosts.removeAll(incompatibleHosts);
+
+        if (clusterHosts.isEmpty()) {
+            logger.info("After filtering by guest OS rules, no compatible hosts were found for VM with OS [{}].", templateGuestOSName);
+        }
+    }
+
     /**
      * Adds hosts with enough CPU capability and enough CPU capacity to the suitable hosts list.
      */
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
index 8b4ca318bf78..4bc34d8a5c60 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
@@ -123,7 +123,7 @@ public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan pla
         String hostTagOnTemplate = template.getTemplateTag();
         String paramAsStringToLog = String.format("zone [%s], pod [%s], cluster [%s]", dcId, podId, clusterId);
 
-        List<HostVO> suitableHosts = retrieveHosts(vmProfile, type, (List<HostVO>) hosts, clusterId, podId, dcId, hostTagOnOffering, hostTagOnTemplate);
+        List<HostVO> suitableHosts = retrieveHosts(vmProfile, type, (List<HostVO>) hosts, template, clusterId, podId, dcId, hostTagOnOffering, hostTagOnTemplate);
 
         if (suitableHosts.isEmpty()) {
             logger.info("No suitable host found for VM [{}] in {}.", vmProfile, paramAsStringToLog);
@@ -137,8 +137,8 @@ public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan pla
         return allocateTo(vmProfile, plan, offering, template, avoid, suitableHosts, returnUpTo, considerReservedCapacity, account);
     }
 
-    protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type, List<HostVO> hostsToFilter, Long clusterId, Long podId, long dcId, String hostTagOnOffering,
-                                         String hostTagOnTemplate) {
+    protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type, List<HostVO> hostsToFilter, VMTemplateVO template,
+                                         Long clusterId, Long podId, long dcId, String hostTagOnOffering, String hostTagOnTemplate) {
         String haVmTag = (String) vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
         List<HostVO> clusterHosts;
 
@@ -159,6 +159,7 @@ protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type,
         filterHostsWithUefiEnabled(type, vmProfile, clusterId, podId, dcId, clusterHosts);
 
         addHostsBasedOnTagRules(hostTagOnOffering, clusterHosts);
+        filterHostsBasedOnGuestOsRules(template, clusterHosts);
 
         return clusterHosts;
 
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
index 96b4255b876d..92fdaf7faf0e 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
@@ -42,7 +42,7 @@ public class RandomAllocator extends BaseAllocator {
     private ResourceManager _resourceMgr;
 
     protected List<Host> findSuitableHosts(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-                                         boolean considerReservedCapacity) {
+                                           boolean considerReservedCapacity) {
         if (type == Host.Type.Storage) {
             return null;
         }
@@ -115,6 +115,7 @@ protected List<HostVO> retrieveHosts(Type type, List<HostVO> hosts, VMTemplateVO
         }
 
         addHostsBasedOnTagRules(offeringHostTag, availableHosts);
+        filterHostsBasedOnGuestOsRules(template, availableHosts);
 
         return availableHosts;
     }
diff --git a/server/src/main/java/com/cloud/api/ApiDBUtils.java b/server/src/main/java/com/cloud/api/ApiDBUtils.java
index 1d00e9ec16ba..d8b3c155ae8c 100644
--- a/server/src/main/java/com/cloud/api/ApiDBUtils.java
+++ b/server/src/main/java/com/cloud/api/ApiDBUtils.java
@@ -31,6 +31,7 @@
 import javax.inject.Inject;
 
 import com.cloud.cpu.CPU;
+import com.cloud.storage.GuestOSVO;
 import org.apache.cloudstack.acl.Role;
 import org.apache.cloudstack.acl.RoleService;
 import org.apache.cloudstack.affinity.AffinityGroup;
@@ -2345,4 +2346,15 @@ public static SharedFSJoinVO newSharedFSView(SharedFS sharedFS) {
     public static List<CPU.CPUArch> listZoneClustersArchs(long zoneId) {
         return s_clusterDao.getClustersArchsByZone(zoneId);
     }
+
+    public static String getTemplateGuestOSName(VMTemplateVO template) {
+        long guestOSId = template.getGuestOSId();
+        GuestOSVO guestOS = s_guestOSDao.findById(guestOSId);
+
+        if (guestOS == null) {
+            return null;
+        }
+
+        return guestOS.getDisplayName();
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index a8551b4c6693..8c51d9926841 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -4759,6 +4759,7 @@ public NicSecondaryIpResponse createSecondaryIPToNicResponse(NicSecondaryIp resu
         setResponseIpAddress(result, response);
         response.setNicId(nic.getUuid());
         response.setNwId(network.getUuid());
+        response.setDescription(result.getDescription());
         response.setObjectName("nicsecondaryip");
         return response;
     }
@@ -4845,6 +4846,7 @@ public NicResponse createNicResponse(Nic result) {
                 for (NicSecondaryIpVO ip : secondaryIps) {
                     NicSecondaryIpResponse ipRes = new NicSecondaryIpResponse();
                     ipRes.setId(ip.getUuid());
+                    ipRes.setDescription(ip.getDescription());
                     setResponseIpAddress(ip, ipRes);
                     ipList.add(ipRes);
                 }
diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java
index dc07814c9724..1bda053ec19a 100644
--- a/server/src/main/java/com/cloud/api/ApiServer.java
+++ b/server/src/main/java/com/cloud/api/ApiServer.java
@@ -16,6 +16,10 @@
 // under the License.
 package com.cloud.api;
 
+import static com.cloud.user.AccountManagerImpl.apiKeyAccess;
+import static org.apache.cloudstack.api.ApiConstants.PASSWORD_CHANGE_REQUIRED;
+import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
+
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InterruptedIOException;
@@ -31,6 +35,7 @@
 import java.security.Security;
 import java.text.ParseException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.Date;
 import java.util.EnumSet;
@@ -39,7 +44,6 @@
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
-import java.util.Arrays;
 import java.util.Map;
 import java.util.Set;
 import java.util.TimeZone;
@@ -58,16 +62,6 @@
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import com.cloud.cluster.ManagementServerHostVO;
-import com.cloud.cluster.dao.ManagementServerHostDao;
-import com.cloud.utils.Ternary;
-import com.cloud.user.Account;
-import com.cloud.user.AccountManager;
-import com.cloud.user.AccountManagerImpl;
-import com.cloud.user.DomainManager;
-import com.cloud.user.User;
-import com.cloud.user.UserAccount;
-import com.cloud.user.UserVO;
 import org.apache.cloudstack.acl.APIChecker;
 import org.apache.cloudstack.acl.ApiKeyPairManagerImpl;
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
@@ -161,6 +155,8 @@
 import com.cloud.api.dispatch.DispatchChainFactory;
 import com.cloud.api.dispatch.DispatchTask;
 import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
@@ -179,14 +175,22 @@
 import com.cloud.exception.UnavailableCommandException;
 import com.cloud.projects.dao.ProjectDao;
 import com.cloud.storage.VolumeApiService;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.AccountManagerImpl;
+import com.cloud.user.DomainManager;
+import com.cloud.user.User;
+import com.cloud.user.UserAccount;
+import com.cloud.user.UserVO;
 import com.cloud.utils.ConstantTimeComparator;
 import com.cloud.utils.DateUtil;
 import com.cloud.utils.HttpUtils;
-import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.HttpUtils.ApiSessionKeyCheckOption;
+import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.Pair;
 import com.cloud.utils.ReflectUtil;
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.Ternary;
 import com.cloud.utils.component.ComponentContext;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.component.PluggableService;
@@ -199,10 +203,6 @@
 import com.cloud.utils.net.NetUtils;
 import com.google.gson.reflect.TypeToken;
 
-import static com.cloud.user.AccountManagerImpl.apiKeyAccess;
-import static org.apache.cloudstack.api.ApiConstants.PASSWORD_CHANGE_REQUIRED;
-import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
-
 @Component
 public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiServerService, Configurable {
     private static final Logger ACCESSLOGGER = LogManager.getLogger("apiserver." + ApiServer.class.getName());
@@ -792,85 +792,14 @@ private String queueCommand(final BaseCmd cmdObj, final Map<String, String> para
         // BaseAsyncCreateCmd: cmd params are processed and create() is called, then same workflow as BaseAsyncCmd.
         // BaseAsyncCmd: cmd is processed and submitted as an AsyncJob, job related info is serialized and returned.
         if (cmdObj instanceof BaseAsyncCmd) {
-            if (!asyncMgr.isAsyncJobsEnabled()) {
-                String msg = "Maintenance or Shutdown has been initiated on this management server. Can not accept new jobs";
-                logger.warn(msg);
-                throw new ServerApiException(ApiErrorCode.SERVICE_UNAVAILABLE, msg);
-            }
-            Long objectId = null;
-            String objectUuid;
-            if (cmdObj instanceof BaseAsyncCreateCmd) {
-                final BaseAsyncCreateCmd createCmd = (BaseAsyncCreateCmd)cmdObj;
-                dispatcher.dispatchCreateCmd(createCmd, params);
-                objectId = createCmd.getEntityId();
-                objectUuid = createCmd.getEntityUuid();
-                params.put("id", objectId.toString());
-                Class entityClass = EventTypes.getEntityClassForEvent(createCmd.getEventType());
-                if (entityClass != null)
-                    ctx.putContextParameter(entityClass, objectUuid);
-            } else {
-                // Extract the uuid before params are processed and id reflects internal db id
-                objectUuid = params.get(ApiConstants.ID);
-                dispatchChainFactory.getStandardDispatchChain().dispatch(new DispatchTask(cmdObj, params));
-            }
-
-            final BaseAsyncCmd asyncCmd = (BaseAsyncCmd)cmdObj;
-
-            if (callerUserId != null) {
-                params.put("ctxUserId", callerUserId.toString());
-            }
-            if (caller != null) {
-                params.put("ctxAccountId", String.valueOf(caller.getId()));
-            }
-            if (objectUuid != null) {
-                params.put("uuid", objectUuid);
-            }
-
-            long startEventId = ctx.getStartEventId();
-            asyncCmd.setStartEventId(startEventId);
-
-            // save the scheduled event
-            final Long eventId =
-                    ActionEventUtils.onScheduledActionEvent((callerUserId == null) ? (Long)User.UID_SYSTEM : callerUserId, asyncCmd.getEntityOwnerId(), asyncCmd.getEventType(),
-                            asyncCmd.getEventDescription(), asyncCmd.getApiResourceId(), asyncCmd.getApiResourceType().toString(), asyncCmd.isDisplay(), startEventId);
-            if (startEventId == 0) {
-                // There was no create event before, set current event id as start eventId
-                startEventId = eventId;
-            }
-
-            params.put("ctxStartEventId", String.valueOf(startEventId));
-            params.put("cmdEventType", asyncCmd.getEventType());
-            params.put("ctxDetails", ApiGsonHelper.getBuilder().create().toJson(ctx.getContextParameters()));
-            if (asyncCmd.getHttpMethod() != null) {
-                params.put(ApiConstants.HTTPMETHOD, asyncCmd.getHttpMethod().toString());
-            }
-
-            Long instanceId = (objectId == null) ? asyncCmd.getApiResourceId() : objectId;
-
-            // users can provide the job id they want to use, so log as it is a uuid and is unique
-            String injectedJobId = asyncCmd.getInjectedJobId();
-            uuidMgr.checkUuidSimple(injectedJobId, AsyncJob.class);
-
-            AsyncJobVO job = new AsyncJobVO("", callerUserId, caller.getId(), cmdObj.getClass().getName(),
-                    ApiGsonHelper.getBuilder().create().toJson(params), instanceId,
-                    asyncCmd.getApiResourceType() != null ? asyncCmd.getApiResourceType().toString() : null,
-                            injectedJobId);
-            job.setDispatcher(asyncDispatcher.getName());
-
-            final long jobId = asyncMgr.submitAsyncJob(job);
-
-            if (jobId == 0L) {
-                final String errorMsg = "Unable to schedule async job for command " + job.getCmd();
-                logger.warn(errorMsg);
-                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, errorMsg);
-            }
+            AsyncCmdResult result = processAsyncCmd((BaseAsyncCmd)cmdObj, params, ctx, callerUserId, caller);
             final String response;
-            if (objectId != null) {
-                final String objUuid = (objectUuid == null) ? objectId.toString() : objectUuid;
-                response = getBaseAsyncCreateResponse(jobId, (BaseAsyncCreateCmd)asyncCmd, objUuid);
+            if (result.objectId != null) {
+                final String objUuid = (result.objectUuid == null) ? result.objectId.toString() : result.objectUuid;
+                response = getBaseAsyncCreateResponse(result.jobId, (BaseAsyncCreateCmd) result.asyncCmd, objUuid);
             } else {
                 SerializationContext.current().setUuidTranslation(true);
-                response = getBaseAsyncResponse(jobId, asyncCmd);
+                response = getBaseAsyncResponse(result.jobId, result.asyncCmd);
             }
             // Always log response for async for now, I don't think any sensitive data will be in here.
             // It might be nice to send this through scrubbing similar to how
@@ -900,6 +829,81 @@ private String queueCommand(final BaseCmd cmdObj, final Map<String, String> para
         }
     }
 
+    @Override
+    public AsyncCmdResult processAsyncCmd(BaseAsyncCmd asyncCmd, Map<String, String> params, CallContext ctx, Long callerUserId, Account caller) throws Exception {
+        if (!asyncMgr.isAsyncJobsEnabled()) {
+            String msg = "Maintenance or Shutdown has been initiated on this management server. Can not accept new jobs";
+            logger.warn(msg);
+            throw new ServerApiException(ApiErrorCode.SERVICE_UNAVAILABLE, msg);
+        }
+        Long objectId = null;
+        String objectUuid;
+        if (asyncCmd instanceof BaseAsyncCreateCmd) {
+            final BaseAsyncCreateCmd createCmd = (BaseAsyncCreateCmd) asyncCmd;
+            dispatcher.dispatchCreateCmd(createCmd, params);
+            objectId = createCmd.getEntityId();
+            objectUuid = createCmd.getEntityUuid();
+            params.put("id", objectId.toString());
+            Class entityClass = EventTypes.getEntityClassForEvent(createCmd.getEventType());
+            if (entityClass != null)
+                ctx.putContextParameter(entityClass, objectUuid);
+        } else {
+            // Extract the uuid before params are processed and id reflects internal db id
+            objectUuid = params.get(ApiConstants.ID);
+            dispatchChainFactory.getStandardDispatchChain().dispatch(new DispatchTask(asyncCmd, params));
+        }
+
+        if (callerUserId != null) {
+            params.put("ctxUserId", callerUserId.toString());
+        }
+        if (caller != null) {
+            params.put("ctxAccountId", String.valueOf(caller.getId()));
+        }
+        if (objectUuid != null) {
+            params.put("uuid", objectUuid);
+        }
+
+        long startEventId = ctx.getStartEventId();
+        asyncCmd.setStartEventId(startEventId);
+
+        // save the scheduled event
+        final Long eventId =
+                ActionEventUtils.onScheduledActionEvent((callerUserId == null) ? (Long)User.UID_SYSTEM : callerUserId, asyncCmd.getEntityOwnerId(), asyncCmd.getEventType(),
+                        asyncCmd.getEventDescription(), asyncCmd.getApiResourceId(), asyncCmd.getApiResourceType().toString(), asyncCmd.isDisplay(), startEventId);
+        if (startEventId == 0) {
+            // There was no create event before, set current event id as start eventId
+            startEventId = eventId;
+        }
+
+        params.put("ctxStartEventId", String.valueOf(startEventId));
+        params.put("cmdEventType", asyncCmd.getEventType());
+        params.put("ctxDetails", ApiGsonHelper.getBuilder().create().toJson(ctx.getContextParameters()));
+        if (asyncCmd.getHttpMethod() != null) {
+            params.put(ApiConstants.HTTPMETHOD, asyncCmd.getHttpMethod().toString());
+        }
+
+        Long instanceId = (objectId == null) ? asyncCmd.getApiResourceId() : objectId;
+
+        // users can provide the job id they want to use, so log as it is a uuid and is unique
+        String injectedJobId = asyncCmd.getInjectedJobId();
+        uuidMgr.checkUuidSimple(injectedJobId, AsyncJob.class);
+
+        AsyncJobVO job = new AsyncJobVO("", callerUserId, caller.getId(), asyncCmd.getClass().getName(),
+                ApiGsonHelper.getBuilder().create().toJson(params), instanceId,
+                asyncCmd.getApiResourceType() != null ? asyncCmd.getApiResourceType().toString() : null,
+                        injectedJobId);
+        job.setDispatcher(asyncDispatcher.getName());
+
+        final long jobId = asyncMgr.submitAsyncJob(job);
+
+        if (jobId == 0L) {
+            final String errorMsg = "Unable to schedule async job for command " + job.getCmd();
+            logger.warn(errorMsg);
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, errorMsg);
+        }
+        return new AsyncCmdResult(objectId, objectUuid, asyncCmd, jobId);
+    }
+
     @SuppressWarnings("unchecked")
     private void buildAsyncListResponse(final BaseListCmd command, final Account account) {
         final List<ResponseObject> responses = ((ListResponse<ResponseObject>)command.getResponseObject()).getResponses();
diff --git a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
index 756425f5093e..43974bcf9cc6 100644
--- a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
@@ -16,6 +16,8 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.List;
+
 import org.apache.cloudstack.api.response.AsyncJobResponse;
 import org.apache.cloudstack.framework.jobs.AsyncJob;
 
@@ -28,4 +30,6 @@ public interface AsyncJobJoinDao extends GenericDao<AsyncJobJoinVO, Long> {
 
     AsyncJobJoinVO newAsyncJobView(AsyncJob vol);
 
+    List<AsyncJobJoinVO> listByIds(List<Long> ids);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
index 10ef67bbbea1..93af9a04e144 100644
--- a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
@@ -16,17 +16,17 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 
-
 import javax.inject.Inject;
 
-import org.springframework.stereotype.Component;
-
 import org.apache.cloudstack.api.ResponseObject;
 import org.apache.cloudstack.api.response.AsyncJobResponse;
 import org.apache.cloudstack.framework.jobs.AsyncJob;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.ApiSerializerHelper;
@@ -115,4 +115,16 @@ public AsyncJobJoinVO newAsyncJobView(AsyncJob job) {
 
     }
 
+    @Override
+    public List<AsyncJobJoinVO> listByIds(List<Long> ids) {
+        if (CollectionUtils.isEmpty(ids)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<AsyncJobJoinVO> idsSearch = createSearchBuilder();
+        idsSearch.and("ids", idsSearch.entity().getId(), SearchCriteria.Op.IN);
+        idsSearch.done();
+        SearchCriteria<AsyncJobJoinVO> sc = idsSearch.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
index 8e32cd010746..7d76349113b5 100644
--- a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
@@ -16,11 +16,14 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.List;
+
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.api.response.ZoneResponse;
 
 import com.cloud.api.query.vo.DataCenterJoinVO;
 import com.cloud.dc.DataCenter;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface DataCenterJoinDao extends GenericDao<DataCenterJoinVO, Long> {
@@ -30,4 +33,6 @@ public interface DataCenterJoinDao extends GenericDao<DataCenterJoinVO, Long> {
     ZoneResponse newDataCenterResponse(ResponseView view, DataCenterJoinVO dof, Boolean showCapacities, Boolean showResourceImage);
 
     DataCenterJoinVO newDataCenterView(DataCenter dof);
+
+    List<DataCenterJoinVO> listByIds(List<Long> ids, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
index f2d061c7bb0a..35d27e0cb791 100644
--- a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
@@ -16,22 +16,13 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
 
 import javax.inject.Inject;
 
-import com.cloud.cpu.CPU;
-import com.cloud.dc.ASNumberRangeVO;
-import com.cloud.dc.dao.ASNumberRangeDao;
-import com.cloud.gpu.dao.HostGpuGroupsDao;
-import com.cloud.network.Network;
-import com.cloud.network.dao.NetrisProviderDao;
-import com.cloud.network.dao.NsxProviderDao;
-import com.cloud.network.element.NetrisProviderVO;
-import com.cloud.network.element.NsxProviderVO;
-import com.cloud.utils.Pair;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
@@ -48,11 +39,22 @@
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.query.vo.DataCenterJoinVO;
 import com.cloud.api.query.vo.ResourceTagJoinVO;
+import com.cloud.cpu.CPU;
+import com.cloud.dc.ASNumberRangeVO;
 import com.cloud.dc.DataCenter;
+import com.cloud.dc.dao.ASNumberRangeDao;
+import com.cloud.gpu.dao.HostGpuGroupsDao;
+import com.cloud.network.Network;
 import com.cloud.network.NetworkService;
+import com.cloud.network.dao.NetrisProviderDao;
+import com.cloud.network.dao.NsxProviderDao;
+import com.cloud.network.element.NetrisProviderVO;
+import com.cloud.network.element.NsxProviderVO;
 import com.cloud.resource.icon.ResourceIconVO;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.user.AccountManager;
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -200,4 +202,15 @@ public DataCenterJoinVO newDataCenterView(DataCenter dataCenter) {
         return dcs.get(0);
     }
 
+    @Override
+    public List<DataCenterJoinVO> listByIds(List<Long> ids, Filter filter) {
+        if (CollectionUtils.isEmpty(ids)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<DataCenterJoinVO> sb = createSearchBuilder();
+        sb.and("ids", sb.entity().getId(), SearchCriteria.Op.IN);
+        SearchCriteria<DataCenterJoinVO> sc = sb.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
index bc6ec7931366..c4128178b5e6 100644
--- a/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
@@ -25,6 +25,8 @@
 
 import com.cloud.api.query.vo.HostJoinVO;
 import com.cloud.host.Host;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface HostJoinDao extends GenericDao<HostJoinVO, Long> {
@@ -41,4 +43,6 @@ public interface HostJoinDao extends GenericDao<HostJoinVO, Long> {
 
     List<HostJoinVO> findByClusterId(Long clusterId, Host.Type type);
 
+    List<HostJoinVO> listAvailableRoutingByZonesAndHypervisor(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType, Filter filter);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
index e7265a7e3b9a..b7464ba987ce 100644
--- a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
@@ -19,6 +19,7 @@
 import java.text.DecimalFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Date;
 import java.util.EnumSet;
 import java.util.Iterator;
@@ -40,6 +41,7 @@
 import org.apache.cloudstack.ha.HAResource;
 import org.apache.cloudstack.ha.dao.HAConfigDao;
 import org.apache.cloudstack.outofbandmanagement.dao.OutOfBandManagementDao;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
@@ -53,8 +55,10 @@
 import com.cloud.host.HostStats;
 import com.cloud.host.dao.HostDetailsDao;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
 import com.cloud.storage.StorageStats;
 import com.cloud.user.AccountManager;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -221,6 +225,7 @@ private void setNewHostResponseBase(HostJoinVO host, EnumSet<HostDetails> detail
                 hostResponse.setHaHost(containsHostHATag(hostTags));
                 hostResponse.setExplicitHostTags(host.getExplicitTag());
                 hostResponse.setImplicitHostTags(host.getImplicitTag());
+                hostResponse.setGuestOsRule(host.getGuestOsRule());
 
                 hostResponse.setHypervisorVersion(host.getHypervisorVersion());
                 if (host.getArch() != null) {
@@ -413,4 +418,26 @@ private String calculateResourceAllocatedPercentage(float resource, float resour
         return decimalFormat.format(((float)resource / resourceWithOverProvision * 100.0f)) + "%";
     }
 
+    @Override
+    public List<HostJoinVO> listAvailableRoutingByZonesAndHypervisor(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        List<ResourceState> availableStates = Arrays.asList(
+                ResourceState.Enabled, ResourceState.Disabled, ResourceState.Degraded
+        );
+        SearchBuilder<HostJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getZoneId(), SearchCriteria.Op.IN);
+        sb.and("type", sb.entity().getType(), SearchCriteria.Op.EQ);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        sb.and("resourceStates", sb.entity().getResourceState(), SearchCriteria.Op.IN);
+        sb.done();
+
+        SearchCriteria<HostJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("type", Host.Type.Routing);
+        sc.setParameters("hypervisorType", hypervisorType);
+        sc.setParameters("resourceStates", availableStates.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
index bc19e0892057..ed381743c354 100644
--- a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
@@ -18,11 +18,14 @@
 
 import java.util.List;
 
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.ScopeType;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 
 import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.storage.Storage;
 import com.cloud.storage.StoragePool;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 
@@ -44,4 +47,6 @@ public interface StoragePoolJoinDao extends GenericDao<StoragePoolJoinVO, Long>
 
     List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId, Long podId, Long clusterId, ScopeType scopeType, List<String> tags);
 
+    List<StoragePoolJoinVO> listAvailableByZoneHypervisorAndType(long zoneId, Hypervisor.HypervisorType hypervisorType, List<Storage.StoragePoolType> types, Filter filter);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
index 8bfce47b1204..946e3df4e90d 100644
--- a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
@@ -19,9 +19,11 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 
 import javax.inject.Inject;
 
+import com.cloud.storage.clvm.ClvmPoolManager;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
@@ -34,27 +36,29 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailVO;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiDBUtils;
 import com.cloud.api.query.vo.StoragePoolJoinVO;
 import com.cloud.capacity.CapacityManager;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.server.ResourceTag;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Storage;
 import com.cloud.storage.StoragePool;
+import com.cloud.storage.StoragePoolStatus;
 import com.cloud.storage.StorageStats;
 import com.cloud.storage.VolumeApiServiceImpl;
 import com.cloud.user.AccountManager;
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
-import org.apache.commons.collections.MapUtils;
-
-import java.util.Map;
 
 @Component
 public class StoragePoolJoinDaoImpl extends GenericDaoBase<StoragePoolJoinVO, Long> implements StoragePoolJoinDao {
@@ -180,7 +184,11 @@ public StoragePoolResponse newStoragePoolResponse(StoragePoolJoinVO pool, boolea
         poolResponse.setTags(pool.getTag());
         poolResponse.setStorageAccessGroups(pool.getStorageAccessGroup());
         poolResponse.setIsTagARule(pool.getIsTagARule());
-        poolResponse.setOverProvisionFactor(Double.toString(CapacityManager.StorageOverprovisioningFactor.valueIn(pool.getId())));
+        if (ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            poolResponse.setOverProvisionFactor(String.valueOf(1));
+        } else {
+            poolResponse.setOverProvisionFactor(Double.toString(CapacityManager.StorageOverprovisioningFactor.valueIn(pool.getId())));
+        }
         poolResponse.setManaged(storagePool.isManaged());
         Map<String, String> details = ApiDBUtils.getResourceDetails(pool.getId(), ResourceTag.ResourceObjectType.Storage);
         poolResponse.setDetails(details);
@@ -271,7 +279,11 @@ public StoragePoolResponse newStoragePoolForMigrationResponse(StoragePoolJoinVO
             }
         }
 
-        poolResponse.setOverProvisionFactor(Double.toString(CapacityManager.StorageOverprovisioningFactor.valueIn(pool.getId())));
+        if (ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            poolResponse.setOverProvisionFactor(String.valueOf(1));
+        } else {
+            poolResponse.setOverProvisionFactor(Double.toString(CapacityManager.StorageOverprovisioningFactor.valueIn(pool.getId())));
+        }
 
         // TODO: StatsCollector does not persist data
         StorageStats stats = ApiDBUtils.getStoragePoolStatistics(pool.getId());
@@ -398,7 +410,8 @@ public List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId,
         String injectableTag = injectableTagsBuilder.toString();
 
         for (StoragePoolJoinVO storagePoolJoinVO : storagePools) {
-            if (TagAsRuleHelper.interpretTagAsRule(storagePoolJoinVO.getTag(), injectableTag, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value())) {
+            if (GenericRuleHelper.interpretTagAsRule(storagePoolJoinVO.getTag(), injectableTag, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value(),
+                    VolumeApiServiceImpl.storageTagRuleExecutionTimeout.key())) {
                 StoragePoolVO storagePoolVO = storagePoolDao.findById(storagePoolJoinVO.getId());
                 if (storagePoolVO != null) {
                     filteredPools.add(storagePoolVO);
@@ -410,4 +423,26 @@ public List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId,
         return filteredPools;
     }
 
+    public List<StoragePoolJoinVO> listAvailableByZoneHypervisorAndType(long zoneId, Hypervisor.HypervisorType hypervisorType, List<Storage.StoragePoolType> types, Filter filter) {
+        List<StoragePoolStatus> availableStatus = Arrays.asList(
+                StoragePoolStatus.Up, StoragePoolStatus.Disabled
+        );
+        SearchBuilder<StoragePoolJoinVO> sb = createSearchBuilder();
+        sb.and("zoneId", sb.entity().getZoneId(), SearchCriteria.Op.EQ);
+        sb.and("hypervisors", sb.entity().getHypervisor(), SearchCriteria.Op.IN);
+        sb.and("types", sb.entity().getPoolType(), SearchCriteria.Op.IN);
+        sb.and("status", sb.entity().getStatus(), SearchCriteria.Op.IN);
+        sb.done();
+        SearchCriteria<StoragePoolJoinVO> sc = sb.create();
+        sc.setParameters("zoneId", zoneId);
+        List<Hypervisor.HypervisorType> hypervisors = new ArrayList<>();
+        hypervisors.add(Hypervisor.HypervisorType.Any);
+        hypervisors.add(hypervisorType);
+        sc.setParameters("hypervisors", hypervisors.toArray());
+        if (CollectionUtils.isNotEmpty(types)) {
+            sc.setParameters("types", types.toArray());
+        }
+        sc.setParameters("status", availableStatus.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
index 79312460d2c0..ae62f301f466 100644
--- a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
@@ -17,8 +17,10 @@
 package com.cloud.api.query.dao;
 
 import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.user.Account;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.api.ApiConstants.VMDetails;
@@ -49,4 +51,8 @@ List<UserVmJoinVO> listByAccountServiceOfferingTemplateAndNotInState(long accoun
     List<UserVmJoinVO> listEligibleInstancesWithExpiredLease();
 
     List<UserVmJoinVO> listLeaseInstancesExpiringInDays(int days);
+
+    List<UserVmJoinVO> listByZonesHypervisorNotTypesAndOwners(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType,
+                                                              List<String> excludeTypes, List<Long> accountIds,
+                                                              String domainPath, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
index 72690091e40e..4877eb844af1 100644
--- a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
@@ -61,6 +61,7 @@
 import com.cloud.gpu.GPU;
 import com.cloud.gpu.dao.VgpuProfileDao;
 import com.cloud.host.ControlState;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.network.IpAddress;
 import com.cloud.network.vpc.VpcVO;
 import com.cloud.network.vpc.dao.VpcDao;
@@ -83,6 +84,7 @@
 import com.cloud.user.dao.UserDao;
 import com.cloud.user.dao.UserStatisticsDao;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.SearchCriteria.Op;
@@ -386,6 +388,7 @@ public UserVmResponse newUserVmResponse(ResponseView view, String objectName, Us
                     for (NicSecondaryIpVO ip : secondaryIps) {
                         NicSecondaryIpResponse ipRes = new NicSecondaryIpResponse();
                         ipRes.setId(ip.getUuid());
+                        ipRes.setDescription(ip.getDescription());
                         ApiResponseHelper.setResponseIpAddress(ip, ipRes);
                         ipList.add(ipRes);
                     }
@@ -507,7 +510,7 @@ public UserVmResponse newUserVmResponse(ResponseView view, String objectName, Us
         }
 
         if (userVm.getUserDataId() != null) {
-            userVmResponse.setUserDataId(userVm.getUserDataUUid());
+            userVmResponse.setUserDataId(userVm.getUserDataUuid());
             userVmResponse.setUserDataName(userVm.getUserDataName());
             userVmResponse.setUserDataDetails(userVm.getUserDataDetails());
             userVmResponse.setUserDataPolicy(userVm.getUserDataPolicy());
@@ -841,4 +844,43 @@ public List<UserVmJoinVO> listLeaseInstancesExpiringInDays(int days) {
         }
         return listBy(sc);
     }
+
+    @Override
+    public List<UserVmJoinVO> listByZonesHypervisorNotTypesAndOwners(List<Long> zoneIds,
+                                                                     Hypervisor.HypervisorType hypervisorType,
+                                                                     List<String> excludeTypes, List<Long> accountIds,
+                                                                     String domainPath, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<UserVmJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), Op.EQ);
+        if (CollectionUtils.isNotEmpty(excludeTypes)) {
+            sb.and().op("typeNull", sb.entity().getUserVmType(), Op.NULL);
+            sb.or("type", sb.entity().getUserVmType(), Op.NOTIN);
+            sb.cp();
+        }
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainPathNotBlank = StringUtils.isNotBlank(domainPath);
+        if (accountIdsNotEmpty || domainPathNotBlank) {
+            sb.and().op("account", sb.entity().getAccountId(), Op.IN);
+            sb.or("domainPath", sb.entity().getDomainPath(), Op.LIKE);
+            sb.cp();
+        }
+        sb.done();
+        SearchCriteria<UserVmJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("hypervisorType", hypervisorType);
+        if (CollectionUtils.isNotEmpty(excludeTypes)) {
+            sc.setParameters("type", excludeTypes.toArray());
+        }
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainPathNotBlank) {
+            sc.setParameters("domainPath", domainPath + "%");
+        }
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
index ebcf0bca391e..7336bdfb3b58 100644
--- a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
@@ -22,7 +22,9 @@
 import org.apache.cloudstack.api.response.VolumeResponse;
 
 import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.Volume;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface VolumeJoinDao extends GenericDao<VolumeJoinVO, Long> {
@@ -34,4 +36,9 @@ public interface VolumeJoinDao extends GenericDao<VolumeJoinVO, Long> {
     List<VolumeJoinVO> newVolumeView(Volume vol);
 
     List<VolumeJoinVO> searchByIds(Long... ids);
+
+    List<VolumeJoinVO> listByInstanceId(long instanceId);
+
+    List<VolumeJoinVO> listByZonesHypervisorTypeAndOwners(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType,
+                                                          List<Long> accountIds, String domainPath, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
index 4f5d984c969a..94d06b2ed6bd 100644
--- a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
@@ -17,12 +17,12 @@
 package com.cloud.api.query.dao;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 import javax.inject.Inject;
 
-import com.cloud.hypervisor.Hypervisor;
-import com.cloud.offering.DiskOffering;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
@@ -31,11 +31,15 @@
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiDBUtils;
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.offering.DiskOffering;
 import com.cloud.offering.ServiceOffering;
 import com.cloud.storage.Storage;
 import com.cloud.storage.VMTemplateStorageResourceAssoc.Status;
@@ -43,8 +47,10 @@
 import com.cloud.user.AccountManager;
 import com.cloud.user.VmDiskStatisticsVO;
 import com.cloud.user.dao.VmDiskStatisticsDao;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VirtualMachine;
 
 @Component
 public class VolumeJoinDaoImpl extends GenericDaoBaseWithTagInformation<VolumeJoinVO, VolumeResponse> implements VolumeJoinDao {
@@ -129,7 +135,11 @@ public VolumeResponse newVolumeResponse(ResponseView view, VolumeJoinVO volume)
         }
 
         if (volume.getProvisioningType() != null) {
-            volResponse.setProvisioningType(volume.getProvisioningType().toString());
+            Long poolId = volume.getPoolId();
+            StoragePoolVO poolVO = primaryDataStoreDao.findById(poolId);
+            if (poolVO == null || !ClvmPoolManager.isClvmPoolType(poolVO.getPoolType())) {
+                volResponse.setProvisioningType(volume.getProvisioningType().toString());
+            }
         }
 
         // Show the virtual size of the volume
@@ -372,4 +382,44 @@ public List<VolumeJoinVO> searchByIds(Long... volIds) {
         return uvList;
     }
 
+    @Override
+    public List<VolumeJoinVO> listByInstanceId(long instanceId) {
+        SearchCriteria<VolumeJoinVO> sc = createSearchCriteria();
+        sc.addAnd("vmId", SearchCriteria.Op.EQ, instanceId);
+        return search(sc, null);
+    }
+
+    @Override
+    public List<VolumeJoinVO> listByZonesHypervisorTypeAndOwners(List<Long> zoneIds,
+                                                                 Hypervisor.HypervisorType hypervisorType,
+                                                                 List<Long> accountIds, String domainPath,
+                                                                 Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<VolumeJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("vmType", sb.entity().getVmType(), SearchCriteria.Op.EQ);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainPathNotBlank = StringUtils.isNotBlank(domainPath);
+        if (accountIdsNotEmpty || domainPathNotBlank) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domainPath", sb.entity().getDomainPath(), SearchCriteria.Op.LIKE);
+            sb.cp();
+        }
+        sb.done();
+        SearchCriteria<VolumeJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("vmType", VirtualMachine.Type.User);
+        sc.setParameters("hypervisorType", hypervisorType);
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainPathNotBlank) {
+            sc.setParameters("domainPath", domainPath + "%");
+        }
+        return search(sc, filter);
+    }
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
index 83cfcc8375f3..24ab5291a42a 100644
--- a/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
@@ -173,6 +173,9 @@ public class HostJoinVO extends BaseViewVO implements InternalIdentity, Identity
     @Column(name = "guest_os_category_name")
     private String osCategoryName;
 
+    @Column(name = "guest_os_rule")
+    private String guestOsRule;
+
     @Column(name = "tag")
     private String tag;
 
@@ -373,6 +376,10 @@ public String getOsCategoryName() {
         return osCategoryName;
     }
 
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
     public Long getJobId() {
         return jobId;
     }
diff --git a/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
index c59a13ccd1b2..b697c3571159 100644
--- a/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
@@ -131,6 +131,9 @@ public class UserVmJoinVO extends BaseViewWithTagInformationVO implements Contro
     @Column(name = "guest_os_uuid")
     private String guestOsUuid;
 
+    @Column(name = "guest_os_display_name")
+    private String guestOsDisplayName;
+
     @Column(name = "hypervisor_type")
     @Convert(converter = HypervisorTypeConverter.class)
     private HypervisorType hypervisorType;
@@ -432,7 +435,7 @@ public class UserVmJoinVO extends BaseViewWithTagInformationVO implements Contro
     private int jobStatus;
 
     @Column(name = "affinity_group_id")
-    private long affinityGroupId;
+    private Long affinityGroupId;
 
     @Column(name = "affinity_group_uuid")
     private String affinityGroupUuid;
@@ -615,6 +618,10 @@ public String getGuestOsUuid() {
         return guestOsUuid;
     }
 
+    public String getGuestOsDisplayName() {
+        return guestOsDisplayName;
+    }
+
     public HypervisorType getHypervisorType() {
         return hypervisorType;
     }
@@ -1019,7 +1026,7 @@ public String getIp6Cidr() {
         return ip6Cidr;
     }
 
-    public long getAffinityGroupId() {
+    public Long getAffinityGroupId() {
         return affinityGroupId;
     }
 
@@ -1064,7 +1071,7 @@ public Long getUserDataId() {
         return userDataId;
     }
 
-    public String getUserDataUUid() {
+    public String getUserDataUuid() {
         return userDataUuid;
     }
 
diff --git a/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
index 2ae720fa8524..ba932c775beb 100644
--- a/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
@@ -23,6 +23,7 @@
 import javax.persistence.Entity;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
+import javax.persistence.Id;
 import javax.persistence.Table;
 import javax.persistence.Temporal;
 import javax.persistence.TemporalType;
@@ -40,6 +41,10 @@
 @Table(name = "volume_view")
 public class VolumeJoinVO extends BaseViewWithTagInformationVO implements ControlledViewEntity {
 
+    @Id
+    @Column(name = "id", updatable = false, nullable = false)
+    private long id;
+
     @Column(name = "uuid")
     private String uuid;
 
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 6da5dda967d0..6889d33c5c80 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -143,7 +143,7 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.userdata.UserDataManager;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
@@ -160,6 +160,9 @@
 import com.cloud.api.query.vo.NetworkOfferingJoinVO;
 import com.cloud.capacity.CapacityManager;
 import com.cloud.capacity.dao.CapacityDao;
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
+import com.cloud.cluster.dao.ManagementServerHostDetailsDao;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.dc.AccountVlanMapVO;
 import com.cloud.dc.ClusterDetailsDao;
@@ -469,6 +472,10 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
     @Inject
     ImageStoreDetailsDao _imageStoreDetailsDao;
     @Inject
+    ManagementServerHostDao managementServerHostDao;
+    @Inject
+    ManagementServerHostDetailsDao managementServerHostDetailsDao;
+    @Inject
     MessageBus messageBus;
     @Inject
     AgentManager _agentManager;
@@ -885,6 +892,13 @@ public String updateConfiguration(final long userId, final String name, final St
                 }
                 break;
 
+                case ManagementServer:
+                    final ManagementServerHostVO managementServer = managementServerHostDao.findById(resourceId);
+                    Preconditions.checkState(managementServer != null);
+                    resourceType = ApiCommandResourceType.ManagementServer;
+                    managementServerHostDetailsDao.addDetail(resourceId, name, value, true);
+                    break;
+
             default:
                 throw new InvalidParameterValueException("Scope provided is invalid");
             }
@@ -1032,8 +1046,9 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
         String value = cmd.getValue();
         final Long zoneId = cmd.getZoneId();
         final Long clusterId = cmd.getClusterId();
-        final Long storagepoolId = cmd.getStoragepoolId();
+        final Long storagepoolId = cmd.getStoragePoolId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         Long accountId = cmd.getAccountId();
         Long domainId = cmd.getDomainId();
         // check if config value exists
@@ -1113,6 +1128,11 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
             id = imageStoreId;
             paramCountCheck++;
         }
+        if (managementServerId != null) {
+            scope = ConfigKey.Scope.ManagementServer;
+            id = managementServerId;
+            paramCountCheck++;
+        }
 
         if (paramCountCheck > 1) {
             throw new InvalidParameterValueException("cannot handle multiple IDs, provide only one ID corresponding to the scope");
@@ -1168,6 +1188,7 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
         final Long accountId = cmd.getAccountId();
         final Long domainId = cmd.getDomainId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         ConfigKey<?> configKey = null;
         Optional optionalValue;
         String defaultValue;
@@ -1201,6 +1222,7 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
         scopeMap.put(ConfigKey.Scope.Account.toString(), accountId);
         scopeMap.put(ConfigKey.Scope.StoragePool.toString(), storagepoolId);
         scopeMap.put(ConfigKey.Scope.ImageStore.toString(), imageStoreId);
+        scopeMap.put(ConfigKey.Scope.ManagementServer.toString(), managementServerId);
 
         ParamCountPair paramCountPair = getParamCount(scopeMap);
         id = paramCountPair.getId();
@@ -1297,6 +1319,16 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
                 newValue = optionalValue.isPresent() ? optionalValue.get().toString() : defaultValue;
                 break;
 
+            case ManagementServer:
+                final ManagementServerHostVO managementServer = managementServerHostDao.findById(id);
+                if (managementServer == null) {
+                    throw new InvalidParameterValueException("unable to find management server by id " + id);
+                }
+                managementServerHostDetailsDao.removeDetail(id, name);
+                optionalValue = Optional.ofNullable(configKey != null ? configKey.valueIn(id) : config.getValue());
+                newValue = optionalValue.isPresent() ? optionalValue.get().toString() : defaultValue;
+                break;
+
             default:
                 if (!_configDao.update(name, category, defaultValue)) {
                     logger.error("Failed to reset configuration option, name: {}, defaultValue: {}", name, defaultValue);
@@ -5083,7 +5115,8 @@ protected void updateOfferingTagsIfIsNotNull(String tags, DiskOfferingVO diskOff
 
                     if ((CollectionUtils.isNotEmpty(tagsAsString) && tagsAsString.containsAll(listOfTags)) ||
                         (tagsOnPool.size() == 1 && tagsOnPool.get(0).isTagARule() &&
-                        TagAsRuleHelper.interpretTagAsRule(tagsOnPool.get(0).getTag(), tags, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value()))) {
+                        GenericRuleHelper.interpretTagAsRule(tagsOnPool.get(0).getTag(), tags, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value(),
+                                VolumeApiServiceImpl.storageTagRuleExecutionTimeout.key()))) {
                         continue;
                     }
 
@@ -5126,7 +5159,8 @@ protected void updateServiceOfferingHostTagsIfNotNull(String hostTags, ServiceOf
 
                     if ((CollectionUtils.isNotEmpty(tagsAsString) && tagsAsString.containsAll(listOfHostTags)) ||
                         (tagsOnHost.size() == 1 && tagsOnHost.get(0).getIsTagARule() &&
-                        TagAsRuleHelper.interpretTagAsRule(tagsOnHost.get(0).getTag(), hostTags, HostTagsDao.hostTagRuleExecutionTimeout.value()))) {
+                        GenericRuleHelper.interpretTagAsRule(tagsOnHost.get(0).getTag(), hostTags, HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                                HostTagsDao.hostTagRuleExecutionTimeout.key()))) {
                         continue;
                     }
 
diff --git a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
index 7fb4a97e149b..2eaa44af1b0c 100644
--- a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
+++ b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
@@ -35,6 +35,7 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.api.ApiDBUtils;
 import com.cloud.gpu.dao.VgpuProfileDao;
 import com.cloud.resource.ResourceState;
 import org.apache.cloudstack.affinity.AffinityGroupDomainMapVO;
@@ -805,18 +806,49 @@ protected boolean checkVmProfileAndHost(final VirtualMachineProfile vmProfile, f
                 return false;
             }
         }
+
+        DetailVO guestOsRule = _hostDetailsDao.findDetail(host.getId(), HostVO.GUEST_OS_RULE);
+        if (guestOsRule != null) {
+            return isHostGuestOsCompatible(vmProfile, host, guestOsRule);
+        }
+
+        DetailVO guestOsCategoryId = _hostDetailsDao.findDetail(host.getId(), HostVO.GUEST_OS_CATEGORY_ID);
+        if (guestOsCategoryId != null) {
+            return isHostGuestOsCategoryCompatible(vmProfile, host, guestOsCategoryId);
+        }
+
+        return true;
+    }
+
+    private boolean isHostGuestOsCategoryCompatible(VirtualMachineProfile vmProfile, HostVO host, DetailVO guestOsCategoryId) {
         long guestOSId = vmProfile.getTemplate().getGuestOSId();
         GuestOSVO guestOS = _guestOSDao.findById(guestOSId);
-        if (guestOS != null) {
-            long guestOSCategoryId = guestOS.getCategoryId();
-            DetailVO hostDetail = _hostDetailsDao.findDetail(host.getId(), "guest.os.category.id");
-            if (hostDetail != null) {
-                String guestOSCategoryIdString = hostDetail.getValue();
-                if (String.valueOf(guestOSCategoryId) != guestOSCategoryIdString) {
-                    logger.debug("The last host has different guest.os.category.id than guest os category of VM, skipping");
-                    return false;
-                }
-            }
+
+        if (guestOS == null) {
+            return true;
+        }
+
+        long guestOSCategoryId = guestOS.getCategoryId();
+        String guestOSCategoryIdString = guestOsCategoryId.getValue();
+        if (!String.valueOf(guestOSCategoryId).equals(guestOSCategoryIdString)) {
+            logger.debug("The last host has different `{}` than guest os category of VM, skipping", Host.GUEST_OS_CATEGORY_ID);
+            return false;
+        }
+
+        return true;
+    }
+
+    private boolean isHostGuestOsCompatible(VirtualMachineProfile vmProfile, HostVO host, DetailVO guestOsRule) {
+        VMTemplateVO template = (VMTemplateVO) vmProfile.getTemplate();
+        String templateGuestOSName = ApiDBUtils.getTemplateGuestOSName(template);
+
+        List<HostVO> incompatibleHosts = _hostDao.findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(templateGuestOSName);
+
+        boolean isHostCompatible = incompatibleHosts.stream().noneMatch(incompatibleHost -> incompatibleHost.getId() == host.getId());
+
+        if (!isHostCompatible) {
+            logger.debug("The template [{}] is incompatible with the host [{}] due to the guest OS rule [{}].", template, host, guestOsRule);
+            return false;
         }
         return true;
     }
diff --git a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
index d18fd043f697..387fd6e40580 100644
--- a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
@@ -891,7 +891,7 @@ public boolean configureNicSecondaryIp(NicSecondaryIp secIp, boolean isZoneSgEna
      */
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_NIC_SECONDARY_IP_ASSIGN, eventDescription = "Assigning secondary IP to NIC", create = true)
-    public NicSecondaryIp allocateSecondaryGuestIP(final long nicId, IpAddresses requestedIpPair) throws InsufficientAddressCapacityException {
+    public NicSecondaryIp allocateSecondaryGuestIP(final long nicId, IpAddresses requestedIpPair, String description) throws InsufficientAddressCapacityException {
 
         Account caller = CallContext.current().getCallingAccount();
         String ipv4Address = requestedIpPair.getIp4Address();
@@ -989,7 +989,7 @@ public Long doInTransaction(TransactionStatus status) {
 
                     logger.debug("Setting nic_secondary_ip table ...");
                     Long vmId = nicVO.getInstanceId();
-                    NicSecondaryIpVO secondaryIpVO = new NicSecondaryIpVO(nicId, ip4AddrFinal, ip6AddrFinal, vmId, ipOwner.getId(), ipOwner.getDomainId(), networkId);
+                    NicSecondaryIpVO secondaryIpVO = new NicSecondaryIpVO(nicId, ip4AddrFinal, ip6AddrFinal, vmId, ipOwner.getId(), ipOwner.getDomainId(), networkId, description);
                     _nicSecondaryIpDao.persist(secondaryIpVO);
                     return secondaryIpVO.getId();
                 }
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 0f6933664f93..8db55790fd8a 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -84,8 +84,8 @@
 import org.apache.cloudstack.utils.identity.ManagementServerNode;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.collections.MapUtils;
-import org.apache.commons.lang.ObjectUtils;
 import org.apache.commons.lang3.ArrayUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.jetbrains.annotations.NotNull;
 import org.springframework.stereotype.Component;
 
@@ -2046,31 +2046,74 @@ private void updateHostName(HostVO host, String name) {
         _hostDao.update(host.getId(), host);
     }
 
-    private void updateHostGuestOSCategory(Long hostId, Long guestOSCategoryId) {
-        // Verify that the guest OS Category exists
-        if (!(guestOSCategoryId > 0) || _guestOSCategoryDao.findById(guestOSCategoryId) == null) {
+    /**
+     * Updates the guest OS details related to the host ({@code guest.os.rule} and {@code guest.os.category.id}); only one can be set at a time for a given host.
+     */
+    private void updateGuestOsRelatedFields(Long hostId, Long cmdOsCategoryId, String cmdGuestOsRule) {
+        if (ObjectUtils.allNotNull(cmdOsCategoryId, cmdGuestOsRule)) {
+            throw new InvalidParameterValueException("Informing both guest OS category and guest OS rule is invalid; please, inform only one of them.");
+        }
+
+        if (cmdOsCategoryId != null) {
+            updateHostCategoryOs(hostId, cmdOsCategoryId);
+        } else if (cmdGuestOsRule != null) {
+            updateHostGuestOsRule(hostId, cmdGuestOsRule);
+        }
+    }
+
+    /**
+     * Associates/removes a guest OS rule to a host and removes any guest OS category associated with it.
+     */
+    private void updateHostGuestOsRule(Long hostId, String cmdGuestOsRule) {
+        final DetailVO hostGuestOsRule = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_RULE);
+
+        if (StringUtils.isNotBlank(cmdGuestOsRule)) {
+            createOrUpdateHostDetails(hostGuestOsRule, cmdGuestOsRule, Host.GUEST_OS_RULE, hostId);
+        } else if (hostGuestOsRule != null) {
+            _hostDetailsDao.remove(hostGuestOsRule.getId());
+        }
+        removeHostDetails(hostId, Host.GUEST_OS_CATEGORY_ID);
+    }
+
+    /**
+     * Removes a host details if it exists.
+     */
+    private void removeHostDetails(Long hostId, String detailString) {
+        DetailVO detailVO = _hostDetailsDao.findDetail(hostId, detailString);
+
+        if (detailVO != null) {
+            _hostDetailsDao.remove(detailVO.getId());
+        }
+    }
+
+    private void createOrUpdateHostDetails(DetailVO hostDetail, String detailValue, String detailName, Long hostId) {
+        if (hostDetail != null) {
+            hostDetail.setValue(detailValue);
+            _hostDetailsDao.update(hostDetail.getId(), hostDetail);
+        } else {
+            Map<String, String> detail = new HashMap<>();
+            detail.put(detailName, detailValue);
+            _hostDetailsDao.persist(hostId, detail);
+        }
+    }
+
+    /**
+     * Associates/removes a valid guest OS category to a host and removes any guest OS rules associated with it.
+     */
+    private void updateHostCategoryOs(Long hostId, Long cmdOsCategoryId) {
+        if (cmdOsCategoryId <= 0 || _guestOSCategoryDao.findById(cmdOsCategoryId) == null) {
             throw new InvalidParameterValueException("Please specify a valid guest OS category.");
         }
 
-        final GuestOSCategoryVO guestOSCategory = _guestOSCategoryDao.findById(guestOSCategoryId);
-        final DetailVO guestOSDetail = _hostDetailsDao.findDetail(hostId, "guest.os.category.id");
+        GuestOSCategoryVO guestOSCategory = _guestOSCategoryDao.findById(cmdOsCategoryId);
+        DetailVO guestOSDetail = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_CATEGORY_ID);
 
         if (guestOSCategory != null && !GuestOSCategoryVO.CATEGORY_NONE.equalsIgnoreCase(guestOSCategory.getName())) {
-            // Create/Update an entry for guest.os.category.id
-            if (guestOSDetail != null) {
-                guestOSDetail.setValue(String.valueOf(guestOSCategory.getId()));
-                _hostDetailsDao.update(guestOSDetail.getId(), guestOSDetail);
-            } else {
-                final Map<String, String> detail = new HashMap<>();
-                detail.put("guest.os.category.id", String.valueOf(guestOSCategory.getId()));
-                _hostDetailsDao.persist(hostId, detail);
-            }
-        } else {
-            // Delete any existing entry for guest.os.category.id
-            if (guestOSDetail != null) {
-                _hostDetailsDao.remove(guestOSDetail.getId());
-            }
+            createOrUpdateHostDetails(guestOSDetail, String.valueOf(guestOSCategory.getId()), Host.GUEST_OS_CATEGORY_ID, hostId);
+        } else if (guestOSDetail != null) {
+            _hostDetailsDao.remove(guestOSDetail.getId());
         }
+        removeHostDetails(hostId, Host.GUEST_OS_RULE);
     }
 
     private void removeStorageAccessGroupsOnPodsInZone(long zoneId, List<String> newStoragePoolTags, List<String> tagsToDeleteOnZone) {
@@ -2821,16 +2864,17 @@ private void updateHostTags(HostVO host, Long hostId, List<String> hostTags, Boo
 
     @Override
     public Host updateHost(final UpdateHostCmd cmd) throws NoTransitionException {
-        return updateHost(cmd.getId(), cmd.getName(), cmd.getOsCategoryId(),
+        return updateHost(cmd.getId(), cmd.getName(), cmd.getOsCategoryId(), cmd.getGuestOsRule(),
                 cmd.getAllocationState(), cmd.getUrl(), cmd.getHostTags(), cmd.getIsTagARule(), cmd.getAnnotation(), false,
                 cmd.getExternalDetails(), cmd.isCleanupExternalDetails());
     }
 
-    private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String allocationState,
+    private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String guestOsRule, String allocationState,
             String url, List<String> hostTags, Boolean isTagARule, String annotation,
             boolean isUpdateFromHostHealthCheck, Map<String, String> externalDetails,
             boolean cleanupExternalDetails) throws NoTransitionException {
         jsInterpreterHelper.ensureInterpreterEnabledIfParameterProvided(ApiConstants.IS_TAG_A_RULE, Boolean.TRUE.equals(isTagARule));
+        jsInterpreterHelper.ensureInterpreterEnabledIfParameterProvided(ApiConstants.GUEST_OS_RULE, guestOsRule != null);
 
         // Verify that the host exists
         final HostVO host = _hostDao.findById(hostId);
@@ -2847,9 +2891,7 @@ private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String
             updateHostName(host, name);
         }
 
-        if (guestOSCategoryId != null) {
-            updateHostGuestOSCategory(hostId, guestOSCategoryId);
-        }
+        updateGuestOsRelatedFields(hostId, guestOSCategoryId, guestOsRule);
 
         if (hostTags != null) {
             updateHostTags(host, hostId, hostTags, isTagARule);
@@ -2919,7 +2961,7 @@ private void sendAlertAndAnnotationForAutoEnableDisableKVMHostFeature(HostVO hos
 
     @Override
     public Host autoUpdateHostAllocationState(Long hostId, ResourceState.Event resourceEvent) throws NoTransitionException {
-        return updateHost(hostId, null, null, resourceEvent.toString(), null, null, null, null, true, null, false);
+        return updateHost(hostId, null, null, null, resourceEvent.toString(), null, null, null, null, true, null, false);
     }
 
     @Override
@@ -3639,7 +3681,7 @@ private void checkIPConflicts(final HostPodVO pod, final DataCenterVO dc, final
         // If the server's private IP is the same as is public IP, this host has
         // a host-only private network. Don't check for conflicts with the
         // private IP address table.
-        if (!ObjectUtils.equals(serverPrivateIP, serverPublicIP)) {
+        if (!StringUtils.equals(serverPrivateIP, serverPublicIP)) {
             if (!_privateIPAddressDao.mark(dc.getId(), pod.getId(), serverPrivateIP)) {
                 // If the server's private IP address is already in the
                 // database, return false
@@ -4284,7 +4326,7 @@ public Long getGuestOSCategoryId(final long hostId) {
             return null;
         } else {
             _hostDao.loadDetails(host);
-            final DetailVO detail = _hostDetailsDao.findDetail(hostId, "guest.os.category.id");
+            final DetailVO detail = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_CATEGORY_ID);
             if (detail == null) {
                 return null;
             } else {
diff --git a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
index 8f10dd84b54d..def564dfdc68 100644
--- a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
@@ -222,9 +222,6 @@ public void persistDefaultValues() throws InternalErrorException {
             _configDao.update(Config.SecStorageEncryptCopy.key(), Config.SecStorageEncryptCopy.getCategory(), "false");
             logger.debug("ConfigurationServer made secondary storage copy encrypt set to false.");
 
-            _configDao.update("secstorage.secure.copy.cert", "realhostip");
-            logger.debug("ConfigurationServer made secondary storage copy use realhostip.");
-
             _configDao.update("user.password.encoders.exclude", "MD5,LDAP,PLAINTEXT");
             logger.debug("Configuration server excluded insecure encoders");
 
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index e5066b6da5cc..cadcf97626e3 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -2357,6 +2357,7 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
         final Long clusterId = cmd.getClusterId();
         final Long storagepoolId = cmd.getStoragepoolId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         Long accountId = cmd.getAccountId();
         Long domainId = cmd.getDomainId();
         final String groupName = cmd.getGroupName();
@@ -2410,6 +2411,11 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
             id = imageStoreId;
             paramCountCheck++;
         }
+        if (managementServerId != null) {
+            scope = ConfigKey.Scope.ManagementServer;
+            id = managementServerId;
+            paramCountCheck++;
+        }
 
         if (paramCountCheck > 1) {
             throw new InvalidParameterValueException("cannot handle multiple IDs, provide only one ID corresponding to the scope");
diff --git a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
index 7c501c78beeb..058f1cbc2cdd 100644
--- a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
@@ -1058,6 +1058,7 @@ public PrimaryDataStoreInfo createPool(CreateStoragePoolCmd cmd) throws Resource
         params.put("managed", cmd.isManaged());
         params.put("capacityBytes", cmd.getCapacityBytes());
         params.put("capacityIops", cmd.getCapacityIops());
+        params.put("scheme", uriParams.get("scheme"));
         if (MapUtils.isNotEmpty(uriParams)) {
             params.putAll(uriParams);
         }
@@ -1143,6 +1144,10 @@ protected Map<String,String> extractUriParamsAsMap(String url) {
             if (isHostOrPathBlank) {
                 throw new InvalidParameterValueException("host or path is null, should be gluster://hostname/volume");
             }
+        } else if (scheme.equalsIgnoreCase("clvm") || scheme.equalsIgnoreCase("clvm_ng")) {
+            if (storagePath == null) {
+                throw new InvalidParameterValueException("path is null, should be " + scheme.toLowerCase() + "://localhost/volume-group-name");
+            }
         }
 
         String hostPath = null;
diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
index 6872d2070d66..1bb8c8ee0dbe 100644
--- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
+++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
@@ -35,6 +35,7 @@
 
 import javax.inject.Inject;
 
+import com.cloud.storage.clvm.ClvmPoolManager;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.InternalIdentity;
@@ -112,7 +113,7 @@
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.cloudstack.utils.identity.ManagementServerNode;
 import org.apache.cloudstack.utils.imagestore.ImageStoreUtil;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.cloudstack.utils.volume.VirtualMachineDiskInfo;
 import org.apache.commons.collections.CollectionUtils;
@@ -219,10 +220,10 @@
 import com.cloud.utils.fsm.NoTransitionException;
 import com.cloud.utils.fsm.StateMachine2;
 import com.cloud.vm.DiskProfile;
-import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.UserVmManager;
 import com.cloud.vm.UserVmService;
 import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachine.State;
@@ -241,14 +242,13 @@
 import com.cloud.vm.VmWorkSerializer;
 import com.cloud.vm.VmWorkTakeVolumeSnapshot;
 import com.cloud.vm.dao.UserVmDao;
-import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.snapshot.VMSnapshot;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
 import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
-
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonParseException;
@@ -371,6 +371,8 @@ public class VolumeApiServiceImpl extends ManagerBase implements VolumeApiServic
     @Inject
     EndPointSelector _epSelector;
     @Inject
+    ClvmPoolManager clvmPoolManager;
+    @Inject
     private ReservationDao reservationDao;
     @Inject
     private VMSnapshotDetailsDao vmSnapshotDetailsDao;
@@ -656,21 +658,6 @@ private Long getDefaultCustomOfferingId(Account owner, DataCenter zone) {
         return null;
     }
 
-    private Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone) {
-        Long offeringId = getDefaultCustomOfferingId(owner, zone);
-        if (offeringId != null) {
-            return offeringId;
-        }
-        List<DiskOfferingVO> offerings = _diskOfferingDao.findCustomDiskOfferings();
-        for (DiskOfferingVO offering : offerings) {
-            try {
-                _configMgr.checkDiskOfferingAccess(owner, offering, zone);
-                return offering.getId();
-            } catch (PermissionDeniedException ignored) {}
-        }
-        return null;
-    }
-
     @DB
     protected VolumeVO persistVolume(final Account owner, final Long zoneId, final String volumeName, final String url, final String format, final Long diskOfferingId, final Volume.State state) {
         return Transaction.execute(new TransactionCallbackWithException<VolumeVO, CloudRuntimeException>() {
@@ -689,7 +676,7 @@ public VolumeVO doInTransaction(TransactionStatus status) {
 
                 Long volumeDiskOfferingId = diskOfferingId;
                 if (volumeDiskOfferingId == null) {
-                    volumeDiskOfferingId = getCustomDiskOfferingIdForVolumeUpload(owner, zone);
+                    volumeDiskOfferingId = getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
                     if (volumeDiskOfferingId == null) {
                         throw new CloudRuntimeException(String.format("Unable to find custom disk offering in zone: %s for volume upload", zone.getUuid()));
                     }
@@ -736,17 +723,41 @@ public VolumeVO doInTransaction(TransactionStatus status) {
      * If the retrieved volume name is null, empty or blank, then A random name
      * will be generated using getRandomVolumeName method.
      *
-     * @param cmd
+     * @param userSpecifiedName
      * @return Either the retrieved name or a random name.
      */
-    public String getVolumeNameFromCommand(CreateVolumeCmd cmd) {
-        String userSpecifiedName = cmd.getVolumeName();
-
-        if (StringUtils.isBlank(userSpecifiedName)) {
-            userSpecifiedName = getRandomVolumeName();
+    public String getVolumeNameFromCommand(String userSpecifiedName) {
+        if (StringUtils.isNotBlank(userSpecifiedName)) {
+            return userSpecifiedName;
         }
 
-        return userSpecifiedName;
+        return getRandomVolumeName();
+    }
+
+    @Override
+    public Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone, boolean encryptEnabledOnly) {
+        Long offeringId = getDefaultCustomOfferingId(owner, zone);
+        if (offeringId != null) {
+            if (encryptEnabledOnly) {
+                DiskOfferingVO offering = _diskOfferingDao.findById(offeringId);
+                if (offering != null && offering.getEncrypt()) {
+                    return offeringId;
+                }
+            } else {
+                return offeringId;
+            }
+        }
+        List<DiskOfferingVO> offerings = _diskOfferingDao.listCustomDiskOfferings();
+        for (DiskOfferingVO offering : offerings) {
+            if (encryptEnabledOnly && !offering.getEncrypt()) {
+                continue;
+            }
+            try {
+                _configMgr.checkDiskOfferingAccess(owner, offering, zone);
+                return offering.getId();
+            } catch (PermissionDeniedException ignored) {}
+        }
+        return null;
     }
 
     /*
@@ -758,11 +769,20 @@ public String getVolumeNameFromCommand(CreateVolumeCmd cmd) {
     @DB
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", create = true)
     public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationException {
+        return allocVolume(cmd.getEntityOwnerId(), cmd.getZoneId(), cmd.getDiskOfferingId(), cmd.getVirtualMachineId(),
+                cmd.getSnapshotId(), getVolumeNameFromCommand(cmd.getVolumeName()), cmd.getSize(),
+                cmd.getDisplayVolume(), cmd.getMinIops(), cmd.getMaxIops(), cmd.getCustomId());
+    }
+
+    @Override
+    @DB
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", create = true)
+    public VolumeVO allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long vmId, Long snapshotId,
+            String name, Long cmdSize, Boolean displayVolume, Long cmdMinIops, Long cmdMaxIops, String customId)
+            throws ResourceAllocationException {
         Account caller = CallContext.current().getCallingAccount();
 
-        long ownerId = cmd.getEntityOwnerId();
         Account owner = _accountMgr.getActiveAccountById(ownerId);
-        Boolean displayVolume = cmd.getDisplayVolume();
 
         // permission check
         _accountMgr.checkAccess(caller, null, true, _accountMgr.getActiveAccountById(ownerId));
@@ -775,8 +795,6 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
             }
         }
 
-        Long zoneId = cmd.getZoneId();
-        Long diskOfferingId = null;
         DiskOfferingVO diskOffering = null;
         Long size = null;
         Long minIops = null;
@@ -785,13 +803,13 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
         VolumeVO parentVolume = null;
 
         // validate input parameters before creating the volume
-        if (cmd.getSnapshotId() == null && cmd.getDiskOfferingId() == null) {
+        if (snapshotId == null && diskOfferingId == null) {
             throw new InvalidParameterValueException("At least one of disk Offering ID or snapshot ID must be passed whilst creating volume");
         }
 
         // disallow passing disk offering ID with DATA disk volume snapshots
-        if (cmd.getSnapshotId() != null && cmd.getDiskOfferingId() != null) {
-            SnapshotVO snapshot = _snapshotDao.findById(cmd.getSnapshotId());
+        if (snapshotId != null && diskOfferingId != null) {
+            SnapshotVO snapshot = _snapshotDao.findById(snapshotId);
             if (snapshot != null) {
                 parentVolume = _volsDao.findByIdIncludingRemoved(snapshot.getVolumeId());
                 if (parentVolume != null && parentVolume.getVolumeType() != Volume.Type.ROOT)
@@ -801,10 +819,8 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
         }
 
         Map<String, String> details = new HashMap<>();
-        if (cmd.getDiskOfferingId() != null) { // create a new volume
-
-            diskOfferingId = cmd.getDiskOfferingId();
-            size = cmd.getSize();
+        if (diskOfferingId != null) { // create a new volume
+            size = cmdSize;
             Long sizeInGB = size;
             if (size != null) {
                 if (size > 0) {
@@ -850,8 +866,8 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
 
             if (isCustomizedIops != null) {
                 if (isCustomizedIops) {
-                    minIops = cmd.getMinIops();
-                    maxIops = cmd.getMaxIops();
+                    minIops = cmdMinIops;
+                    maxIops = cmdMaxIops;
 
                     if (minIops == null && maxIops == null) {
                         minIops = 0L;
@@ -883,8 +899,7 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
             }
         }
 
-        if (cmd.getSnapshotId() != null) { // create volume from snapshot
-            Long snapshotId = cmd.getSnapshotId();
+        if (snapshotId != null) { // create volume from snapshot
             SnapshotVO snapshotCheck = _snapshotDao.findById(snapshotId);
             if (snapshotCheck == null) {
                 throw new InvalidParameterValueException("unable to find a snapshot with id " + snapshotId);
@@ -935,7 +950,6 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
 
             // one step operation - create volume in VM's cluster and attach it
             // to the VM
-            Long vmId = cmd.getVirtualMachineId();
             if (vmId != null) {
                 // Check that the virtual machine ID is valid and it's a user vm
                 UserVmVO vm = _userVmDao.findById(vmId);
@@ -983,10 +997,10 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
                 throw new InvalidParameterValueException("Zone is not configured to use local storage but volume's disk offering " + diskOffering.getName() + " uses it");
             }
 
-            String userSpecifiedName = getVolumeNameFromCommand(cmd);
+            String userSpecifiedName = getVolumeNameFromCommand(name);
 
-            return commitVolume(cmd.getSnapshotId(), caller, owner, displayVolume, zoneId, diskOfferingId, provisioningType, size, minIops, maxIops, parentVolume, userSpecifiedName,
-                    _uuidMgr.generateUuid(Volume.class, cmd.getCustomId()), details);
+            return commitVolume(snapshotId, caller, owner, displayVolume, zoneId, diskOfferingId, provisioningType, size, minIops, maxIops, parentVolume, userSpecifiedName,
+                    _uuidMgr.generateUuid(Volume.class, customId), details);
         } finally {
             ReservationHelper.closeAll(reservations);
         }
@@ -1106,25 +1120,33 @@ private VolumeVO createVolumeOnStoragePool(Long volumeId, Long storageId) throws
     @DB
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", async = true)
     public VolumeVO createVolume(CreateVolumeCmd cmd) {
-        VolumeVO volume = _volsDao.findById(cmd.getEntityId());
+        return createVolume(cmd.getEntityId(), cmd.getVirtualMachineId(), cmd.getSnapshotId(), cmd.getStorageId(),
+                cmd.getDisplayVolume());
+    }
+
+    @Override
+    @DB
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", async = true)
+    public VolumeVO createVolume(long volumeId, Long vmId, Long snapshotId, Long storageId, Boolean display) {
+        VolumeVO volume = _volsDao.findById(volumeId);
         boolean created = true;
 
         try {
-            if (cmd.getSnapshotId() != null) {
-                volume = createVolumeFromSnapshot(volume, cmd.getSnapshotId(), cmd.getVirtualMachineId());
+            if (snapshotId != null) {
+                volume = createVolumeFromSnapshot(volume, snapshotId, vmId);
                 if (volume.getState() != Volume.State.Ready) {
                     created = false;
                 }
 
                 // if VM Id is provided, attach the volume to the VM
-                if (cmd.getVirtualMachineId() != null) {
+                if (vmId != null) {
                     try {
-                        attachVolumeToVM(cmd.getVirtualMachineId(), volume.getId(), volume.getDeviceId(), false);
+                        attachVolumeToVM(vmId, volume.getId(), volume.getDeviceId(), false);
                     } catch (Exception ex) {
                         StringBuilder message = new StringBuilder("Volume: ");
                         message.append(volume.getUuid());
                         message.append(" created successfully, but failed to attach the newly created volume to VM: ");
-                        message.append(cmd.getVirtualMachineId());
+                        message.append(vmId);
                         message.append(" due to error: ");
                         message.append(ex.getMessage());
                         if (logger.isDebugEnabled()) {
@@ -1133,20 +1155,20 @@ public VolumeVO createVolume(CreateVolumeCmd cmd) {
                         throw new CloudRuntimeException(message.toString());
                     }
                 }
-            } else if (cmd.getStorageId() != null) {
-                volume = createVolumeOnStoragePool(cmd.getEntityId(), cmd.getStorageId());
+            } else if (storageId != null) {
+                volume = createVolumeOnStoragePool(volumeId, storageId);
             }
             return volume;
         } catch (Exception e) {
             created = false;
-            VolumeInfo vol = volFactory.getVolume(cmd.getEntityId());
+            VolumeInfo vol = volFactory.getVolume(volumeId);
             vol.stateTransit(Volume.Event.DestroyRequested);
             throw new CloudRuntimeException(String.format("Failed to create volume: %s", volume), e);
         } finally {
             if (!created) {
                 VolumeVO finalVolume = volume;
                 logger.trace("Decrementing volume resource count for account {} as volume failed to create on the backend", () -> _accountMgr.getAccount(finalVolume.getAccountId()));
-                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), cmd.getDisplayVolume(),
+                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), display,
                         volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
             }
         }
@@ -1817,6 +1839,11 @@ private void expungeVolumesInPrimaryOrSecondary(VolumeVO volume, DataStoreRole r
             if (DataStoreRole.Image.equals(role)) {
                 _resourceLimitMgr.decrementResourceCount(volOnStorage.getAccountId(), ResourceType.secondary_storage, volOnStorage.getSize());
             }
+
+            // Clean up CLVM lock host tracking detail after successful deletion from primary storage
+            if (DataStoreRole.Primary.equals(role)) {
+                clvmPoolManager.clearClvmLockHostDetail(volume);
+            }
         }
     }
 
@@ -2719,21 +2746,42 @@ private Volume orchestrateAttachVolumeToVM(Long vmId, Long volumeId, Long device
             logger.trace(String.format("is it needed to move the volume: %b?", moveVolumeNeeded));
         }
 
-        if (moveVolumeNeeded) {
+        // Check if CLVM lock transfer is needed (even if moveVolumeNeeded is false)
+        // This handles the case where the volume is already on the correct storage pool
+        // but the VM is running on a different host, requiring only a lock transfer
+        boolean isClvmLockTransferNeeded = !moveVolumeNeeded &&
+                isClvmLockTransferRequired(newVolumeOnPrimaryStorage, existingVolumeOfVm, vm);
+
+        if (isClvmLockTransferNeeded) {
+            // CLVM lock transfer - no data copy, no pool change needed
+            newVolumeOnPrimaryStorage = executeLightweightLockMigration(
+                    newVolumeOnPrimaryStorage, vm, existingVolumeOfVm,
+                    "CLVM lock transfer", "same pool to different host");
+        } else if (moveVolumeNeeded) {
             PrimaryDataStoreInfo primaryStore = (PrimaryDataStoreInfo)newVolumeOnPrimaryStorage.getDataStore();
             if (primaryStore.isLocal()) {
                 throw new CloudRuntimeException(
                         "Failed to attach local data volume " + volumeToAttach.getName() + " to VM " + vm.getDisplayName() + " as migration of local data volume is not allowed");
             }
-            StoragePoolVO vmRootVolumePool = _storagePoolDao.findById(existingVolumeOfVm.getPoolId());
 
-            try {
-                HypervisorType volumeToAttachHyperType = _volsDao.getHypervisorType(volumeToAttach.getId());
-                newVolumeOnPrimaryStorage = _volumeMgr.moveVolume(newVolumeOnPrimaryStorage, vmRootVolumePool.getDataCenterId(), vmRootVolumePool.getPodId(), vmRootVolumePool.getClusterId(),
-                        volumeToAttachHyperType);
-            } catch (ConcurrentOperationException | StorageUnavailableException e) {
-                logger.debug("move volume failed", e);
-                throw new CloudRuntimeException("move volume failed", e);
+            boolean isClvmLightweightMigration = isClvmLightweightMigrationNeeded(
+                    newVolumeOnPrimaryStorage, existingVolumeOfVm);
+
+            if (isClvmLightweightMigration) {
+                newVolumeOnPrimaryStorage = executeLightweightLockMigration(
+                        newVolumeOnPrimaryStorage, vm, existingVolumeOfVm,
+                        "CLVM lightweight migration", "different pools, same VG");
+            } else {
+                StoragePoolVO vmRootVolumePool = _storagePoolDao.findById(existingVolumeOfVm.getPoolId());
+
+                try {
+                    HypervisorType volumeToAttachHyperType = _volsDao.getHypervisorType(volumeToAttach.getId());
+                    newVolumeOnPrimaryStorage = _volumeMgr.moveVolume(newVolumeOnPrimaryStorage, vmRootVolumePool.getDataCenterId(), vmRootVolumePool.getPodId(), vmRootVolumePool.getClusterId(),
+                            volumeToAttachHyperType);
+                } catch (ConcurrentOperationException | StorageUnavailableException e) {
+                    logger.debug("move volume failed", e);
+                    throw new CloudRuntimeException("move volume failed", e);
+                }
             }
         }
         VolumeVO newVol = _volsDao.findById(newVolumeOnPrimaryStorage.getId());
@@ -2748,6 +2796,185 @@ private Volume orchestrateAttachVolumeToVM(Long vmId, Long volumeId, Long device
         return newVol;
     }
 
+    /**
+     * Helper method to get storage pools for volume and VM.
+     *
+     * @param volumeToAttach The volume being attached
+     * @param vmExistingVolume The VM's existing volume
+     * @return Pair of StoragePoolVO objects (volumePool, vmPool), or null if either pool is missing
+     */
+    private Pair<StoragePoolVO, StoragePoolVO> getStoragePoolsForVolumeAttachment(VolumeInfo volumeToAttach, VolumeVO vmExistingVolume) {
+        if (volumeToAttach == null || vmExistingVolume == null) {
+            return null;
+        }
+
+        StoragePoolVO volumePool = _storagePoolDao.findById(volumeToAttach.getPoolId());
+        StoragePoolVO vmPool = _storagePoolDao.findById(vmExistingVolume.getPoolId());
+
+        if (volumePool == null || vmPool == null) {
+            return null;
+        }
+
+        return new Pair<>(volumePool, vmPool);
+    }
+
+    /**
+     * Determines if a CLVM volume needs lightweight lock migration instead of full data copy.
+     *
+     * Lightweight migration is needed when:
+     * 1. Volume is on CLVM storage
+     * 2. Source and destination are in the same Volume Group
+     * 3. Only the host/lock needs to change (not the storage pool)
+     *
+     * @param volumeToAttach The volume being attached
+     * @param vmExistingVolume The VM's existing volume (typically root volume)
+     * @param vm The VM to attach the volume to
+     * @return true if lightweight CLVM lock migration should be used
+     */
+    private boolean isClvmLightweightMigrationNeeded(VolumeInfo volumeToAttach, VolumeVO vmExistingVolume) {
+        Pair<StoragePoolVO, StoragePoolVO> pools = getStoragePoolsForVolumeAttachment(volumeToAttach, vmExistingVolume);
+        if (pools == null) {
+            return false;
+        }
+
+        StoragePoolVO volumePool = pools.first();
+        StoragePoolVO vmPool = pools.second();
+
+        return volService.isLightweightMigrationNeeded(volumePool.getPoolType(), vmPool.getPoolType(),
+                volumePool.getPath(), vmPool.getPath());
+    }
+
+    /**
+     * Determines if a CLVM volume requires lock transfer when already on the correct storage pool.
+     *
+     * Lock transfer is needed when:
+     * 1. Volume is already on the same CLVM storage pool as VM's volumes
+     * 2. But the volume lock is held by a different host than where the VM is running
+     * 3. Only the lock needs to change (no pool change, no data copy)
+     *
+     * @param volumeToAttach The volume being attached
+     * @param vmExistingVolume The VM's existing volume (typically root volume)
+     * @param vm The VM to attach the volume to
+     * @return true if CLVM lock transfer is needed (but not full migration)
+     */
+    private boolean isClvmLockTransferRequired(VolumeInfo volumeToAttach, VolumeVO vmExistingVolume, UserVmVO vm) {
+        if (vm == null) {
+            return false;
+        }
+
+        Pair<StoragePoolVO, StoragePoolVO> pools = getStoragePoolsForVolumeAttachment(volumeToAttach, vmExistingVolume);
+        if (pools == null) {
+            return false;
+        }
+
+        StoragePoolVO volumePool = pools.first();
+        StoragePoolVO vmPool = pools.second();
+
+        Long vmHostId = vm.getHostId();
+        if (vmHostId == null) {
+            vmHostId = vm.getLastHostId();
+        }
+
+        return volService.isLockTransferRequired(volumeToAttach, volumePool.getPoolType(), vmPool.getPoolType(),
+                volumePool.getId(), vmPool.getId(), vmHostId);
+    }
+
+    /**
+     * Determines the destination host for CLVM lock migration.
+     *
+     * If VM is running, uses the VM's current host.
+     * If VM is stopped, picks an available UP host from the storage pool's cluster.
+     *
+     * @param vm The VM
+     * @param vmExistingVolume The VM's existing volume (to determine cluster)
+     * @return Host ID, or null if cannot be determined
+     */
+    private Long determineClvmLockDestinationHost(UserVmVO vm, VolumeVO vmExistingVolume) {
+        Long destHostId = vm.getHostId();
+        if (destHostId != null) {
+            return destHostId;
+        }
+
+        if (vmExistingVolume == null || vmExistingVolume.getPoolId() == null) {
+            return null;
+        }
+        StoragePoolVO pool = _storagePoolDao.findById(vmExistingVolume.getPoolId());
+        if (pool == null || pool.getClusterId() == null) {
+            return null;
+        }
+        List<HostVO> hosts = _hostDao.findByClusterId(pool.getClusterId());
+        if (hosts == null || hosts.isEmpty()) {
+            return null;
+        }
+        // Pick first available UP host
+        for (HostVO host : hosts) {
+            if (host.getStatus() == Status.Up) {
+                destHostId = host.getId();
+                logger.debug("VM {} is stopped, selected host {} from cluster {} for CLVM lock migration",
+                        vm.getUuid(), destHostId, pool.getClusterId());
+                return destHostId;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Executes CLVM lightweight migration with consistent logging and error handling.
+     *
+     * This helper method wraps the actual migration logic to eliminate code duplication
+     * between different CLVM migration scenarios (lock transfer vs. lightweight migration).
+     *
+     * @param volume The volume to migrate locks for
+     * @param vm The VM to attach the volume to
+     * @param vmExistingVolume The VM's existing volume (to determine target host)
+     * @param operationType Description of the operation type for logging (e.g., "CLVM lock transfer")
+     * @param scenarioDescription Description of the scenario for logging (e.g., "same pool to different host")
+     * @return Updated VolumeInfo after lock migration
+     * @throws CloudRuntimeException if migration fails
+     */
+    private VolumeInfo executeLightweightLockMigration(VolumeInfo volume, UserVmVO vm, VolumeVO vmExistingVolume,
+                                                        String operationType, String scenarioDescription) {
+        logger.info("Performing {} for volume {} to VM {} ({})",
+                operationType, volume.getUuid(), vm.getUuid(), scenarioDescription);
+
+        try {
+            return performLightweightLockMigration(volume, vm, vmExistingVolume);
+        } catch (Exception e) {
+            logger.error("{} failed for volume {}: {}",
+                    operationType, volume.getUuid(), e.getMessage(), e);
+            throw new CloudRuntimeException(operationType + " failed", e);
+        }
+    }
+
+    /**
+     * Performs lightweight CLVM lock migration for volume attachment.
+     * Delegates to VolumeService for the actual lock migration.
+     *
+     * @param volume The volume to migrate locks for
+     * @param vm The VM to attach the volume to
+     * @param vmExistingVolume The VM's existing volume (to determine target host)
+     * @return Updated VolumeInfo after lock migration
+     * @throws Exception if lock migration fails
+     */
+    private VolumeInfo performLightweightLockMigration(VolumeInfo volume, UserVmVO vm, VolumeVO vmExistingVolume) throws CloudRuntimeException {
+        Long destHostId = determineClvmLockDestinationHost(vm, vmExistingVolume);
+
+        if (destHostId == null) {
+            throw new CloudRuntimeException(
+                "Cannot determine destination host for CLVM lock migration - VM has no host and no available cluster hosts");
+        }
+
+        try {
+            return volService.performLockMigration(volume, destHostId);
+        } catch (CloudRuntimeException e) {
+            logger.error("CLVM lock migration failed for volume {}: {}", volume.getUuid(), e.getMessage(), e);
+            throw e;
+        }
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_ATTACH, eventDescription = "attaching volume", async = true)
     public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS) {
         Account caller = CallContext.current().getCallingAccount();
 
@@ -3883,7 +4110,8 @@ public boolean doesStoragePoolSupportDiskOfferingTags(StoragePool destPool, Stri
 
         boolean result;
         if (storagePoolTags.second()) {
-            result =  TagAsRuleHelper.interpretTagAsRule(storageTagsList.get(0), diskOfferingTags, storageTagRuleExecutionTimeout.value());
+            result =  GenericRuleHelper.interpretTagAsRule(storageTagsList.get(0), diskOfferingTags, storageTagRuleExecutionTimeout.value(),
+                    storageTagRuleExecutionTimeout.key());
         } else {
             result = CollectionUtils.isSubCollection(Arrays.asList(newDiskOfferingTagsAsStringArray), storageTagsList);
         }
diff --git a/server/src/main/java/com/cloud/storage/clvm/ClvmPoolManager.java b/server/src/main/java/com/cloud/storage/clvm/ClvmPoolManager.java
new file mode 100644
index 000000000000..febef471e683
--- /dev/null
+++ b/server/src/main/java/com/cloud/storage/clvm/ClvmPoolManager.java
@@ -0,0 +1,485 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.cloud.storage.clvm;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+import javax.inject.Inject;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+import com.cloud.storage.StoragePool;
+import com.cloud.storage.VolumeDetailVO;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferAnswer;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+@Component
+public class ClvmPoolManager implements Configurable {
+    @Inject
+    private VolumeDetailsDao _volsDetailsDao;
+    @Inject
+    private AgentManager _agentMgr;
+    @Inject
+    private HostDao _hostDao;
+
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    /**
+     * Constant for the volume detail key that stores the host ID currently holding the CLVM exclusive lock.
+     * This is used during lightweight lock migration to determine the source host for lock transfer.
+     */
+    public static final String CLVM_LOCK_HOST_ID = "clvmLockHostId";
+
+    public static final ConfigKey<Boolean> CLVMSecureZeroFill = new ConfigKey<>("Advanced", Boolean.class, "clvm.secure.zero.fill", "false",
+            "When enabled, CLVM volumes to be zero-filled at the time of deletion to prevent data from being recovered by VMs reusing the space, as thick LVM volumes write data linearly. Note: This setting is propagated to hosts when they connect to the storage pool. Changing this setting requires disconnecting and reconnecting hosts or restarting the KVM agent for it to take effect.", false, ConfigKey.Scope.StoragePool);
+
+    public static boolean isClvmPoolType(Storage.StoragePoolType poolType) {
+        return Arrays.asList(Storage.StoragePoolType.CLVM, Storage.StoragePoolType.CLVM_NG).contains(poolType);
+    }
+
+    /**
+     * Gets the CLVM lock host ID for a volume, optionally querying actual LVM state.
+     *
+     * @param volumeId The volume ID
+     * @param volumeUuid The volume UUID
+     * @return Host ID that holds the lock, or null if not found
+     * @deprecated Use getClvmLockHostId(volumeId, volumeUuid, volumePath, pool, queryActual) instead
+     */
+    public Long getClvmLockHostId(Long volumeId, String volumeUuid) {
+        VolumeDetailVO detail = _volsDetailsDao.findDetail(volumeId, CLVM_LOCK_HOST_ID);
+        if (detail != null && detail.getValue() != null && !detail.getValue().isEmpty()) {
+            try {
+                return Long.parseLong(detail.getValue());
+            } catch (NumberFormatException e) {
+                logger.warn("Invalid clvmLockHostId in volume_details for volume {}: {}",
+                        volumeUuid, detail.getValue());
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Gets the CLVM lock host ID for a volume, optionally querying actual LVM state.
+     * This method can query the actual lock state from LVM (source of truth) instead of
+     * relying solely on potentially stale database records.
+     *
+     * @param volumeId The volume ID
+     * @param volumeUuid The volume UUID
+     * @param volumePath The LV path (required if queryActual is true)
+     * @param pool The storage pool (required if queryActual is true)
+     * @param queryActual If true, queries actual LVM state instead of database
+     * @return Host ID that holds the lock, or null if not found
+     */
+    public Long getClvmLockHostId(Long volumeId, String volumeUuid, String volumePath,
+                                  StoragePool pool, boolean queryActual) {
+        if (queryActual) {
+            if (volumePath == null || pool == null) {
+                logger.warn("Cannot query actual CLVM lock state for volume {} - missing volumePath or pool", volumeUuid);
+                return getClvmLockHostId(volumeId, volumeUuid);
+            }
+            return queryCurrentLockHolder(volumeId, volumeUuid, volumePath, pool, true);
+        }
+
+        return getClvmLockHostId(volumeId, volumeUuid);
+    }
+
+    /**
+     * Safely sets or updates the CLVM_LOCK_HOST_ID detail for a volume.
+     * If the detail already exists, it will be updated. Otherwise, it will be created.
+     *
+     * @param volumeId The ID of the volume
+     * @param hostId The host ID that holds/should hold the CLVM exclusive lock
+     */
+    public void setClvmLockHostId(long volumeId, long hostId) {
+        VolumeDetailVO existingDetail = _volsDetailsDao.findDetail(volumeId, CLVM_LOCK_HOST_ID);
+        if (existingDetail != null) {
+            existingDetail.setValue(String.valueOf(hostId));
+            _volsDetailsDao.update(existingDetail.getId(), existingDetail);
+            logger.debug("Updated CLVM_LOCK_HOST_ID for volume {} to host {}", volumeId, hostId);
+            return;
+        }
+        _volsDetailsDao.addDetail(volumeId, CLVM_LOCK_HOST_ID, String.valueOf(hostId), false);
+        logger.debug("Created CLVM_LOCK_HOST_ID for volume {} with host {}", volumeId, hostId);
+    }
+
+    /**
+     * Query LVM to find the actual current lock holder for a volume.
+     * This is the SOURCE OF TRUTH - it queries the actual LVM state via sanlock/lvmlockd.
+     *
+     * <p>If no host holds the exclusive lock (e.g. after a storage outage), this method attempts
+     * an exclusive activation on the best available host before giving up. Activation failure
+     * is non-fatal: the method returns null so callers can apply their own fallback logic.
+     *
+     * @param volumeId The volume ID
+     * @param volumeUuid The volume UUID
+     * @param volumePath The LV path (e.g., "vm-123-disk-0")
+     * @param pool The storage pool
+     * @param updateDatabase If true, persists the discovered or newly-activated lock host to the DB
+     * @return Host ID of current or newly-activated lock holder, or null if none found/activated
+     */
+    public Long queryCurrentLockHolder(Long volumeId, String volumeUuid, String volumePath,
+                                       StoragePool pool, boolean updateDatabase) {
+        if (pool == null) {
+            logger.error("Cannot query CLVM lock for volume {} - pool is null", volumeUuid);
+            return null;
+        }
+
+        String vgName = pool.getPath();
+        if (vgName.startsWith("/")) {
+            vgName = vgName.substring(1);
+        }
+        String lvPath = String.format("/dev/%s/%s", vgName, volumePath);
+
+        // Fast path: trust the DB record and verify with a single host query
+        Long dbHostId = getClvmLockHostId(volumeId, volumeUuid);
+        if (dbHostId != null) {
+            HostVO dbHost = _hostDao.findById(dbHostId);
+            if (dbHost != null && dbHost.getStatus() == Status.Up
+                    && dbHost.getHypervisorType() == Hypervisor.HypervisorType.KVM) {
+                Boolean active = querySingleHostLockState(dbHostId, lvPath, volumeUuid);
+                if (Boolean.TRUE.equals(active)) {
+                    logger.debug("Fast path: volume {} confirmed active on DB host {}", volumeUuid, dbHostId);
+                    return dbHostId;
+                }
+                logger.info("Fast path miss: volume {} not active on DB host {} - falling back to full fan-out",
+                        volumeUuid, dbHostId);
+            } else {
+                logger.info("Fast path skip: DB host {} for volume {} is down/missing — falling back to full fan-out",
+                        dbHostId, volumeUuid);
+            }
+        }
+
+        List<HostVO> hosts = null;
+        Long clusterId = pool.getClusterId();
+        if (clusterId != null) {
+            hosts = _hostDao.findByClusterId(clusterId, Host.Type.Routing);
+        } else if (pool.getDataCenterId() > 0) {
+            hosts = _hostDao.findByDataCenterId(pool.getDataCenterId());
+        }
+        if (hosts == null || hosts.isEmpty()) {
+            logger.warn("No KVM routing hosts found to query CLVM lock state for volume {} (pool: {}, cluster: {}, zone: {})",
+                    volumeUuid, pool.getName(), clusterId, pool.getDataCenterId());
+            return null;
+        }
+
+        List<Long> activeHostIds = new ArrayList<>();
+
+        for (HostVO host : hosts) {
+            if (host.getStatus() != Status.Up ||
+                host.getType() != Host.Type.Routing ||
+                host.getHypervisorType() != Hypervisor.HypervisorType.KVM) {
+                continue;
+            }
+            // Skip the DB host, already confirmed inactive in the fast path above
+            if (dbHostId != null && host.getId() == dbHostId) {
+                continue;
+            }
+
+            Boolean active = querySingleHostLockState(host.getId(), lvPath, volumeUuid);
+            if (Boolean.TRUE.equals(active)) {
+                logger.debug("Volume {} is locally active on host {} (fan-out)", volumeUuid, host.getId());
+                activeHostIds.add(host.getId());
+            }
+        }
+
+        if (activeHostIds.isEmpty()) {
+            logger.debug("Volume {} is not active on any reachable host — no exclusive lock held", volumeUuid);
+
+            // Recovery: attempt exclusive activation on the best available host before giving up.
+            Long targetHostId = selectActivationTargetHost(dbHostId, hosts);
+            if (targetHostId != null) {
+                Long recoveredHostId = tryActivateExclusivelyOnHost(volumeId, volumeUuid, lvPath,
+                        targetHostId, updateDatabase);
+                if (recoveredHostId != null) {
+                    return recoveredHostId;
+                }
+            }
+
+            // Activation failed or no eligible host - clean up stale DB record and give up
+            if (updateDatabase && dbHostId != null) {
+                VolumeDetailVO detail = _volsDetailsDao.findDetail(volumeId, CLVM_LOCK_HOST_ID);
+                if (detail != null && String.valueOf(dbHostId).equals(detail.getValue())) {
+                    _volsDetailsDao.remove(detail.getId());
+                }
+            }
+            return null;
+        }
+
+        if (activeHostIds.size() > 1) {
+            logger.warn("Volume {} is active on {} hosts {}, shared-mode LV (template?). "
+                    + "Skipping exclusive lock transfer.",
+                    volumeUuid, activeHostIds.size(), activeHostIds);
+            return null;
+        }
+
+        Long lockHostId = activeHostIds.get(0);
+        logger.info("Volume {} is exclusively active on host {} (found via fan-out, DB had {})",
+                volumeUuid, lockHostId, dbHostId);
+
+        if (updateDatabase) {
+            if (dbHostId == null || !dbHostId.equals(lockHostId)) {
+                logger.info("Correcting database: volume {} lock host: {} -> {} (actual)",
+                        volumeUuid, dbHostId, lockHostId);
+                setClvmLockHostId(volumeId, lockHostId);
+            }
+        }
+
+        return lockHostId;
+    }
+
+    /**
+     * Queries a single host for the CLVM LV activation state.
+     *
+     * @return {@code Boolean.TRUE} if the LV is active on that host,
+     *         {@code Boolean.FALSE} if reachable but inactive,
+     *         {@code null} if the host is unreachable or returned an error
+     */
+    private Boolean querySingleHostLockState(Long hostId, String lvPath, String volumeUuid) {
+        try {
+            ClvmLockTransferCommand queryCmd = new ClvmLockTransferCommand(
+                    ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE, lvPath, volumeUuid);
+            Answer answer = _agentMgr.send(hostId, queryCmd);
+
+            if (answer == null || !answer.getResult()) {
+                logger.debug("Failed to query lock state from host {}: {}",
+                        hostId, answer != null ? answer.getDetails() : "null answer");
+                return null;
+            }
+            if (!(answer instanceof ClvmLockTransferAnswer)) {
+                logger.warn("Unexpected answer type from host {} for QUERY_LOCK_STATE: {}",
+                        hostId, answer.getClass());
+                return null;
+            }
+            ClvmLockTransferAnswer queryAnswer = (ClvmLockTransferAnswer) answer;
+            logger.debug("Host {} reports volume {} active={} (attr={})",
+                    hostId, volumeUuid, queryAnswer.isActive(), queryAnswer.getLvAttributes());
+            return queryAnswer.isActive();
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.debug("Could not query host {} for lock state: {}", hostId, e.getMessage());
+            return null;
+        }
+    }
+
+    /**
+     * Selects the best host on which to exclusively activate an inactive CLVM volume.
+     *
+     * <p>Priority 1: the last known lock holder ({@code clvmLockHostId} from DB), if that host
+     * is UP and KVM.
+     *
+     * <p>Priority 2: a random UP KVM routing host from the cluster/zone list (fallback).
+     *
+     * @param dbHostId last known lock holder host ID from the DB (may be null)
+     * @param hosts    routing hosts in the cluster or zone collected during fan-out
+     * @return host ID to activate on, or null if no eligible host found
+     */
+    private Long selectActivationTargetHost(Long dbHostId, List<HostVO> hosts) {
+        if (dbHostId != null) {
+            HostVO dbHost = _hostDao.findById(dbHostId);
+            if (dbHost != null && dbHost.getStatus() == Status.Up
+                    && dbHost.getHypervisorType() == Hypervisor.HypervisorType.KVM) {
+                logger.debug("selectActivationTargetHost: preferring DB host {} (last known lock holder)", dbHostId);
+                return dbHostId;
+            }
+        }
+        if (hosts != null) {
+            List<HostVO> eligible = hosts.stream()
+                    .filter(h -> h.getStatus() == Status.Up
+                            && h.getType() == Host.Type.Routing
+                            && h.getHypervisorType() == Hypervisor.HypervisorType.KVM)
+                    .collect(Collectors.toList());
+            if (!eligible.isEmpty()) {
+                Collections.shuffle(eligible);
+                HostVO chosen = eligible.get(0);
+                logger.debug("selectActivationTargetHost: falling back to random UP KVM host {} in cluster/zone",
+                        chosen.getId());
+                return chosen.getId();
+            }
+        }
+        logger.warn("selectActivationTargetHost: no eligible UP KVM host found");
+        return null;
+    }
+
+    /**
+     * Sends an {@code ACTIVATE_EXCLUSIVE} command to {@code targetHostId} and optionally
+     * persists the new lock host to the database.
+     *
+     * <p>Activation failure is non-fatal: returns null so the caller can apply its own fallback.
+     *
+     * @param volumeId       volume DB ID
+     * @param volumeUuid     volume UUID (for logging)
+     * @param lvPath         full LV device path, e.g. {@code /dev/vgname/vol-path}
+     * @param targetHostId   host to activate on
+     * @param updateDatabase if true, persists the new lock host on success
+     * @return {@code targetHostId} on success, {@code null} if the command failed or threw
+     */
+    private Long tryActivateExclusivelyOnHost(Long volumeId, String volumeUuid, String lvPath,
+                                              Long targetHostId, boolean updateDatabase) {
+        try {
+            ClvmLockTransferCommand activateCmd = new ClvmLockTransferCommand(
+                    ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE, lvPath, volumeUuid);
+            Answer activateAnswer = _agentMgr.send(targetHostId, activateCmd);
+            if (activateAnswer != null && activateAnswer.getResult()) {
+                logger.info("Recovery: exclusively activated volume {} on host {} (was inactive on all hosts)",
+                        volumeUuid, targetHostId);
+                if (updateDatabase) {
+                    setClvmLockHostId(volumeId, targetHostId);
+                }
+                return targetHostId;
+            }
+            logger.warn("Recovery activation of volume {} on host {} failed: {}",
+                    volumeUuid, targetHostId,
+                    activateAnswer != null ? activateAnswer.getDetails() : "null answer");
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.warn("Recovery activation of volume {} on host {} threw exception: {}",
+                    volumeUuid, targetHostId, e.getMessage());
+        }
+        return null;
+    }
+
+    /**
+     * Cleans up CLVM lock host tracking detail from volume_details table.
+     * Called after successful volume deletion to prevent orphaned records.
+     *
+     * @param volume The volume being deleted
+     */
+    public void clearClvmLockHostDetail(VolumeVO volume) {
+        try {
+            VolumeDetailVO detail = _volsDetailsDao.findDetail(volume.getId(), CLVM_LOCK_HOST_ID);
+            if (detail != null) {
+                logger.debug("Removing CLVM lock host detail for deleted volume {}", volume.getUuid());
+                _volsDetailsDao.remove(detail.getId());
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to clean up CLVM lock host detail for volume {}: {}",
+                    volume.getUuid(), e.getMessage());
+        }
+    }
+
+    /**
+     * Transfers the CLVM exclusive lock for a volume from the source host to the destination host.
+     *
+     * @param volumeUuid   The volume UUID
+     * @param volumeId     The volume DB ID
+     * @param volumePath   The LV name within the VG (e.g. "vm-123-disk-0")
+     * @param pool         The storage pool
+     * @param sourceHostId The host currently holding the lock (pre-validated by caller)
+     * @param destHostId   The host that should hold the lock after transfer
+     * @return true if the lock was successfully transferred and activated on the destination
+     */
+    public boolean transferClvmVolumeLock(String volumeUuid, Long volumeId, String volumePath,
+                                          StoragePool pool, Long sourceHostId, Long destHostId) {
+        if (pool == null) {
+            logger.error("Cannot transfer CLVM lock for volume {} - pool is null", volumeUuid);
+            return false;
+        }
+
+        String vgName = pool.getPath();
+        if (vgName.startsWith("/")) {
+            vgName = vgName.substring(1);
+        }
+
+        String lvPath = String.format("/dev/%s/%s", vgName, volumePath);
+
+        try {
+            // sourceHostId is trusted as pre-validated by the caller
+            Long hostToDeactivate = sourceHostId;
+
+            logger.info("Transferring CLVM lock for volume {}: source={}, destination={}",
+                    volumeUuid, sourceHostId, destHostId);
+
+            if (hostToDeactivate != null && !hostToDeactivate.equals(destHostId)) {
+                HostVO deactivateHost = _hostDao.findById(hostToDeactivate);
+                if (deactivateHost != null && deactivateHost.getStatus() == Status.Up) {
+                    ClvmLockTransferCommand deactivateCmd = new ClvmLockTransferCommand(
+                            ClvmLockTransferCommand.Operation.DEACTIVATE, lvPath, volumeUuid);
+
+                    Answer deactivateAnswer = _agentMgr.send(hostToDeactivate, deactivateCmd);
+
+                    if (deactivateAnswer == null || !deactivateAnswer.getResult()) {
+                        logger.warn("Failed to deactivate CLVM volume {} on host {}. Will attempt activation on destination.",
+                                volumeUuid, hostToDeactivate);
+                    } else {
+                        logger.debug("Successfully deactivated volume {} on host {}", volumeUuid, hostToDeactivate);
+                    }
+                } else {
+                    logger.warn("Host {} (current lock holder) is down. Will attempt force claim on destination host {}",
+                            hostToDeactivate, destHostId);
+                }
+            } else if (hostToDeactivate == null) {
+                logger.debug("Volume {} has no active lock holder, will directly activate on destination", volumeUuid);
+            }
+
+            ClvmLockTransferCommand activateCmd = new ClvmLockTransferCommand(
+                    ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE,
+                    lvPath,
+                    volumeUuid
+            );
+
+            Answer activateAnswer = _agentMgr.send(destHostId, activateCmd);
+
+            if (activateAnswer == null || !activateAnswer.getResult()) {
+                String error = activateAnswer != null ? activateAnswer.getDetails() : "null answer";
+                logger.error("Failed to activate CLVM volume {} exclusively on dest host {}: {}",
+                        volumeUuid, destHostId, error);
+                return false;
+            }
+
+            setClvmLockHostId(volumeId, destHostId);
+
+            logger.info("Successfully transferred CLVM lock for volume {} from host {} to host {}",
+                    volumeUuid, sourceHostId != null ? sourceHostId : "none", destHostId);
+
+            return true;
+
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Exception during CLVM lock transfer for volume {}: {}", volumeUuid, e.getMessage(), e);
+            return false;
+        }
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return ClvmPoolManager.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey<?>[] {
+                CLVMSecureZeroFill
+        };
+    }
+}
diff --git a/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java b/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
index 67d5b091a032..5258f4337550 100644
--- a/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
+++ b/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
@@ -87,11 +87,6 @@ public boolean configure(String name, Map<String, Object> params) {
         final Map<String, String> configs = _configDao.getConfiguration("management-server", params);
         _proxy = configs.get(Config.SecStorageProxy.key());
 
-        String cert = configs.get("secstorage.ssl.cert.domain");
-        if (!"realhostip.com".equalsIgnoreCase(cert)) {
-            logger.warn("Only realhostip.com ssl cert is supported, ignoring self-signed and other certs");
-        }
-
         _copyAuthPasswd = configs.get("secstorage.copy.password");
 
         DownloadListener dl = new DownloadListener(this);
diff --git a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
index ce01048eaa56..dc33a4442a33 100755
--- a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
@@ -165,6 +165,7 @@
 import com.cloud.utils.DateUtil.IntervalType;
 import com.cloud.utils.NumbersUtil;
 import com.cloud.utils.Pair;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.utils.Ternary;
 import com.cloud.utils.concurrency.NamedThreadFactory;
 import com.cloud.utils.db.DB;
@@ -1633,6 +1634,8 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
         boolean isKvmAndFileBasedStorage = isHypervisorKvmAndFileBasedStorage(volume, storagePool);
         boolean backupSnapToSecondary = isBackupSnapshotToSecondaryForZone(volume.getDataCenterId());
 
+        StoragePoolType poolType = volume.getStoragePoolType();
+
         if (isKvmAndFileBasedStorage && backupSnapToSecondary) {
             DataStore imageStore = snapshotSrv.findSnapshotImageStore(snapshot);
             if (imageStore == null) {
@@ -1641,7 +1644,7 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
             snapshot.setImageStore(imageStore);
         }
 
-        updateSnapshotPayload(volume.getPoolId(), payload, isKvmAndFileBasedStorage, clusterId);
+        updateSnapshotPayload(volume.getPoolId(), payload, isKvmAndFileBasedStorage, poolType, clusterId);
 
         snapshot.addPayload(payload);
         try {
@@ -1659,6 +1662,9 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
             if (backupSnapToSecondary) {
                 if (!isKvmAndFileBasedStorage) {
                     backupSnapshotToSecondary(payload.getAsyncBackup(), snapshotStrategy, snapshotOnPrimary, payload.getZoneIds(), payload.getStoragePoolIds());
+                    if (!payload.getAsyncBackup() && ClvmPoolManager.isClvmPoolType(storagePool.getPoolType())) {
+                        _snapshotStoreDao.removeBySnapshotStore(snapshotId, snapshotOnPrimary.getDataStore().getId(), snapshotOnPrimary.getDataStore().getRole());
+                    }
                 } else {
                     postSnapshotDirectlyToSecondary(snapshot, snapshotOnPrimary, snapshotId);
                 }
@@ -1678,7 +1684,12 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
                 postCreateSnapshot(volume.getId(), snapshotId, payload.getSnapshotPolicyId(), clusterId);
                 snapshotZoneDao.addSnapshotToZone(snapshotId, snapshot.getDataCenterId());
 
-                DataStoreRole dataStoreRole = backupSnapToSecondary ? snapshotHelper.getDataStoreRole(snapshot) : DataStoreRole.Primary;
+                DataStoreRole dataStoreRole;
+                if (payload.getAsyncBackup() && backupSnapToSecondary && !isKvmAndFileBasedStorage) {
+                    dataStoreRole = DataStoreRole.Primary;
+                } else {
+                    dataStoreRole = backupSnapToSecondary ? snapshotHelper.getDataStoreRole(snapshot) : DataStoreRole.Primary;
+                }
 
                 List<SnapshotDataStoreVO> snapshotStoreRefs = _snapshotStoreDao.listReadyBySnapshot(snapshotId, dataStoreRole);
                 if (CollectionUtils.isEmpty(snapshotStoreRefs)) {
@@ -1816,6 +1827,7 @@ protected void runInContext() {
                     SnapshotInfo backupedSnapshot = snapshotStrategy.backupSnapshot(snapshotOnPrimary);
                     if (backupedSnapshot != null) {
                         snapshotStrategy.postSnapshotCreation(snapshotOnPrimary);
+                        removeClvmPrimarySnapshotStoreRefIfNeeded(snapshotOnPrimary);
                         copyNewSnapshotToZones(snapshotOnPrimary.getId(), snapshotOnPrimary.getDataCenterId(), zoneIds);
                     }
                 }
@@ -1841,7 +1853,15 @@ private void decriseBackupSnapshotAttempts() {
         }
     }
 
-    private void updateSnapshotPayload(long storagePoolId, CreateSnapshotPayload payload, boolean isKvmAndFileBasedStorage, Long clusterId) {
+    void removeClvmPrimarySnapshotStoreRefIfNeeded(SnapshotInfo snapshotOnPrimary) {
+        DataStore dataStore = snapshotOnPrimary.getDataStore();
+        StoragePoolVO pool = _storagePoolDao.findById(dataStore.getId());
+        if (pool != null && ClvmPoolManager.isClvmPoolType(pool.getPoolType())) {
+            _snapshotStoreDao.removeBySnapshotStore(snapshotOnPrimary.getId(), dataStore.getId(), dataStore.getRole());
+        }
+    }
+
+    private void updateSnapshotPayload(long storagePoolId, CreateSnapshotPayload payload, boolean isKvmAndFileBasedStorage, StoragePoolType poolType, Long clusterId) {
         StoragePoolVO storagePoolVO = _storagePoolDao.findById(storagePoolId);
 
         if (storagePoolVO.isManaged()) {
diff --git a/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java b/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
index 7962d9dced9c..a32790c135d2 100644
--- a/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
+++ b/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
@@ -231,8 +231,8 @@ public UploadVO createEntityDownloadURL(VMTemplateVO template, TemplateDataStore
             UploadVO upload = extractURLList.get(0);
             String uploadUrl = extractURLList.get(0).getUploadUrl();
             String[] token = uploadUrl.split("/");
-            // example: uploadUrl = https://10-11-101-112.realhostip.com/userdata/2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
-            // then token[2] = 10-11-101-112.realhostip.com, token[4] = 2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
+            // example: uploadUrl = https://10-11-101-112.example.com/userdata/2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
+            // then token[2] = 10-11-101-112.example.com, token[4] = 2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
             String hostname = ep.getPublicAddr().replace(".", "-") + ".";
             if ((token != null) && (token.length == 5) && (token[2].equals(hostname + _ssvmUrlDomain))) // ssvm publicip and domain suffix not changed
                 return extractURLList.get(0);
@@ -365,7 +365,9 @@ private String generateCopyUrl(String ipAddress, String uuid) {
             if (_ssvmUrlDomain != null && _ssvmUrlDomain.length() > 0) {
                 hostname = hostname + "." + _ssvmUrlDomain;
             } else {
-                hostname = hostname + ".realhostip.com";
+                logger.warn("SSL copy is enabled but secstorage.ssl.cert.domain is not configured; "
+                    + "using IP address directly. Configure a wildcard SSL certificate domain for proper HTTPS support.");
+                hostname = ipAddress;
             }
         }
         return scheme + "://" + hostname + "/userdata/" + uuid;
@@ -376,11 +378,6 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         final Map<String, String> configs = _configDao.getConfiguration("management-server", params);
         _sslCopy = Boolean.parseBoolean(configs.get("secstorage.encrypt.copy"));
 
-        String cert = configs.get("secstorage.secure.copy.cert");
-        if ("realhostip.com".equalsIgnoreCase(cert)) {
-            logger.warn("Only realhostip.com ssl cert is supported, ignoring self-signed and other certs");
-        }
-
         _ssvmUrlDomain = configs.get("secstorage.ssl.cert.domain");
 
         _agentMgr.registerForHostEvents(new UploadListener(this), true, false, false);
diff --git a/server/src/main/java/com/cloud/user/AccountManager.java b/server/src/main/java/com/cloud/user/AccountManager.java
index 98d2419e0486..eca1a571dd88 100644
--- a/server/src/main/java/com/cloud/user/AccountManager.java
+++ b/server/src/main/java/com/cloud/user/AccountManager.java
@@ -204,6 +204,8 @@ void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEntity> s
 
     void checkApiAccess(Account caller, String command, String apiKey);
 
+    void checkApiAccess(Account caller, String command);
+
     UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user);
 
     void verifyCallerPrivilegeForUserOrAccountOperations(Account userAccount);
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index 52ec26661c9d..c073b5437d77 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -1534,6 +1534,12 @@ public void checkApiAccess(Account caller, String command, String apiKey) {
         checkApiAccess(apiCheckers, caller, command, keyPairPermissions.toArray(new ApiKeyPairPermission[0]));
     }
 
+    @Override
+    public void checkApiAccess(Account caller, String command) {
+        List<APIChecker> apiCheckers = getEnabledApiCheckers();
+        checkApiAccess(apiCheckers, caller, command);
+    }
+
     @NotNull
     private List<APIChecker> getEnabledApiCheckers() {
         // we are really only interested in the dynamic access checker
@@ -2772,11 +2778,21 @@ public Account getActiveAccountById(long accountId) {
         return _accountDao.findById(accountId);
     }
 
+    @Override
+    public Account getActiveAccountByUuid(String accountUuid) {
+        return _accountDao.findByUuid(accountUuid);
+    }
+
     @Override
     public Account getAccount(long accountId) {
         return _accountDao.findByIdIncludingRemoved(accountId);
     }
 
+    @Override
+    public Account getAccountByUuid(String accountUuid) {
+        return _accountDao.findByUuidIncludingRemoved(accountUuid);
+    }
+
     @Override
     public RoleType getRoleType(Account account) {
         if (account == null) {
@@ -2790,6 +2806,15 @@ public User getActiveUser(long userId) {
         return _userDao.findById(userId);
     }
 
+    @Override
+    public User getOneActiveUserForAccount(Account account) {
+        List<UserVO> users = _userDao.listByAccount(account.getId());
+        if (CollectionUtils.isEmpty(users)) {
+            return null;
+        }
+        return users.get(0);
+    }
+
     @Override
     public User getUserIncludingRemoved(long userId) {
         return _userDao.findByIdIncludingRemoved(userId);
diff --git a/server/src/main/java/com/cloud/vm/UserVmManager.java b/server/src/main/java/com/cloud/vm/UserVmManager.java
index 300803bfa986..543da444706b 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManager.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManager.java
@@ -16,13 +16,14 @@
 // under the License.
 package com.cloud.vm;
 
+import static com.cloud.user.ResourceLimitService.ResourceLimitHostTags;
+
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import com.cloud.utils.StringUtils;
 import org.apache.cloudstack.api.BaseCmd.HTTPMethod;
 import org.apache.cloudstack.framework.config.ConfigKey;
 
@@ -40,8 +41,7 @@
 import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.uservm.UserVm;
 import com.cloud.utils.Pair;
-
-import static com.cloud.user.ResourceLimitService.ResourceLimitHostTags;
+import com.cloud.utils.StringUtils;
 
 /**
  *
@@ -210,5 +210,4 @@ static Set<String> getStrictHostTags() {
      * @return true if the VM is part of a CKS cluster, false otherwise.
      */
     boolean isVMPartOfAnyCKSCluster(VMInstanceVO vm);
-
 }
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index bb55f570927b..5126c4023c5a 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -313,8 +313,8 @@
 import com.cloud.resource.ResourceManager;
 import com.cloud.resource.ResourceState;
 import com.cloud.resourcelimit.CheckedReservation;
-import com.cloud.resourcelimit.ReservationHelper;
 import com.cloud.serializer.GsonHelper;
+import com.cloud.resourcelimit.ReservationHelper;
 import com.cloud.server.ManagementService;
 import com.cloud.server.ResourceTag;
 import com.cloud.service.ServiceOfferingVO;
@@ -322,8 +322,10 @@
 import com.cloud.service.dao.ServiceOfferingDetailsDao;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.GuestOS;
 import com.cloud.storage.GuestOSCategoryVO;
 import com.cloud.storage.GuestOSVO;
+import com.cloud.storage.LaunchPermissionVO;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Snapshot;
 import com.cloud.storage.SnapshotPolicyVO;
@@ -341,9 +343,11 @@
 import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeApiService;
 import com.cloud.storage.VolumeVO;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.GuestOSCategoryDao;
 import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.LaunchPermissionDao;
 import com.cloud.storage.dao.SnapshotDao;
 import com.cloud.storage.dao.SnapshotPolicyDao;
 import com.cloud.storage.dao.VMTemplateDao;
@@ -424,6 +428,7 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
 
     private static final long GiB_TO_BYTES = 1024 * 1024 * 1024;
 
+
     @Inject
     private EntityManager _entityMgr;
     @Inject
@@ -620,6 +625,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     BackupScheduleDao backupScheduleDao;
     @Inject
+    LaunchPermissionDao launchPermissionDao;
+    @Inject
     private UserDataDao userDataDao;
     @Inject
     protected SnapshotHelper snapshotHelper;
@@ -645,6 +652,9 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     ExtensionHelper extensionHelper;
 
+    @Inject
+    ClvmPoolManager clvmPoolManager;
+
     private ScheduledExecutorService _executor = null;
     private ScheduledExecutorService _vmIpFetchExecutor = null;
     private int _expungeInterval;
@@ -1499,11 +1509,8 @@ public UserVm addNicToVirtualMachine(AddNicToVMCmd cmd) throws InvalidParameterV
         // Perform permission check on VM
         _accountMgr.checkAccess(caller, null, true, vmInstance);
 
-        // Verify that zone is not Basic
         DataCenterVO dc = _dcDao.findById(vmInstance.getDataCenterId());
-        if (dc.getNetworkType() == DataCenter.NetworkType.Basic) {
-            throw new CloudRuntimeException(String.format("Zone %s, has a NetworkType of Basic. Can't add a new NIC to a Instance on a Basic Network", dc));
-        }
+        validateVmZoneTypeForAddNic(vmInstance, dc);
 
         //ensure network belongs in zone
         if (network.getDataCenterId() != vmInstance.getDataCenterId()) {
@@ -1552,6 +1559,16 @@ public UserVm addNicToVirtualMachine(AddNicToVMCmd cmd) throws InvalidParameterV
         return _vmDao.findById(vmInstance.getId());
     }
 
+    private void validateVmZoneTypeForAddNic(UserVmVO vmInstance, DataCenter dc) {
+        if (!NetworkType.Basic.equals(dc.getNetworkType())) {
+            return;
+        }
+        if (_nicDao.countByVmId(vmInstance.getId()) == 0) {
+            return;
+        }
+        throw new CloudRuntimeException(String.format("Zone %s, has a NetworkType of Basic. Can't add a new NIC to a Instance on a Basic Network", dc));
+    }
+
     /**
      * Set NIC as default if VM has no default NIC
      * @param vmInstance VM instance to be checked
@@ -2365,9 +2382,9 @@ public HashMap<String, VolumeStatsEntry> getVolumeStatistics(long clusterId, Str
     }
 
     private List<String> getVolumesByHost(HostVO host, StoragePool pool) {
-        List<VMInstanceVO> vmsPerHost = _vmInstanceDao.listByHostId(host.getId());
+        List<Long> vmsPerHost = _vmInstanceDao.listIdsByHostIdForVolumeStats(host.getId());
         return vmsPerHost.stream()
-                .flatMap(vm -> _volsDao.findNonDestroyedVolumesByInstanceIdAndPoolId(vm.getId(),pool.getId()).stream().map(vol ->
+                .flatMap(vmId -> _volsDao.findNonDestroyedVolumesByInstanceIdAndPoolId(vmId,pool.getId()).stream().map(vol ->
                 vol.getState() == Volume.State.Ready ? (vol.getFormat() == ImageFormat.OVA ? vol.getChainInfo() : vol.getPath()) : null).filter(Objects::nonNull))
                 .collect(Collectors.toList());
     }
@@ -2532,7 +2549,6 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         _scaleRetry = NumbersUtil.parseInt(configs.get(Config.ScaleRetry.key()), 2);
 
         _vmIpFetchThreadExecutor = Executors.newFixedThreadPool(VmIpFetchThreadPoolMax.value(), new NamedThreadFactory("vmIpFetchThread"));
-
         logger.info("User VM Manager is configured.");
 
         return true;
@@ -2605,6 +2621,9 @@ public boolean expunge(UserVmVO vm) {
             List<VolumeVO> rootVol = _volsDao.findByInstanceAndType(vm.getId(), Volume.Type.ROOT);
             // expunge the vm
             _itMgr.advanceExpunge(vm.getUuid());
+            for (VolumeVO volume : rootVol) {
+                clvmPoolManager.clearClvmLockHostDetail(volume);
+            }
 
             // Only if vm is not expunged already, cleanup it's resources
             if (vm.getRemoved() == null) {
@@ -3574,6 +3593,7 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         CallContext ctx = CallContext.current();
         long vmId = cmd.getId();
         boolean expunge = cmd.getExpunge();
+        boolean forced = cmd.isForced();
 
         if (expunge) {
             String jobParamsString = ((AsyncJobVO) cmd.getJob()).getCmdInfo();
@@ -3588,26 +3608,13 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         if (vm == null || vm.getRemoved() != null) {
             throw new InvalidParameterValueException("unable to find a virtual machine with id " + vmId);
         }
-        if (UserVmManager.SHAREDFSVM.equals(vm.getUserVmType())) {
-            throw new InvalidParameterValueException("Operation not supported on Shared FileSystem Instance");
-        }
 
         if (Arrays.asList(State.Destroyed, State.Expunging).contains(vm.getState()) && !expunge) {
             logger.debug("Vm {} is already destroyed", vm);
             return vm;
         }
 
-        if (vm.isDeleteProtection()) {
-            throw new InvalidParameterValueException(String.format(
-                    "Instance [id = %s, name = %s] has delete protection enabled and cannot be deleted.",
-                    vm.getUuid(), vm.getName()));
-        }
-
-        // check if vm belongs to AutoScale vm group in Disabled state
-        autoScaleManager.checkIfVmActionAllowed(vmId);
-
-        // check if vm belongs to any plugin resources
-        checkPluginsIfVmCanBeDestroyed(vm);
+        validateVmDestroyAllowed(vm, forced);
 
         // check if there are active volume snapshots tasks
         logger.debug("Checking if there are any ongoing Snapshots on the ROOT volumes associated with Instance {}", vm);
@@ -3666,6 +3673,26 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         return destroyedVm;
     }
 
+    private void validateVmDestroyAllowed(UserVmVO vm, boolean forced) {
+        if (forced) {
+            return;
+        }
+        if (UserVmManager.SHAREDFSVM.equals(vm.getUserVmType())) {
+            throw new InvalidParameterValueException("Operation not supported on Shared FileSystem Instance");
+        }
+        if (vm.isDeleteProtection()) {
+            throw new InvalidParameterValueException(String.format(
+                    "Instance [id = %s, name = %s] has delete protection enabled and cannot be deleted.",
+                    vm.getUuid(), vm.getName()));
+        }
+
+        // check if vm belongs to AutoScale vm group in Disabled state
+        autoScaleManager.checkIfVmActionAllowed(vm.getId());
+
+        // check if vm belongs to any plugin resources
+        checkPluginsIfVmCanBeDestroyed(vm);
+    }
+
     private List<VolumeVO> getVolumesFromIds(DestroyVMCmd cmd) {
         List<VolumeVO> volumes = new ArrayList<>();
         if (cmd.getVolumeIds() != null) {
@@ -3890,16 +3917,31 @@ public UserVm createBasicSecurityGroupVirtualMachine(DataCenter zone, ServiceOff
         if (defaultNetwork == null) {
             throw new InvalidParameterValueException("Unable to find a default network to start a vm");
         } else {
-            networkList.add(_networkDao.findById(defaultNetwork.getId()));
+            if (!_itMgr.isBlankInstance(template)) {
+                networkList.add(_networkDao.findById(defaultNetwork.getId()));
+            }
         }
 
+
         boolean isVmWare = (template.getHypervisorType() == HypervisorType.VMware || (hypervisor != null && hypervisor == HypervisorType.VMware));
 
+        securityGroupIdList = validateAndUpdateSecurityGroupsIfNeeded(securityGroupIdList, owner, isVmWare, defaultNetwork, template);
+
+        return createVirtualMachine(zone, serviceOffering, template, hostName, displayName, owner, diskOfferingId, diskSize, dataDiskInfoList, networkList, securityGroupIdList, group, httpmethod,
+                userData, userDataId, userDataDetails, sshKeyPairs, hypervisor, caller, requestedIps, defaultIps, displayVm, keyboard, affinityGroupIdList, customParametes, customId, dhcpOptionMap,
+                dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
+
+    }
+
+    @Nullable
+    private List<Long> validateAndUpdateSecurityGroupsIfNeeded(List<Long> securityGroupIdList, Account owner,
+                                                               boolean isVmWare, Network defaultNetwork,
+                                                               VirtualMachineTemplate template) {
         if (securityGroupIdList != null && isVmWare) {
             throw new InvalidParameterValueException("Security group feature is not supported for VMware hypervisor");
         } else if (!isVmWare && _networkModel.isSecurityGroupSupportedInNetwork(defaultNetwork) && _networkModel.canAddDefaultSecurityGroup()) {
             //add the default securityGroup only if no security group is specified
-            if (securityGroupIdList == null || securityGroupIdList.isEmpty()) {
+            if (CollectionUtils.isEmpty(securityGroupIdList) && !_itMgr.isBlankInstance(template)) {
                 if (securityGroupIdList == null) {
                     securityGroupIdList = new ArrayList<>();
                 }
@@ -3917,11 +3959,7 @@ public UserVm createBasicSecurityGroupVirtualMachine(DataCenter zone, ServiceOff
                 }
             }
         }
-
-        return createVirtualMachine(zone, serviceOffering, template, hostName, displayName, owner, diskOfferingId, diskSize, dataDiskInfoList, networkList, securityGroupIdList, group, httpmethod,
-                userData, userDataId, userDataDetails, sshKeyPairs, hypervisor, caller, requestedIps, defaultIps, displayVm, keyboard, affinityGroupIdList, customParametes, customId, dhcpOptionMap,
-                dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
-
+        return securityGroupIdList;
     }
 
     @Override
@@ -3945,7 +3983,9 @@ public UserVm createAdvancedSecurityGroupVirtualMachine(DataCenter zone, Service
         _accountMgr.checkAccess(owner, _diskOfferingDao.findById(diskOfferingId), zone);
 
         // If no network is specified, find system security group enabled network
-        if (networkIdList == null || networkIdList.isEmpty()) {
+        if (_itMgr.isBlankInstance(template)) {
+            logger.debug("Blank instance for {} hypervisor, skipping network allocation in an advanced security group enabled zone", hypervisor);
+        } else if (networkIdList == null || networkIdList.isEmpty()) {
             Network networkWithSecurityGroup = _networkModel.getNetworkWithSGWithFreeIPs(owner, zone.getId());
             if (networkWithSecurityGroup == null) {
                 throw new InvalidParameterValueException("No network with security enabled is found in zone id=" + zone.getUuid());
@@ -4058,7 +4098,9 @@ public UserVm createAdvancedVirtualMachine(DataCenter zone, ServiceOffering serv
         _accountMgr.checkAccess(owner, diskOffering, zone);
 
         List<HypervisorType> vpcSupportedHTypes = _vpcMgr.getSupportedVpcHypervisors();
-        if (networkIdList == null || networkIdList.isEmpty()) {
+        if (_itMgr.isBlankInstance(template)) {
+            logger.debug("Template is a dummy template for hypervisor {}, skipping network allocation in an advanced zone", hypervisor);
+        } else if (networkIdList == null || networkIdList.isEmpty()) {
             NetworkVO defaultNetwork = getDefaultNetwork(zone, owner, false);
             if (defaultNetwork != null) {
                 networkList.add(defaultNetwork);
@@ -4292,7 +4334,7 @@ private UserVm createVirtualMachine(DataCenter zone, ServiceOffering serviceOffe
         if (isIso) {
             if (diskOfferingId == null) {
                 DiskOfferingVO diskOffering = _diskOfferingDao.findById(rootDiskOfferingId);
-                if (diskOffering.isComputeOnly()) {
+                if (diskOffering.isComputeOnly() && !_itMgr.isBlankInstance(template)) {
                     throw new InvalidParameterValueException("Installing from ISO requires a disk offering to be specified for the root disk.");
                 }
             } else {
@@ -4489,7 +4531,8 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 }
             }
 
-            if (TemplateType.SYSTEM.equals(template.getTemplateType()) && !CKS_NODE.equals(vmType) && !SHAREDFSVM.equals(vmType)) {
+            if (TemplateType.SYSTEM.equals(template.getTemplateType()) && !CKS_NODE.equals(vmType) &&
+                    !SHAREDFSVM.equals(vmType) && !_itMgr.isBlankInstance(template)) {
                 throw new InvalidParameterValueException(String.format("Unable to use system template %s to deploy a user vm", template));
             }
 
@@ -4502,7 +4545,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 if (CollectionUtils.isEmpty(snapshotsOnZone)) {
                     throw new InvalidParameterValueException("The snapshot does not exist on zone " + zone.getId());
                 }
-            } else {
+            } else if (!_itMgr.isBlankInstanceDefaultTemplate(template)) {
                 List<VMTemplateZoneVO> listZoneTemplate = _templateZoneDao.listByZoneTemplate(zone.getId(), template.getId());
                 if (listZoneTemplate == null || listZoneTemplate.isEmpty()) {
                     throw new InvalidParameterValueException("The template " + template.getId() + " is not available for use");
@@ -4607,7 +4650,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 networkIndex++;
             }
 
-            if (securityGroupIdList != null && !securityGroupIdList.isEmpty() && !securityGroupEnabled) {
+            if (CollectionUtils.isNotEmpty(securityGroupIdList) && !securityGroupEnabled) {
                 throw new InvalidParameterValueException("Unable to deploy vm with security groups as SecurityGroup service is not enabled for the vm's network");
             }
 
@@ -4617,7 +4660,11 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
             // by Agent Manager in order to configure default
             // gateway for the vm
             if (defaultNetworkNumber == 0) {
-                throw new InvalidParameterValueException("At least 1 default network has to be specified for the vm");
+                if (_itMgr.isBlankInstance(template)) {
+                    logger.debug("Template is a dummy template for hypervisor {}, vm can be created without a default network", hypervisorType);
+                } else {
+                    throw new InvalidParameterValueException("At least 1 default network has to be specified for the vm");
+                }
             } else if (defaultNetworkNumber > 1) {
                 throw new InvalidParameterValueException("Only 1 default network per vm is supported");
             }
@@ -4772,7 +4819,7 @@ protected long configureCustomRootDiskSize(Map<String, String> customParameters,
             return rootDiskSize;
         } else {
             // For baremetal, size can be 0 (zero)
-            Long templateSize = _templateDao.findById(template.getId()).getSize();
+            Long templateSize = template.getSize();
             if (templateSize != null) {
                 return templateSize;
             }
@@ -4887,6 +4934,9 @@ private UserVmVO commitUserVm(final boolean isImport, final DataCenter zone, fin
                 offering.getLimitCpuUse(), owner.getDomainId(), owner.getId(), userId, offering.getId(), userData, userDataId, userDataDetails, hostName);
         vm.setUuid(uuidName);
         vm.setDynamicallyScalable(dynamicScalingEnabled);
+        if (_itMgr.isBlankInstance(template)) {
+            vm.setUpdateParameters(false);
+        }
 
         Map<String, String> details = template.getDetails();
         if (details != null && !details.isEmpty()) {
@@ -5165,12 +5215,24 @@ private UserVmVO commitUserVm(final DataCenter zone, final VirtualMachineTemplat
                                   Map<Integer, String>> extraDhcpOptionMap, final Map<Long, DiskOffering> dataDiskTemplateToDiskOfferingMap,
                                   Map<String, String> userVmOVFPropertiesMap, final boolean dynamicScalingEnabled, String vmType, final Long rootDiskOfferingId, String sshkeypairs,
                                   List<VmDiskInfo> dataDiskInfoList, Volume volume, Snapshot snapshot) throws InsufficientCapacityException {
+        Long guestOsId = getGuestOsIdIfNeeded(template);
         return commitUserVm(false, zone, null, null, template, hostName, displayName, owner,
                 diskOfferingId, diskSize, userData, userDataId, userDataDetails, isDisplayVm, keyboard,
-                accountId, userId, offering, isIso, null, sshPublicKeys, networkNicMap,
-                id, instanceName, uuidName, hypervisorType, customParameters,
-                extraDhcpOptionMap, dataDiskTemplateToDiskOfferingMap,
-                userVmOVFPropertiesMap, null, dynamicScalingEnabled, vmType, rootDiskOfferingId, sshkeypairs, dataDiskInfoList, volume, snapshot);
+                accountId, userId, offering, isIso, guestOsId, sshPublicKeys, networkNicMap, id, instanceName, uuidName,
+                hypervisorType, customParameters, extraDhcpOptionMap, dataDiskTemplateToDiskOfferingMap,
+                userVmOVFPropertiesMap, null, dynamicScalingEnabled, vmType, rootDiskOfferingId, sshkeypairs,
+                dataDiskInfoList, volume, snapshot);
+    }
+
+    protected Long getGuestOsIdIfNeeded(VirtualMachineTemplate template) {
+        if (!_itMgr.isBlankInstanceDefaultTemplate(template)) {
+            return null;
+        }
+        Object obj = CallContext.current().getContextParameter(ApiConstants.OS_ID);
+        if (!(obj instanceof GuestOS)) {
+            return null;
+        }
+        return ((GuestOS)obj).getId();
     }
 
     public void validateRootDiskResize(final HypervisorType hypervisorType, Long rootDiskSize, VMTemplateVO templateVO, UserVmVO vm, final Map<String, String> customParameters) throws InvalidParameterValueException
@@ -5328,7 +5390,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
     @ActionEvent(eventType = EventTypes.EVENT_VM_CREATE, eventDescription = "deploying Vm", async = true)
     public UserVm startVirtualMachine(DeployVMCmd cmd) throws ResourceUnavailableException, InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException {
         long vmId = cmd.getEntityId();
-        if (!cmd.getStartVm()) {
+        if (!cmd.getStartVm() || cmd.isBlankInstance()) {
             return getUserVm(vmId);
         }
         Long podId = null;
@@ -6402,7 +6464,9 @@ private void verifyServiceOffering(BaseDeployVMCmd cmd, ServiceOffering serviceO
 
     private void verifyTemplate(BaseDeployVMCmd cmd, VirtualMachineTemplate template, Long serviceOfferingId) {
         if (TemplateType.VNF.equals(template.getTemplateType())) {
-            vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds(), cmd.getVmNetworkMap());
+            if (!_itMgr.isBlankInstance(template)) {
+                vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds(), cmd.getVmNetworkMap());
+            }
         } else if (cmd instanceof DeployVnfApplianceCmd) {
             throw new InvalidParameterValueException("Can't deploy VNF appliance from a non-VNF template");
         }
@@ -6492,6 +6556,16 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
                 (!(HypervisorType.KVM.equals(template.getHypervisorType()) || HypervisorType.KVM.equals(cmd.getHypervisor())))) {
             throw new InvalidParameterValueException("Deploying a virtual machine with existing volume/snapshot is supported only from KVM hypervisors");
         }
+        boolean blankInstance = cmd.isBlankInstance();
+        if (blankInstance) {
+            CallContext.current().putContextParameter(ApiConstants.BLANK_INSTANCE, true);
+        }
+        if (template == null && HypervisorType.KVM.equals(cmd.getHypervisor()) && blankInstance) {
+            template = getBlankInstanceTemplate();
+            logger.info("Creating launch permission for Dummy template");
+            LaunchPermissionVO launchPermission = new LaunchPermissionVO(template.getId(), owner.getId());
+            launchPermissionDao.persist(launchPermission);
+        }
         // Make sure a valid template ID was specified
         if (template == null) {
             throw new InvalidParameterValueException("Unable to use template " + templateId);
@@ -6586,6 +6660,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
         String keyboard = cmd.getKeyboard();
         Map<Long, DiskOffering> dataDiskTemplateToDiskOfferingMap = cmd.getDataDiskTemplateToDiskOfferingMap();
         Map<String, String> userVmOVFProperties = cmd.getVmProperties();
+        final String instanceType = cmd.getInstanceType();
         if (zone.getNetworkType() == NetworkType.Basic) {
             if (networkIds != null) {
                 throw new InvalidParameterValueException("Can't specify network Ids in Basic zone");
@@ -6601,7 +6676,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
                 vm = createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, getSecurityGroupIdList(cmd, zone, template, owner), owner, name,
                         displayName, diskOfferingId, size, dataDiskInfoList, group, hypervisor, cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, ipToNetworkMap, addrs, displayVm, keyboard,
                         cmd.getAffinityGroupIdList(), cmd.getDetails(), cmd.getCustomId(), cmd.getDhcpOptionsMap(),
-                        dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId, null, volume, snapshot);
+                        dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId, instanceType, volume, snapshot);
 
             } else {
                 if (cmd.getSecurityGroupIdList() != null && !cmd.getSecurityGroupIdList().isEmpty()) {
@@ -6609,7 +6684,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
                 }
                 vm = createAdvancedVirtualMachine(zone, serviceOffering, template, networkIds, owner, name, displayName, diskOfferingId, size, dataDiskInfoList, group,
                         hypervisor, cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, ipToNetworkMap, addrs, displayVm, keyboard, cmd.getAffinityGroupIdList(), cmd.getDetails(),
-                        cmd.getCustomId(), cmd.getDhcpOptionsMap(), dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
+                        cmd.getCustomId(), cmd.getDhcpOptionsMap(), dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, instanceType, overrideDiskOfferingId, volume, snapshot);
                 if (cmd instanceof DeployVnfApplianceCmd) {
                     vnfTemplateManager.createIsolatedNetworkRulesForVnfAppliance(zone, template, owner, vm, (DeployVnfApplianceCmd) cmd);
                 }
@@ -6650,6 +6725,12 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
         if (isLeaseFeatureEnabled) {
             applyLeaseOnCreateInstance(vm, cmd.getLeaseDuration(), cmd.getLeaseExpiryAction(), svcOffering);
         }
+
+        if (_itMgr.isBlankInstanceDefaultTemplate(template) && cmd instanceof DeployVMCmd && ((DeployVMCmd) cmd).isBlankInstance()) {
+            logger.info("Revoking launch permission for Dummy template");
+            launchPermissionDao.removePermissions(template.getId(), Collections.singletonList(owner.getId()));
+        }
+
         return vm;
     }
 
@@ -8009,7 +8090,10 @@ public UserVm moveVmToUser(final AssignVMCmd cmd) throws ResourceAllocationExcep
         try {
         verifyResourceLimitsForAccountAndStorage(newAccount, vm, offering, volumes, template, reservations);
 
-        Network newNetwork = ensureDestinationNetwork(cmd, vm, newAccount);
+        Network newNetwork = null;
+        if (!cmd.isSkipNetwork()) {
+            newNetwork = ensureDestinationNetwork(cmd, vm, newAccount);
+        }
         try {
             Transaction.execute(new TransactionCallbackNoReturn() {
                 @Override
@@ -8303,6 +8387,10 @@ protected void updateVolumesOwner(final List<VolumeVO> volumes, Account oldAccou
      */
     protected void updateVmNetwork(AssignVMCmd cmd, Account caller, UserVmVO vm, Account newAccount, VirtualMachineTemplate template)
             throws InsufficientCapacityException, ResourceAllocationException {
+        if (cmd.isSkipNetwork()) {
+            logger.trace("Skipping network update for {} as per command parameter.", vm);
+            return;
+        }
 
         logger.trace("Updating network for VM [{}].", vm);
 
@@ -10085,4 +10173,19 @@ private void setVncPasswordForKvmIfAvailable(Map<String, String> customParameter
             vm.setVncPassword(customParameters.get(VmDetailConstants.KVM_VNC_PASSWORD));
         }
     }
+
+    protected VMTemplateVO getBlankInstanceTemplate() {
+        VMTemplateVO template = _templateDao.findByName(VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME);
+        if (template != null) {
+            return template;
+        }
+        template = VMTemplateVO.createSystemIso(_templateDao.getNextInSequence(Long.class, "id"),
+                VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME, VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME, true,
+                "", true, 64, Account.ACCOUNT_ID_SYSTEM, "",
+                "Blank Template for KVM VM", false, 1);
+        template.setState(VirtualMachineTemplate.State.Active);
+        template.setFormat(ImageFormat.QCOW2);
+        template = _templateDao.persist(template);
+        return template;
+    }
 }
diff --git a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
index 52e2434d3206..7572ab4a78be 100644
--- a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
@@ -436,6 +436,12 @@ public VMSnapshot allocVMSnapshot(Long vmId, String vsDisplayName, String vsDesc
             vmSnapshotType = VMSnapshot.Type.Disk;
         }
 
+        // CLVM_NG: Block VM snapshots until Phase 2 implementation is complete
+        if (rootVolumePool.getPoolType() == Storage.StoragePoolType.CLVM_NG) {
+            throw new InvalidParameterValueException("VM snapshots are not yet supported on CLVM_NG storage pools. " +
+                    "This feature will be available in a future release.");
+        }
+
         try {
             return createAndPersistVMSnapshot(userVmVo, vsDescription, vmSnapshotName, vsDisplayName, vmSnapshotType);
         } catch (Exception e) {
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index 1cbb668206d9..c17c0b487f10 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -1822,9 +1822,9 @@ public BackupProvider getBackupProvider(final Long zoneId) {
     }
 
     public BackupProvider getBackupProvider(final String name) {
-        if (StringUtils.isEmpty(name)) {
-            throw new CloudRuntimeException("Invalid backup provider name provided");
-        }
+       if (StringUtils.isEmpty(name)) {
+           throw new CloudRuntimeException("Invalid backup provider name provided");
+       }
        if (!backupProvidersMap.containsKey(name)) {
            throw new CloudRuntimeException("Failed to find backup provider by the name: " + name);
        }
@@ -2436,8 +2436,10 @@ public BackupResponse createBackupResponse(Backup backup, Boolean listVmDetails)
             backedUpVolumes = new Gson().toJson(backup.getBackedUpVolumes().toArray(), Backup.VolumeInfo[].class);
         }
         response.setVolumes(backedUpVolumes);
-        response.setBackupOfferingId(offering.getUuid());
-        response.setBackupOffering(offering.getName());
+        if (offering != null) {
+            response.setBackupOfferingId(offering.getUuid());
+            response.setBackupOffering(offering.getName());
+        }
         response.setAccountId(account.getUuid());
         response.setAccount(account.getAccountName());
         response.setDomainId(domain.getUuid());
@@ -2455,6 +2457,13 @@ public BackupResponse createBackupResponse(Backup backup, Boolean listVmDetails)
             response.setVmDetails(vmDetails);
         }
 
+        if (backup.getFromCheckpointId() != null) {
+            response.setFromCheckpointId(backup.getFromCheckpointId());
+        }
+        if (backup.getToCheckpointId() != null) {
+            response.setToCheckpointId(backup.getToCheckpointId());
+        }
+
         response.setObjectName("backup");
         return response;
     }
diff --git a/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java b/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java
new file mode 100644
index 000000000000..ea90fc6b4b53
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java
@@ -0,0 +1,1036 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import static org.apache.cloudstack.backup.BackupManager.BackupFrameworkEnabled;
+import static org.apache.cloudstack.backup.BackupManager.BackupProviderPlugin;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.utils.fsm.StateMachine2;
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.jobs.AsyncJobExecutionContext;
+import org.apache.cloudstack.framework.jobs.AsyncJobManager;
+import org.apache.cloudstack.framework.jobs.impl.VmWorkJobVO;
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.joda.time.DateTime;
+import org.springframework.stereotype.Component;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.ScopeType;
+import com.cloud.storage.StoragePoolHostVO;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.StoragePoolHostDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.NumbersUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.ReflectionUse;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachine.State;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.VmWork;
+import com.cloud.vm.VmWorkConstants;
+import com.cloud.vm.VmWorkJobHandler;
+import com.cloud.vm.VmWorkJobHandlerProxy;
+import com.cloud.vm.VmWorkSerializer;
+import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+
+@Component
+public class KVMBackupExportServiceImpl extends ManagerBase implements KVMBackupExportService, VmWorkJobHandler {
+    public static final String VM_WORK_JOB_HANDLER = KVMBackupExportServiceImpl.class.getSimpleName();
+    private static final long BACKUP_FINALIZE_WAIT_CHECK_INTERVAL = 15 * 1000L;
+    private static Set<String> COMPATIBLE_BACKUP_PROVIDERS = Set.of("veeam", "dummy");
+
+    @Inject
+    private VMInstanceDao vmInstanceDao;
+
+    @Inject
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Inject
+    private BackupDao backupDao;
+
+    @Inject
+    private ImageTransferDao imageTransferDao;
+
+    @Inject
+    private VolumeDao volumeDao;
+
+    @Inject
+    private VolumeDetailsDao volumeDetailsDao;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Inject
+    private HostDao hostDao;
+
+    @Inject
+    private PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Inject
+    private StoragePoolHostDao storagePoolHostDao;
+
+    @Inject
+    private DataCenterDao dataCenterDao;
+
+    @Inject
+    AccountService accountService;
+
+    @Inject
+    AsyncJobManager asyncJobManager;
+
+    @Inject
+    VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private VolumeDataFactory volumeDataFactory;
+
+    VmWorkJobHandlerProxy jobHandlerProxy = new VmWorkJobHandlerProxy(this);
+
+    private Boolean isZoneCompatible(Long zoneId) {
+        if (!BackupFrameworkEnabled.valueIn(zoneId)) {
+            return true;
+        }
+        if (COMPATIBLE_BACKUP_PROVIDERS.contains(BackupProviderPlugin.valueIn(zoneId))) {
+            return true;
+        }
+        return false;
+    }
+
+    private void verifyKVMBackupExportServiceSupported(Long zoneId) {
+        if (!isZoneCompatible(zoneId)) {
+            throw new CloudRuntimeException("Veeam-KVM backups are disabled because the CloudStack Zone is configured to use the \"" +
+                    BackupProviderPlugin.valueIn(zoneId) + "\" backup provider. Acceptable \"backup.framework.provider.plugin\" " +
+                    "values are " + COMPATIBLE_BACKUP_PROVIDERS +
+                    ". Please refer to the documentation for more details on backup providers compatibility.");
+        }
+    }
+
+    protected void validateVmVolumesForBackup(VMInstanceVO vm) {
+        List<VolumeVO> volumes = volumeDao.findByInstanceAndNotStates(vm.getId(), Volume.State.Ready);
+        List<String> nonReadyVolumeIds = volumes
+                .stream()
+                .map(VolumeVO::getUuid)
+                .collect(Collectors.toList());
+        if (CollectionUtils.isNotEmpty(nonReadyVolumeIds)) {
+            throw new CloudRuntimeException(String.format("Volumes [%s] of Instance: %s are not in Ready state",
+                    StringUtils.join(nonReadyVolumeIds, ","), vm.getUuid()));
+        }
+    }
+
+    @Override
+    public Backup createBackup(StartBackupCmd cmd) {
+        Long vmId = cmd.getVmId();
+
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("Instance not found: " + vmId);
+        }
+
+        verifyKVMBackupExportServiceSupported(vm.getDataCenterId());
+
+        if (vm.getState() != State.Running && vm.getState() != State.Stopped) {
+            throw new CloudRuntimeException("Instance must be running or stopped to start Backup");
+        }
+
+        Backup existingBackup = backupDao.findByVmId(vmId);
+        if (existingBackup != null && existingBackup.getStatus() == Backup.Status.BackingUp) {
+            throw new CloudRuntimeException("Backup already in progress for Instance: " + vm.getUuid());
+        }
+
+        validateVmVolumesForBackup(vm);
+
+        Pair<Long, Long> clusterAndHostId = virtualMachineManager.findClusterAndHostIdForVm(vm, false);
+        Long hostId = clusterAndHostId.second();
+        if (hostId == null) {
+            throw new CloudRuntimeException("Host cannot be determined for Instance: " + vm.getUuid());
+        }
+
+        BackupVO backup = new BackupVO();
+        backup.setVmId(vmId);
+        String name = cmd.getName();
+        if (StringUtils.isEmpty(name)) {
+            name = vmId + "-" + DateTime.now();
+        }
+        backup.setName(name);
+        final String description = cmd.getDescription();
+        if (StringUtils.isNotEmpty(description)) {
+            backup.setDescription(description);
+        }
+        backup.setAccountId(vm.getAccountId());
+        backup.setDomainId(vm.getDomainId());
+        backup.setZoneId(vm.getDataCenterId());
+        backup.setStatus(Backup.Status.Queued);
+        backup.setBackupOfferingId(0L);
+        backup.setDate(new Date());
+
+        String toCheckpointId = "ckp-" + UUID.randomUUID().toString().substring(0, 8);
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String fromCheckpointId = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+
+        backup.setToCheckpointId(toCheckpointId);
+        backup.setFromCheckpointId(fromCheckpointId);
+        backup.setType("FULL");
+        backup.setHostId(hostId);
+
+        return backupDao.persist(backup);
+    }
+
+    protected void removeFailedBackup(BackupVO backup) {
+        backup.setStatus(Backup.Status.Error);
+        backupDao.update(backup.getId(), backup);
+        backupDao.remove(backup.getId());
+    }
+
+    protected void queueBackupFinalizeWaitWorkJob(final VMInstanceVO vm, final BackupVO backup) {
+        final CallContext context = CallContext.current();
+        final Account callingAccount = context.getCallingAccount();
+        final long callingUserId = context.getCallingUserId();
+
+        VmWorkJobVO workJob = new VmWorkJobVO(context.getContextId());
+        workJob.setDispatcher(VmWorkConstants.VM_WORK_JOB_DISPATCHER);
+        workJob.setCmd(VmWorkWaitForBackupFinalize.class.getName());
+        workJob.setAccountId(callingAccount.getId());
+        workJob.setUserId(callingUserId);
+        workJob.setStep(VmWorkJobVO.Step.Starting);
+        workJob.setVmType(VirtualMachine.Type.User);
+        workJob.setVmInstanceId(vm.getId());
+        workJob.setRelated(AsyncJobExecutionContext.getOriginJobId());
+
+        VmWorkWaitForBackupFinalize workInfo = new VmWorkWaitForBackupFinalize(
+                callingUserId, callingAccount.getId(), vm.getId(), VM_WORK_JOB_HANDLER, backup.getId());
+        workJob.setCmdInfo(VmWorkSerializer.serialize(workInfo));
+
+        asyncJobManager.submitAsyncJob(workJob, VmWorkConstants.VM_WORK_QUEUE, vm.getId());
+    }
+
+    @Override
+    public Backup startBackup(StartBackupCmd cmd) {
+        BackupVO backup = backupDao.findById(cmd.getEntityId());
+        Long vmId = cmd.getVmId();
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            removeFailedBackup(backup);
+            throw new CloudRuntimeException("Instance not found for Backup: " + backup.getUuid());
+        }
+        boolean isVmStopped = vm.getState() == State.Stopped;
+
+        List<VolumeVO> volumes = volumeDao.findByInstance(vmId);
+        Map<String, String> diskPathUuidMap = new HashMap<>();
+        Map<String, byte[]> diskPathPassphraseMap = new HashMap<>();
+        for (Volume vol : volumes) {
+            if (vol.getPoolId() == null) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Storage Pool cannot be determined for Volume: " + vol.getUuid());
+            }
+            String volumePath = getVolumePathForFileBasedBackend(vol);
+            diskPathUuidMap.put(volumePath, vol.getUuid());
+            if (isVmStopped) {
+                VolumeInfo volumeInfo = volumeDataFactory.getVolume(vol.getId());
+                diskPathPassphraseMap.put(volumePath, volumeInfo.getPassphrase());
+            } else {
+                diskPathPassphraseMap.put(volumePath, null);
+            }
+        }
+        Long hostId = backup.getHostId();
+
+        VMInstanceDetailVO lastCheckpointId = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID);
+        if (lastCheckpointId != null) {
+            try {
+                sendDeleteCheckpointCommand(vm, lastCheckpointId.getValue());
+            } catch (CloudRuntimeException e) {
+                logger.warn("Failed to delete last checkpoint {} for VM {}, proceeding with backup start", lastCheckpointId.getValue(), vmId, e);
+            }
+        }
+        if (hostId == null) {
+            removeFailedBackup(backup);
+            throw new CloudRuntimeException("Host cannot be found for Backup: " + backup.getUuid());
+        }
+
+        Host host = hostDao.findById(hostId);
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCkpCreateTimeStr = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        Long fromCheckpointCreateTime = activeCkpCreateTimeStr != null ? NumbersUtil.parseLong(activeCkpCreateTimeStr, 0L) : null;
+        StartBackupCommand startCmd = new StartBackupCommand(
+            vm.getInstanceName(),
+            backup.getToCheckpointId(),
+            backup.getFromCheckpointId(),
+            fromCheckpointCreateTime,
+            backup.getUuid(),
+            diskPathUuidMap,
+            diskPathPassphraseMap,
+            isVmStopped
+        );
+
+        StartBackupAnswer answer;
+        try {
+            answer = (StartBackupAnswer) agentManager.send(hostId, startCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            removeFailedBackup(backup);
+            logger.error("Failed to communicate with agent on {} for {} start", host, backup, e);
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!answer.getResult()) {
+            removeFailedBackup(backup);
+            logger.error("Failed to start {} due to: {}", backup, answer.getDetails());
+            throw new CloudRuntimeException("Failed to start Backup: " + answer.getDetails());
+        }
+
+        // Update backup with checkpoint creation time
+        backup.setCheckpointCreateTime(answer.getCheckpointCreateTime());
+        updateBackupState(backup, Backup.Status.ReadyForImageTransfer);
+        queueBackupFinalizeWaitWorkJob(vm, backup);
+        return backup;
+    }
+
+    protected void updateBackupState(BackupVO backup, Backup.Status newStatus) {
+        backup.setStatus(newStatus);
+        backupDao.update(backup.getId(), backup);
+    }
+
+    private void updateVmCheckpoints(Long vmId, BackupVO backup) {
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String oldCheckpointId = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        String oldCreateTimeStr = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        if (oldCheckpointId != null && oldCreateTimeStr != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID, oldCheckpointId, false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME, oldCreateTimeStr, false);
+        }
+        String newCheckpointId = backup.getToCheckpointId();
+        Long newCreateTime = backup.getCheckpointCreateTime();
+        if (newCheckpointId != null && newCreateTime != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID, backup.getToCheckpointId(), false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME, String.valueOf(newCreateTime), false);
+        } else {
+            logger.error("New checkpoint details are missing for backup {} and vm {}", backup.getId(), vmId);
+        }
+    }
+
+    @Override
+    public Backup finalizeBackup(FinalizeBackupCmd cmd) {
+        Long vmId = cmd.getVmId();
+        Long backupId = cmd.getBackupId();
+
+        // Get backup
+        BackupVO backup = backupDao.findById(backupId);
+        if (backup == null) {
+            throw new CloudRuntimeException("Backup not found: " + backupId);
+        }
+
+        if (!backup.getVmId().equals(vmId)) {
+            throw new CloudRuntimeException("Backup does not belong to VM: " + vmId);
+        }
+
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + vmId);
+        }
+
+        updateBackupState(backup, Backup.Status.FinalizingImageTransfer);
+
+        List<ImageTransferVO> transfers = imageTransferDao.listByBackupId(backupId);
+        for (ImageTransferVO transfer : transfers) {
+            if (transfer.getPhase() != ImageTransferVO.Phase.finished) {
+                logger.warn("Finalize called for backup {} while Image transfer {} is not finalized, attempting to finalize it", backup.getUuid(), transfer.getUuid());
+                finalizeImageTransfer(transfer.getId());
+            }
+        }
+
+        if (vm.getState() == State.Running) {
+            StopBackupCommand stopCmd = new StopBackupCommand(vm.getInstanceName(), vmId, backupId);
+
+            StopBackupAnswer answer;
+            try {
+                answer = (StopBackupAnswer) agentManager.send(backup.getHostId(), stopCmd);
+            } catch (AgentUnavailableException | OperationTimedoutException e) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Failed to communicate with agent", e);
+            }
+
+            if (!answer.getResult()) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Failed to stop backup: " + answer.getDetails());
+            }
+        }
+
+        updateVmCheckpoints(vmId, backup);
+
+        updateBackupState(backup, Backup.Status.BackedUp);
+        backupDao.remove(backup.getId());
+
+        return backup;
+
+    }
+
+    private ImageTransferVO createDownloadImageTransfer(Long backupId, VolumeVO volume, ImageTransfer.Backend backend) {
+        final String direction = ImageTransfer.Direction.download.toString();
+        BackupVO backup = backupDao.findById(backupId);
+        if (backup == null) {
+            throw new CloudRuntimeException("Backup not found: " + backupId);
+        }
+        if (ImageTransfer.Backend.file.equals(backend)) {
+            throw new CloudRuntimeException("File backend is not supported for download");
+        }
+
+        String transferId = UUID.randomUUID().toString();
+
+        String socket = backup.getUuid();
+        VMInstanceVO vm = vmInstanceDao.findById(backup.getVmId());
+        if (vm.getState() == State.Stopped) {
+            Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(backup.getVmId());
+            String volumePath = getVolumePathForFileBasedBackend(volume);
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getId());
+            startNBDServer(transferId,
+                    direction,
+                    backup.getHostId(),
+                    volume.getUuid(),
+                    volumePath,
+                    vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID),
+                    volumeInfo.getPassphrase());
+            socket = transferId;
+        }
+
+        HostVO backupHost = hostDao.findById(backup.getHostId());
+        if (backupHost == null) {
+            throw new CloudRuntimeException("Host not found for backup: " + backupId);
+        }
+        int idleTimeoutSec = ImageTransferIdleTimeoutSeconds.valueIn(backupHost.getDataCenterId());
+        CreateImageTransferCommand transferCmd = new CreateImageTransferCommand(
+                transferId,
+                direction,
+                volume.getUuid(),
+                socket,
+                backup.getFromCheckpointId(),
+                idleTimeoutSec);
+
+        try {
+            CreateImageTransferAnswer answer;
+            answer = (CreateImageTransferAnswer) agentManager.send(backup.getHostId(), transferCmd);
+
+            if (!answer.getResult()) {
+                throw new CloudRuntimeException("Failed to create image transfer: " + answer.getDetails());
+            }
+
+            ImageTransferVO imageTransfer = new ImageTransferVO(
+                    transferId,
+                    backupId,
+                    volume.getId(),
+                    backup.getHostId(),
+                    socket,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.download,
+                    backup.getAccountId(),
+                    backup.getDomainId(),
+                    backup.getZoneId()
+            );
+            imageTransfer.setTransferUrl(answer.getTransferUrl());
+            imageTransfer.setSignedTicketId(answer.getImageTransferId());
+            imageTransfer = imageTransferDao.persist(imageTransfer);
+            return imageTransfer;
+
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+    }
+
+    private HostVO getRandomHostFromStoragePool(StoragePoolVO storagePool) {
+        List<HostVO> hosts;
+        switch (storagePool.getScope()) {
+            case CLUSTER:
+                hosts = hostDao.findByClusterId(storagePool.getClusterId());
+                Collections.shuffle(hosts);
+                return hosts.get(0);
+            case ZONE:
+                hosts = hostDao.findByDataCenterId(storagePool.getDataCenterId());
+                Collections.shuffle(hosts);
+                return hosts.get(0);
+            case HOST:
+                List<StoragePoolHostVO> storagePoolHostVOs = storagePoolHostDao.listByPoolId(storagePool.getId());
+                Collections.shuffle(storagePoolHostVOs);
+                return hostDao.findById(storagePoolHostVOs.get(0).getHostId());
+            default:
+                throw new CloudRuntimeException("Unsupported storage pool scope: " + storagePool.getScope());
+        }
+    }
+
+    private void startNBDServer(String transferId, String direction, Long hostId, String exportName, String volumePath, String checkpointId, byte[] passphrase) {
+        StartNBDServerAnswer nbdServerAnswer;
+        if (hostId == null) {
+            throw new CloudRuntimeException("Host cannot be determined for starting NBD server");
+        }
+        HostVO host = hostDao.findById(hostId);
+        if (host == null) {
+            throw new CloudRuntimeException("Host cannot be found for starting NBD server with ID: " + hostId);
+        }
+        StartNBDServerCommand nbdServerCmd = new StartNBDServerCommand(
+                transferId,
+                exportName,
+                volumePath,
+                transferId,
+                direction,
+                checkpointId,
+                passphrase
+        );
+        try {
+            nbdServerAnswer = (StartNBDServerAnswer) agentManager.send(hostId, nbdServerCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+        if (!nbdServerAnswer.getResult()) {
+            throw new CloudRuntimeException("Failed to start the NBD server");
+        }
+    }
+
+    private String getVolumePathPrefix(StoragePoolVO storagePool) {
+        if (ScopeType.HOST.equals(storagePool.getScope())) {
+                return storagePool.getPath();
+        }
+        switch (storagePool.getPoolType()) {
+            case NetworkFilesystem:
+                return String.format("/mnt/%s", storagePool.getUuid());
+            case SharedMountPoint:
+                return storagePool.getPath();
+            default:
+                throw new CloudRuntimeException("Unsupported storage pool type for file based image transfer: " + storagePool.getPoolType());
+        }
+    }
+
+    private String getVolumePathForFileBasedBackend(Volume volume) {
+        StoragePoolVO storagePool = primaryDataStoreDao.findById(volume.getPoolId());
+        String volumePathPrefix = getVolumePathPrefix(storagePool);
+        return volumePathPrefix + "/" + volume.getPath();
+    }
+
+    private ImageTransferVO createUploadImageTransfer(VolumeVO volume, ImageTransfer.Backend backend) {
+        final String direction = ImageTransfer.Direction.upload.toString();
+        String transferId = UUID.randomUUID().toString();
+
+        Long poolId = volume.getPoolId();
+        StoragePoolVO storagePool = poolId == null ? null : primaryDataStoreDao.findById(poolId);
+        if (storagePool == null) {
+            throw new CloudRuntimeException("Storage pool cannot be determined for volume: " + volume.getUuid());
+        }
+
+        Host host = getRandomHostFromStoragePool(storagePool);
+        String volumePath = getVolumePathForFileBasedBackend(volume);
+        int idleTimeoutSec = ImageTransferIdleTimeoutSeconds.valueIn(host.getDataCenterId());
+
+        ImageTransferVO imageTransfer;
+        CreateImageTransferCommand transferCmd;
+        if (backend.equals(ImageTransfer.Backend.file)) {
+            imageTransfer = new ImageTransferVO(
+                    transferId,
+                    volume.getId(),
+                    host.getId(),
+                    volumePath,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.upload,
+                    volume.getAccountId(),
+                    volume.getDomainId(),
+                    volume.getDataCenterId());
+
+            transferCmd = new CreateImageTransferCommand(
+                    transferId,
+                    direction,
+                    transferId,
+                    volumePath,
+                    idleTimeoutSec);
+
+        } else {
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getId());
+            startNBDServer(transferId, direction, host.getId(), volume.getUuid(), volumePath, null, volumeInfo.getPassphrase());
+            imageTransfer = new ImageTransferVO(
+                    transferId,
+                    null,
+                    volume.getId(),
+                    host.getId(),
+                    transferId,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.upload,
+                    volume.getAccountId(),
+                    volume.getDomainId(),
+                    volume.getDataCenterId());
+
+            transferCmd = new CreateImageTransferCommand(
+                    transferId,
+                    direction,
+                    volume.getUuid(),
+                    transferId,
+                    null,
+                    idleTimeoutSec);
+        }
+        CreateImageTransferAnswer transferAnswer;
+        try {
+            transferAnswer = (CreateImageTransferAnswer) agentManager.send(imageTransfer.getHostId(), transferCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!transferAnswer.getResult()) {
+            if (!backend.equals(ImageTransfer.Backend.file)) {
+                stopNBDServer(imageTransfer);
+            }
+            throw new CloudRuntimeException("Failed to create image transfer: " + transferAnswer.getDetails());
+        }
+
+        imageTransfer.setTransferUrl(transferAnswer.getTransferUrl());
+        imageTransfer.setSignedTicketId(transferAnswer.getImageTransferId());
+        imageTransfer = imageTransferDao.persist(imageTransfer);
+
+        try {
+            final StateMachine2<Volume.State, Volume.Event, Volume> stateMachine = Volume.State.getStateMachine();
+            stateMachine.transitTo(volume, Volume.Event.RestoreRequested, null, volumeDao);
+        } catch (NoTransitionException e) {
+            throw new CloudRuntimeException("Failed to transition volume  " + volume.getUuid(), e);
+        }
+
+        return imageTransfer;
+
+    }
+
+    private ImageTransfer.Backend getImageTransferBackend(ImageTransfer.Format format, ImageTransfer.Direction direction) {
+        if (ImageTransfer.Format.cow.equals(format)) {
+            if (ImageTransfer.Direction.download.equals(direction)) {
+                logger.debug("Using NBD backend for download");
+                return ImageTransfer.Backend.nbd;
+            }
+            return ImageTransfer.Backend.file;
+        } else {
+            return ImageTransfer.Backend.nbd;
+        }
+    }
+
+    @Override
+    public ImageTransferResponse createImageTransfer(CreateImageTransferCmd cmd) {
+        ImageTransfer imageTransfer = createImageTransfer(cmd.getVolumeId(), cmd.getBackupId(), cmd.getDirection(), cmd.getFormat());
+        if (imageTransfer instanceof ImageTransferVO) {
+            ImageTransferVO imageTransferVO = (ImageTransferVO) imageTransfer;
+            return toImageTransferResponse(imageTransferVO);
+        }
+        return toImageTransferResponse(imageTransferDao.findById(imageTransfer.getId()));
+    }
+
+    @Override
+    public ImageTransfer createImageTransfer(long volumeId, Long backupId, ImageTransfer.Direction direction, ImageTransfer.Format format) {
+        User callingUser = CallContext.current().getCallingUser();
+        ImageTransfer imageTransfer;
+        VolumeVO volume = volumeDao.findById(volumeId);
+        accountService.checkAccess(callingUser, volume);
+
+        if (volume == null) {
+            throw new CloudRuntimeException("Volume not found with the specified Id");
+        }
+
+        verifyKVMBackupExportServiceSupported(volume.getDataCenterId());
+
+        ImageTransferVO existingTransfer = imageTransferDao.findByVolume(volume.getId());
+        if (existingTransfer != null) {
+            throw new CloudRuntimeException("Image transfer already exists for volume: " + volume.getUuid());
+        }
+
+        ImageTransfer.Backend backend = getImageTransferBackend(format, direction);
+        if (ImageTransfer.Direction.upload.equals(direction)) {
+            imageTransfer = createUploadImageTransfer(volume, backend);
+        } else if (ImageTransfer.Direction.download.equals(direction)) {
+            imageTransfer = createDownloadImageTransfer(backupId, volume, backend);
+        } else {
+            throw new CloudRuntimeException("Invalid direction: " + direction);
+        }
+
+        return imageTransferDao.findById(imageTransfer.getId());
+    }
+
+    @Override
+    public boolean cancelImageTransfer(long imageTransferId) {
+        finalizeImageTransfer(imageTransferId);
+        return true;
+    }
+
+    private void finalizeDownloadImageTransfer(ImageTransferVO imageTransfer) {
+
+        String transferId = imageTransfer.getUuid();
+        FinalizeImageTransferCommand finalizeCmd = new FinalizeImageTransferCommand(transferId);
+
+        BackupVO backup = backupDao.findById(imageTransfer.getBackupId());
+
+        Answer answer;
+        try {
+            answer = agentManager.send(backup.getHostId(), finalizeCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!answer.getResult()) {
+            throw new CloudRuntimeException("Failed to finalize image transfer: " + answer.getDetails());
+        }
+
+        VMInstanceVO vm = vmInstanceDao.findById(backup.getVmId());
+        if (vm.getState() == State.Stopped) {
+            boolean stopNbdServerResult = stopNBDServer(imageTransfer);
+            if (!stopNbdServerResult) {
+                throw new CloudRuntimeException("Failed to stop the nbd server");
+            }
+        }
+    }
+
+    private boolean stopNBDServer(ImageTransferVO imageTransfer) {
+        String transferId = imageTransfer.getUuid();
+        String direction = imageTransfer.getDirection().toString();
+        StopNBDServerCommand stopNbdServerCommand = new StopNBDServerCommand(transferId, direction);
+        Answer answer;
+        try {
+            answer = agentManager.send(imageTransfer.getHostId(), stopNbdServerCommand);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Failed to stop NBD server on image transfer finalization", e);
+            return false;
+        }
+        return answer.getResult();
+    }
+
+    private String finalizeUploadImageTransferWithResult(ImageTransferVO imageTransfer) {
+        String transferId = imageTransfer.getUuid();
+        boolean stopNbdServerResult = stopNBDServer(imageTransfer);
+        if (!stopNbdServerResult) {
+            return "Failed to stop the nbd server";
+        }
+
+        FinalizeImageTransferCommand finalizeCmd = new FinalizeImageTransferCommand(transferId);
+        Answer answer;
+        try {
+            answer = agentManager.send(imageTransfer.getHostId(), finalizeCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            return "Failed to communicate with agent";
+        }
+
+        if (!answer.getResult()) {
+            return "Failed to finalize image transfer: " + answer.getDetails();
+        }
+        return null;
+    }
+
+    private void finalizeUploadImageTransfer(ImageTransferVO imageTransfer) {
+        String failureReason = finalizeUploadImageTransferWithResult(imageTransfer);
+        Volume.Event event = failureReason == null ? Volume.Event.RestoreSucceeded : Volume.Event.RestoreFailed;
+
+        VolumeVO volume = volumeDao.findById(imageTransfer.getVolumeId());
+        try {
+            final StateMachine2<Volume.State, Volume.Event, Volume> stateMachine = Volume.State.getStateMachine();
+            stateMachine.transitTo(volume, event, null, volumeDao);
+        } catch (NoTransitionException e) {
+            throw new CloudRuntimeException("Failed to transition state during upload finalize image transfer for volume " + volume.getUuid(), e);
+        }
+
+        if (failureReason != null) {
+            throw new CloudRuntimeException(failureReason);
+        }
+    }
+
+    @Override
+    public boolean finalizeImageTransfer(FinalizeImageTransferCmd cmd) {
+        return finalizeImageTransfer(cmd.getImageTransferId());
+    }
+
+    @Override
+    public boolean finalizeImageTransfer(final long imageTransferId) {
+        ImageTransferVO imageTransfer = imageTransferDao.findById(imageTransferId);
+        if (imageTransfer == null) {
+            throw new CloudRuntimeException("Image transfer not found: " + imageTransferId);
+        }
+
+        if (imageTransfer.getDirection().equals(ImageTransfer.Direction.download)) {
+            finalizeDownloadImageTransfer(imageTransfer);
+        } else {
+            finalizeUploadImageTransfer(imageTransfer);
+        }
+        imageTransfer.setPhase(ImageTransferVO.Phase.finished);
+        imageTransferDao.update(imageTransfer.getId(), imageTransfer);
+        imageTransferDao.remove(imageTransfer.getId());
+        return true;
+    }
+
+    @Override
+    public List<ImageTransferResponse> listImageTransfers(ListImageTransfersCmd cmd) {
+        Long id = cmd.getId();
+        Long backupId = cmd.getBackupId();
+
+        List<ImageTransferVO> transfers;
+        if (id != null) {
+            transfers = List.of(imageTransferDao.findById(id));
+        } else if (backupId != null) {
+            transfers = imageTransferDao.listByBackupId(backupId);
+        } else {
+            transfers = imageTransferDao.listAll();
+        }
+
+        return transfers.stream().map(this::toImageTransferResponse).collect(Collectors.toList());
+    }
+
+    private CheckpointResponse createCheckpointResponse(String checkpointId, String createTime, boolean isActive) {
+        CheckpointResponse response = new CheckpointResponse();
+        response.setObjectName("checkpoint");
+        response.setId(checkpointId);
+        Long createTimeSeconds = createTime != null ? NumbersUtil.parseLong(createTime, 0L) : 0L;
+        response.setCreated(Date.from(Instant.ofEpochSecond(createTimeSeconds)));
+        response.setIsActive(isActive);
+        return response;
+    }
+
+    @Override
+    public List<CheckpointResponse> listVmCheckpoints(ListVmCheckpointsCmd cmd) {
+        Long vmId = cmd.getVmId();
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + vmId);
+        }
+        List<CheckpointResponse> responses = new ArrayList<>();
+
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCheckpointId = details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        if (activeCheckpointId != null) {
+            responses.add(createCheckpointResponse(activeCheckpointId, details.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME), true));
+        }
+        String lastCheckpointId = details.get(VmDetailConstants.LAST_CHECKPOINT_ID);
+        if (lastCheckpointId != null) {
+            responses.add(createCheckpointResponse(lastCheckpointId, details.get(VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME), false));
+        }
+        return responses;
+    }
+
+    private void sendDeleteCheckpointCommand(VMInstanceVO vm, String checkpointId) {
+        Long hostId = vm.getHostId() != null ? vm.getHostId() : vm.getLastHostId();
+
+        Map<String, String> diskPathUuidMap = new HashMap<>();
+        if (vm.getState() == State.Stopped) {
+            List<VolumeVO> volumes = volumeDao.findByInstance(vm.getId());
+            for (Volume vol : volumes) {
+                diskPathUuidMap.put(getVolumePathForFileBasedBackend(vol), vol.getUuid());
+            }
+        }
+
+        DeleteVmCheckpointCommand deleteCmd = new DeleteVmCheckpointCommand(
+                vm.getInstanceName(),
+                checkpointId,
+                diskPathUuidMap,
+                vm.getState() == State.Stopped);
+
+        Answer answer;
+        try {
+            answer = agentManager.send(hostId, deleteCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Failed to communicate with agent to delete checkpoint for VM {}", vm.getId(), e);
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (answer == null || !answer.getResult()) {
+            String err = answer != null ? answer.getDetails() : "null answer";
+            throw new CloudRuntimeException("Failed to delete checkpoint: " + err);
+        }
+    }
+
+    @Override
+    public boolean deleteVmCheckpoint(DeleteVmCheckpointCmd cmd) {
+        VMInstanceVO vm = vmInstanceDao.findById(cmd.getVmId());
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + cmd.getVmId());
+        }
+
+        verifyKVMBackupExportServiceSupported(vm.getDataCenterId());
+
+        if (vm.getState() != State.Running && vm.getState() != State.Stopped) {
+            throw new CloudRuntimeException("VM must be running or stopped to delete checkpoint");
+        }
+
+        long vmId = cmd.getVmId();
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCheckpointId = details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        if (activeCheckpointId == null || !activeCheckpointId.equals(cmd.getCheckpointId())) {
+            logger.error("Checkpoint ID {} to delete does not match active checkpoint ID for VM {}", cmd.getCheckpointId(), vmId);
+            return true;
+        }
+
+        sendDeleteCheckpointCommand(vm, activeCheckpointId);
+        revertVmCheckpointDetailsAfterActiveDelete(vmId, details);
+
+        return true;
+    }
+
+    @Override
+    public List<Long> listCompatibleDataCenterIds() {
+        return dataCenterDao.listAllIds().stream()
+                .filter(this::isZoneCompatible)
+                .collect(Collectors.toList());
+    }
+
+    private void revertVmCheckpointDetailsAfterActiveDelete(long vmId, Map<String, String> detailsBeforeDelete) {
+        String lastId = detailsBeforeDelete.get(VmDetailConstants.LAST_CHECKPOINT_ID);
+        String lastTime = detailsBeforeDelete.get(VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME);
+        if (lastId != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID, lastId, false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME, lastTime, false);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME);
+        } else {
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        }
+    }
+
+    @Override
+    public List<Class<?>> getCommands() {
+        List<Class<?>> cmdList = new ArrayList<>();
+        if (ExposeKVMBackupExportServiceApis.value()) {
+            cmdList.add(StartBackupCmd.class);
+            cmdList.add(FinalizeBackupCmd.class);
+            cmdList.add(CreateImageTransferCmd.class);
+            cmdList.add(FinalizeImageTransferCmd.class);
+            cmdList.add(ListImageTransfersCmd.class);
+            cmdList.add(ListVmCheckpointsCmd.class);
+            cmdList.add(DeleteVmCheckpointCmd.class);
+        }
+        return cmdList;
+    }
+
+    private ImageTransferResponse toImageTransferResponse(ImageTransferVO imageTransferVO) {
+        ImageTransferResponse response = new ImageTransferResponse();
+        response.setId(imageTransferVO.getUuid());
+        Long backupId = imageTransferVO.getBackupId();
+        if (backupId != null) {
+            Backup backup = backupDao.findByIdIncludingRemoved(backupId);
+            response.setBackupId(backup.getUuid());
+        }
+        Long volumeId = imageTransferVO.getVolumeId();
+        Volume volume = volumeDao.findByIdIncludingRemoved(volumeId);
+        response.setDiskId(volume.getUuid());
+        response.setTransferUrl(imageTransferVO.getTransferUrl());
+        response.setPhase(imageTransferVO.getPhase().toString());
+        response.setDirection(imageTransferVO.getDirection().toString());
+        response.setCreated(imageTransferVO.getCreated());
+        return response;
+    }
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public boolean stop() {
+        return true;
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateWaitForBackupFinalize(VmWorkWaitForBackupFinalize work) {
+        return waitForBackupTerminalState(work.getBackupId());
+    }
+
+    @Override
+    public Pair<JobInfo.Status, String> handleVmWorkJob(VmWork work) throws Exception {
+        return jobHandlerProxy.handleVmWorkJob(work);
+    }
+
+    protected Pair<JobInfo.Status, String> waitForBackupTerminalState(final long backupId) {
+        while (true) {
+            final BackupVO backup = backupDao.findByIdIncludingRemoved(backupId);
+            if (backup == null) {
+                RuntimeException ex = new CloudRuntimeException(String.format("Backup %d not found while waiting for finalize", backupId));
+                return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+            }
+
+            if (backup.getStatus() == Backup.Status.BackedUp) {
+                return new Pair<>(JobInfo.Status.SUCCEEDED, asyncJobManager.marshallResultObject(backup.getId()));
+            }
+
+            if (backup.getStatus() == Backup.Status.Failed || backup.getStatus() == Backup.Status.Error) {
+                RuntimeException ex = new CloudRuntimeException(String.format("Backup %d reached terminal failure state: %s", backupId, backup.getStatus()));
+                return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+            }
+            logger.debug("{} is not in a terminal state, current state: {}, waiting {}ms to check again",
+                    backup, backup.getStatus(), BACKUP_FINALIZE_WAIT_CHECK_INTERVAL);
+            try {
+                Thread.sleep(BACKUP_FINALIZE_WAIT_CHECK_INTERVAL);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                    RuntimeException ex = new CloudRuntimeException(String.format("Interrupted while waiting for backup %d finalize", backupId), e);
+                    return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+                }
+            }
+        }
+
+    @Override
+    public String getConfigComponentName() {
+        return KVMBackupExportService.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[]{
+                ImageTransferIdleTimeoutSeconds,
+                ExposeKVMBackupExportServiceApis
+        };
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java b/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java
new file mode 100644
index 000000000000..ac64b47aa3ea
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java
@@ -0,0 +1,35 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.vm.VmWork;
+
+public class VmWorkWaitForBackupFinalize extends VmWork {
+    private static final long serialVersionUID = 2209426364298601717L;
+
+    private final long backupId;
+
+    public VmWorkWaitForBackupFinalize(long userId, long accountId, long vmId, String handlerName, long backupId) {
+        super(userId, accountId, vmId, handlerName);
+        this.backupId = backupId;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
index beecf90d2b83..97c13f714474 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
@@ -257,7 +257,7 @@ protected Domain setDomainPresetVariable(long domainId) {
      * @return the {@link DataStore} returned by the script.
      */
     public DataStore interpretHeuristicRule(String rule, HeuristicType heuristicType, Object obj, long zoneId) {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(HEURISTICS_SCRIPT_TIMEOUT)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(HEURISTICS_SCRIPT_TIMEOUT, StorageManager.HEURISTICS_SCRIPT_TIMEOUT.key())) {
             buildPresetVariables(jsInterpreter, heuristicType, zoneId, obj);
             Object scriptReturn = jsInterpreter.executeScript(rule);
 
diff --git a/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java b/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
index 4f0aabd3f379..2548752cb685 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
@@ -660,6 +660,39 @@ public void deleteSharedFS(Long sharedFSId) {
         sharedFSDao.remove(sharedFS.getId());
     }
 
+    @Override
+    public SharedFS getSharedFSByUuid(String uuid) {
+        return sharedFSDao.findByUuid(uuid);
+    }
+
+    @Override
+    public SharedFS getSharedFSForVmId(long vmId) {
+        return sharedFSDao.findByVm(vmId);
+    }
+
+    public SharedFS updateSharedFSPostRestore(long sharedFsId, long volumeId) {
+        SharedFSVO sharedFS = sharedFSDao.findById(sharedFsId);
+        if (sharedFS == null) {
+            throw new CloudRuntimeException("Unable to find the Shared FileSystem");
+        }
+        VolumeVO volume = volumeDao.findById(volumeId);
+        if (volume == null) {
+            throw new CloudRuntimeException("Unable to find the Volume");
+        }
+        if (volume.getInstanceId() == null) {
+            throw new CloudRuntimeException("Volume is not attached to any Instance");
+        }
+        if (sharedFS.getAccountId() != volume.getAccountId() || sharedFS.getDomainId() != volume.getDomainId()) {
+            throw new CloudRuntimeException("Shared FileSystem and the Volume do not belong to the same account");
+        }
+        sharedFS.setVolumeId(volume.getId());
+        sharedFS.setVmId(volume.getInstanceId());
+        if (!sharedFSDao.update(sharedFS.getId(), sharedFS)) {
+            throw new CloudRuntimeException("Failed to update Shared FileSystem with the restored Volume information");
+        }
+        return sharedFS;
+    }
+
     @Override
     public String getConfigComponentName() {
         return SharedFSService.class.getSimpleName();
diff --git a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
index 37d32c0f3905..34c981430f7d 100644
--- a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
@@ -183,6 +183,8 @@
 
     <bean id="oCFS2ManagerImpl" class="com.cloud.storage.OCFS2ManagerImpl" />
 
+    <bean id="clvmPoolManager" class="com.cloud.storage.clvm.ClvmPoolManager" />
+
     <bean id="outOfBandManagementServiceImpl" class="org.apache.cloudstack.outofbandmanagement.OutOfBandManagementServiceImpl">
         <property name="outOfBandManagementDrivers" value="#{outOfBandManagementDriversRegistry.registered}" />
     </bean>
@@ -347,6 +349,8 @@
 
     <bean id="backupRepositoryService" class="org.apache.cloudstack.backup.BackupRepositoryServiceImpl" />
 
+    <bean id="kvmBackupExportService" class="org.apache.cloudstack.backup.KVMBackupExportServiceImpl" />
+
     <bean id="storageLayer" class="com.cloud.storage.JavaStorageLayer" />
 
     <bean id="nfsMountManager" class="org.apache.cloudstack.storage.NfsMountManagerImpl" >
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
index 00cac5bbd52c..f39ed06a656b 100644
--- a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
@@ -193,7 +193,7 @@ public void allocateToTestSuitableHostsEmptyShouldReturnNull() {
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(emptyList).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(emptyList).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
 
     Assert.assertNull(suitableHosts);
@@ -208,7 +208,7 @@ public void allocateToTestSuitableHostsNotEmptyShouldCallAllocateToMethod() {
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
@@ -226,7 +226,7 @@ public void allocateToTestProvidedHostsNotNullShouldCallAddHostsToAvoidSetMethod
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
@@ -245,7 +245,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndHaTagNotNullShouldReturnOnlyH
     Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -262,7 +263,8 @@ public void retrieveHostsTestHostsToFilterIsNotNullAndHaTagNotNullShouldReturnOn
     Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, hostsToFilter, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, hostsToFilter, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -278,7 +280,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagAndNoHostTagShouldRetu
     Mockito.doReturn(upAndEnabledHostsWithNoHa).when(resourceManagerMock).listAllUpAndEnabledNonHAHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.nullable(String.class), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, null, null);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, null, null);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -293,7 +296,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagWithHostTagShouldCallR
     Mockito.doNothing().when(firstFitAllocatorSpy).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Mockito.verify(firstFitAllocatorSpy, Mockito.times(1)).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
   }
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
index ab9b322eb843..938ed7a152ea 100644
--- a/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
@@ -222,6 +222,7 @@ public void retrieveHostsTestProvidedHostsNullAndNoHostTagAndNoTagRuleShouldOnly
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -237,6 +238,7 @@ public void retrieveHostsTestProvidedHostsNullAndOnlyHostTagsRulesShouldReturnHo
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -252,6 +254,7 @@ public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndNoHostWi
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -267,6 +270,7 @@ public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndHostWith
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -281,6 +285,7 @@ public void retrieveHostsTestProvidedHostsNotNullAndNoHostTagAndNoTagRuleShouldO
 
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -295,6 +300,7 @@ public void retrieveHostsTestProvidedHostsNotNullAndOnlyHostTagsRulesShouldRetur
 
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -309,6 +315,7 @@ public void retrieveHostsTestProvidedHostsNotNullProvidedHostTagsNotNullAndNoHos
 
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -323,6 +330,7 @@ public void retrieveHostsTestProvidedHostsNullNotProvidedHostTagsNotNullAndHostW
 
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
diff --git a/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java b/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java
new file mode 100644
index 000000000000..64da9abff1ef
--- /dev/null
+++ b/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api.query.dao;
+
+import static org.junit.Assert.assertSame;
+import static org.mockito.AdditionalMatchers.aryEq;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class StoragePoolJoinDaoImplTest {
+
+    @Spy
+    @InjectMocks
+    private StoragePoolJoinDaoImpl storagePoolJoinDao = new StoragePoolJoinDaoImpl();
+
+    @Mock
+    private SearchCriteria<StoragePoolJoinVO> searchCriteria;
+
+    @Before
+    @SuppressWarnings("unchecked")
+    public void setUp() {
+        StoragePoolJoinVO storagePoolJoinVO = mock(StoragePoolJoinVO.class);
+        SearchBuilder<StoragePoolJoinVO> searchBuilder = mock(SearchBuilder.class);
+        when(searchBuilder.entity()).thenReturn(storagePoolJoinVO);
+        when(searchBuilder.create()).thenReturn(searchCriteria);
+        doReturn(searchBuilder).when(storagePoolJoinDao).createSearchBuilder();
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeReturnsMatchingPoolsWhenTypesAreProvided() {
+        long zoneId = 42L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.KVM;
+        List<Storage.StoragePoolType> types = Arrays.asList(Storage.StoragePoolType.NetworkFilesystem, Storage.StoragePoolType.Filesystem);
+        Filter filter = mock(Filter.class);
+        List<StoragePoolJoinVO> expectedPools = Collections.singletonList(mock(StoragePoolJoinVO.class));
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, filter);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, types, filter);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria).setParameters(eq("types"), aryEq(types.toArray()));
+        verify(storagePoolJoinDao).listBy(searchCriteria, filter);
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeSkipsTypeFilterWhenTypesAreNull() {
+        long zoneId = 7L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.VMware;
+        Filter filter = mock(Filter.class);
+        List<StoragePoolJoinVO> expectedPools = Collections.emptyList();
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, filter);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, null, filter);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria, never()).setParameters(eq("types"), any(Object[].class));
+        verify(storagePoolJoinDao).listBy(searchCriteria, filter);
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeSkipsTypeFilterForEmptyTypesAndPassesNullFilter() {
+        long zoneId = 9L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.XenServer;
+        List<StoragePoolJoinVO> expectedPools = Collections.singletonList(mock(StoragePoolJoinVO.class));
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, null);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, Collections.emptyList(), null);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria, never()).setParameters(eq("types"), any(Object[].class));
+        verify(storagePoolJoinDao).listBy(searchCriteria, null);
+    }
+}
diff --git a/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java b/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
index 286d4d04fa66..dd45324db410 100644
--- a/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
+++ b/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
@@ -872,6 +872,7 @@ public void testResetConfigurations() {
         Mockito.when(cmd.getAccountId()).thenReturn(null);
         Mockito.when(cmd.getDomainId()).thenReturn(null);
         Mockito.when(cmd.getImageStoreId()).thenReturn(null);
+        Mockito.when(cmd.getManagementServerId()).thenReturn(null);
 
         ConfigurationVO cfg = new ConfigurationVO("Advanced", "DEFAULT", "test", "pool.storage.capacity.disablethreshold", null, "description");
         cfg.setScope(10);
diff --git a/server/src/test/java/com/cloud/keystore/KeystoreTest.java b/server/src/test/java/com/cloud/keystore/KeystoreTest.java
index 970892dc325e..2b991d4a4f7c 100644
--- a/server/src/test/java/com/cloud/keystore/KeystoreTest.java
+++ b/server/src/test/java/com/cloud/keystore/KeystoreTest.java
@@ -75,20 +75,20 @@ public void testKeystoreSave() throws Exception {
             ComponentLocator locator = ComponentLocator.getCurrentLocator();
 
             KeystoreDao ksDao = locator.getDao(KeystoreDao.class);
-            ksDao.save("CPVMCertificate", "CPVMCertificate", "KeyForCertificate", "realhostip.com");
+            ksDao.save("CPVMCertificate", "CPVMCertificate", "KeyForCertificate", "example.com");
             ksVo = ksDao.findByName("CPVMCertificate");
             assertTrue(ksVo != null);
             assertTrue(ksVo.getCertificate().equals("CPVMCertificate"));
             assertTrue(ksVo.getKey().equals("KeyForCertificate"));
-            assertTrue(ksVo.getDomainSuffix().equals("realhostip.com"));
+            assertTrue(ksVo.getDomainSuffix().equals("example.com"));
 
-            ksDao.save("CPVMCertificate", "CPVMCertificate Again", "KeyForCertificate Again", "again.realhostip.com");
+            ksDao.save("CPVMCertificate", "CPVMCertificate Again", "KeyForCertificate Again", "again.example.com");
 
             ksVo = ksDao.findByName("CPVMCertificate");
             assertTrue(ksVo != null);
             assertTrue(ksVo.getCertificate().equals("CPVMCertificate Again"));
             assertTrue(ksVo.getKey().equals("KeyForCertificate Again"));
-            assertTrue(ksVo.getDomainSuffix().equals("again.realhostip.com"));
+            assertTrue(ksVo.getDomainSuffix().equals("again.example.com"));
 
             ksDao.expunge(ksVo.getId());
         }
@@ -112,9 +112,9 @@ public void testKeystoreManager() throws Exception {
             assertTrue(ksMgr.configure("TaskManager", new HashMap<String, Object>()));
             assertTrue(ksMgr.start());
 
-            ksMgr.saveCertificate("CPVMCertificate", certContent, keyContent, "realhostip.com");
+            ksMgr.saveCertificate("CPVMCertificate", certContent, keyContent, "example.com");
 
-            byte[] ksBits = ksMgr.getKeystoreBits("CPVMCertificate", "realhostip", "vmops.com");
+            byte[] ksBits = ksMgr.getKeystoreBits("CPVMCertificate", "example", "vmops.com");
             assertTrue(ksBits != null);
 
             try {
diff --git a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
index 924bf1135a67..e69f927b41e0 100644
--- a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
+++ b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
@@ -788,6 +788,7 @@ public void testSearchForConfigurations() {
         Mockito.when(cmd.getAccountId()).thenReturn(null);
         Mockito.when(cmd.getDomainId()).thenReturn(null);
         Mockito.when(cmd.getImageStoreId()).thenReturn(null);
+        Mockito.when(cmd.getManagementServerId()).thenReturn(null);
 
         SearchCriteria<ConfigurationVO> sc = Mockito.mock(SearchCriteria.class);
         Mockito.when(configDao.createSearchCriteria()).thenReturn(sc);
diff --git a/server/src/test/java/com/cloud/storage/ClvmPoolManagerTest.java b/server/src/test/java/com/cloud/storage/ClvmPoolManagerTest.java
new file mode 100644
index 000000000000..1678b3760919
--- /dev/null
+++ b/server/src/test/java/com/cloud/storage/ClvmPoolManagerTest.java
@@ -0,0 +1,936 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.storage;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.clvm.ClvmPoolManager;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferAnswer;
+import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.Arrays;
+import java.util.Collections;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@RunWith(MockitoJUnitRunner.class)
+public class ClvmPoolManagerTest {
+
+    @Mock
+    private VolumeDetailsDao volsDetailsDao;
+
+    @Mock
+    private AgentManager agentMgr;
+
+    @Mock
+    private HostDao hostDao;
+
+    @InjectMocks
+    private ClvmPoolManager clvmPoolManager;
+
+    private static final Long VOLUME_ID = 100L;
+    private static final Long HOST_ID_1 = 1L;
+    private static final Long HOST_ID_2 = 2L;
+    private static final String VOLUME_UUID = "test-volume-uuid";
+    private static final String VOLUME_PATH = "test-volume-path";
+    private static final String VG_NAME = "acsvg";
+
+    @Before
+    public void setUp() {
+        Mockito.reset(volsDetailsDao, agentMgr, hostDao);
+    }
+
+    @Test
+    public void testGetClvmLockHostId_Success() {
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue("123");
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        Long result = clvmPoolManager.getClvmLockHostId(VOLUME_ID, VOLUME_UUID);
+
+        Assert.assertEquals(Long.valueOf(123), result);
+    }
+
+    @Test
+    public void testGetClvmLockHostId_NoDetail() {
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        Long result = clvmPoolManager.getClvmLockHostId(VOLUME_ID, VOLUME_UUID);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testGetClvmLockHostId_InvalidNumber() {
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue("invalid");
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        Long result = clvmPoolManager.getClvmLockHostId(VOLUME_ID, VOLUME_UUID);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testSetClvmLockHostId_NewDetail() {
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        clvmPoolManager.setClvmLockHostId(VOLUME_ID, HOST_ID_1);
+
+        verify(volsDetailsDao, times(1)).addDetail(eq(VOLUME_ID), eq(ClvmPoolManager.CLVM_LOCK_HOST_ID),
+                eq(String.valueOf(HOST_ID_1)), eq(false));
+        verify(volsDetailsDao, never()).update(anyLong(), any());
+    }
+
+    @Test
+    public void testSetClvmLockHostId_UpdateExisting() {
+        VolumeDetailVO existingDetail = Mockito.mock(VolumeDetailVO.class);
+        when(existingDetail.getId()).thenReturn(50L);
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(existingDetail);
+
+        clvmPoolManager.setClvmLockHostId(VOLUME_ID, HOST_ID_2);
+
+        verify(existingDetail, times(1)).setValue(String.valueOf(HOST_ID_2));
+        verify(volsDetailsDao, times(1)).update(eq(50L), eq(existingDetail));
+        verify(volsDetailsDao, never()).addDetail(anyLong(), any(), any(), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void testClearClvmLockHostDetail_Success() {
+        VolumeVO volume = Mockito.mock(VolumeVO.class);
+        when(volume.getId()).thenReturn(VOLUME_ID);
+        when(volume.getUuid()).thenReturn(VOLUME_UUID);
+
+        VolumeDetailVO detail = Mockito.mock(VolumeDetailVO.class);
+        when(detail.getId()).thenReturn(99L);
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        clvmPoolManager.clearClvmLockHostDetail(volume);
+
+        verify(volsDetailsDao, times(1)).remove(99L);
+    }
+
+    @Test
+    public void testClearClvmLockHostDetail_NoDetail() {
+        VolumeVO volume = Mockito.mock(VolumeVO.class);
+        when(volume.getId()).thenReturn(VOLUME_ID);
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        clvmPoolManager.clearClvmLockHostDetail(volume);
+
+        verify(volsDetailsDao, never()).remove(anyLong());
+    }
+
+    @Test
+    public void testTransferClvmVolumeLock_Success() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getPath()).thenReturn("/" + VG_NAME);
+
+        HostVO sourceHost = Mockito.mock(HostVO.class);
+        when(sourceHost.getStatus()).thenReturn(Status.Up);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(sourceHost);
+
+        Answer deactivateAnswer = new Answer(null, true, null);
+        Answer activateAnswer = new Answer(null, true, null);
+
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(deactivateAnswer);
+        when(agentMgr.send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class))).thenReturn(activateAnswer);
+
+        boolean result = clvmPoolManager.transferClvmVolumeLock(VOLUME_UUID, VOLUME_ID,
+                VOLUME_PATH, pool, HOST_ID_1, HOST_ID_2);
+
+        Assert.assertTrue(result);
+        verify(agentMgr, times(2)).send(anyLong(), any(ClvmLockTransferCommand.class));
+    }
+
+    @Test
+    public void testTransferClvmVolumeLock_NullPool() {
+        boolean result = clvmPoolManager.transferClvmVolumeLock(VOLUME_UUID, VOLUME_ID,
+                VOLUME_PATH, null, HOST_ID_1, HOST_ID_2);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testTransferClvmVolumeLock_SameHost() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getPath()).thenReturn("/" + VG_NAME);
+
+        Answer activateAnswer = new Answer(null, true, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(activateAnswer);
+
+        boolean result = clvmPoolManager.transferClvmVolumeLock(VOLUME_UUID, VOLUME_ID,
+                VOLUME_PATH, pool, HOST_ID_1, HOST_ID_1);
+
+        Assert.assertTrue(result);
+        verify(agentMgr, times(1)).send(anyLong(), any(ClvmLockTransferCommand.class));
+    }
+
+    @Test
+    public void testTransferClvmVolumeLock_ActivationFails() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        Answer activateAnswer = new Answer(null, false, "Activation failed");
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(activateAnswer);
+
+        boolean result = clvmPoolManager.transferClvmVolumeLock(VOLUME_UUID, VOLUME_ID,
+                VOLUME_PATH, pool, HOST_ID_1, HOST_ID_1);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testTransferClvmVolumeLock_AgentUnavailable() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(agentMgr.send(anyLong(), any(ClvmLockTransferCommand.class)))
+                .thenThrow(new AgentUnavailableException("Agent unavailable", HOST_ID_2));
+
+        boolean result = clvmPoolManager.transferClvmVolumeLock(VOLUME_UUID, VOLUME_ID,
+                VOLUME_PATH, pool, HOST_ID_1, HOST_ID_2);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_NullPool() {
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, null, false);
+
+        Assert.assertNull(result);
+        verify(hostDao, never()).findByClusterId(anyLong(), any());
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_NoHostsInCluster() {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        when(pool.getDataCenterId()).thenReturn(1L);
+        when(pool.getName()).thenReturn("test-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.emptyList());
+        lenient().when(hostDao.findByDataCenterId(1L)).thenReturn(Collections.emptyList());
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+        verify(hostDao, times(1)).findByClusterId(10L, Host.Type.Routing);
+        verify(hostDao, times(0)).findByDataCenterId(1L);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_ZoneScopedPool() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(null);
+        when(pool.getDataCenterId()).thenReturn(1L);
+        Mockito.lenient().when(pool.getName()).thenReturn("zone-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByDataCenterId(1L)).thenReturn(Collections.singletonList(host));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(hostDao, never()).findByClusterId(anyLong(), any());
+        verify(hostDao, times(1)).findByDataCenterId(1L);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_SuccessfulQuery() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(agentMgr, times(1)).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+        verify(hostDao, never()).findByName(any());
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_VolumeNotLocked() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        // QUERY reports inactive; ACTIVATE_EXCLUSIVE left unstubbed → null answer → recovery fails → returns null
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_EmptyHostname() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        // QUERY reports inactive with empty hostname; ACTIVATE_EXCLUSIVE left unstubbed → null answer → recovery fails → returns null
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "", false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_HostnameNotResolved() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "unknown-host", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(hostDao, never()).findByName(any());
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_QueryFails() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        Answer failedAnswer = new Answer(null, false, "Query failed");
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(failedAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_NullAnswer() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(null);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_AgentUnavailableException() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class)))
+                .thenThrow(new AgentUnavailableException("Host unavailable", HOST_ID_1));
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_OperationTimedoutException() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class)))
+                .thenThrow(new OperationTimedoutException(null, HOST_ID_1, 0, 0, false));
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_UpdateDatabase_MatchingValue() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        Mockito.lenient().when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        Mockito.lenient().when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        // DB has correct value, fast path: query HOST_ID_1, returns active
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host);
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        // Fast path succeeded - no DB write needed, no fan-out
+        verify(volsDetailsDao, never()).update(anyLong(), any());
+        verify(volsDetailsDao, never()).addDetail(anyLong(), any(), any(), Mockito.anyBoolean());
+        verify(hostDao, never()).findByClusterId(anyLong(), any());
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_UpdateDatabase_DifferentValue() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        // DB says HOST_ID_1, but actual lock is on HOST_ID_2
+        // Fast path: query HOST_ID_1, inactive: fall back to fan-out
+        VolumeDetailVO detail = Mockito.mock(VolumeDetailVO.class);
+        when(detail.getValue()).thenReturn(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+        when(detail.getId()).thenReturn(99L);
+
+        HostVO host1 = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        HostVO host2 = createMockHost(HOST_ID_2, "host2", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host1);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(host1, host2));
+
+        // HOST_ID_1 reports inactive (fast path miss), HOST_ID_2 reports active (fan-out)
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, "host1", false, false, null);
+        ClvmLockTransferAnswer activeAnswer   = new ClvmLockTransferAnswer(null, true, null, "host2", true,  false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(inactiveAnswer);
+        when(agentMgr.send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class))).thenReturn(activeAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_2, result);
+        // DB should be corrected to HOST_ID_2
+        verify(detail, times(1)).setValue(String.valueOf(HOST_ID_2));
+        verify(volsDetailsDao, times(1)).update(eq(99L), eq(detail));
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_UpdateDatabase_NoExistingDetail() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        // No DB record, fast path skipped, fan-out finds HOST_ID_1
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(volsDetailsDao, times(1)).addDetail(eq(VOLUME_ID), eq(ClvmPoolManager.CLVM_LOCK_HOST_ID),
+                eq(String.valueOf(HOST_ID_1)), eq(false));
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_UpdateDatabase_RemoveDetailWhenUnlocked() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        // DB has HOST_ID_1, fast path query returns inactive: fan-out also finds nothing
+        VolumeDetailVO detail = Mockito.mock(VolumeDetailVO.class);
+        when(detail.getId()).thenReturn(99L);
+        when(detail.getValue()).thenReturn(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        // QUERY_LOCK_STATE: inactive (fast path miss; HOST_ID_1 skipped in fan-out as dbHostId)
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        // ACTIVATE_EXCLUSIVE: recovery attempt fails — stale DB record must still be removed
+        Answer failedActivation = new Answer(null, false, "Simulated activation failure for test");
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE)))
+                .thenReturn(failedActivation);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertNull(result);
+        verify(volsDetailsDao, times(1)).remove(99L);
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_SkipsNonKVMHosts() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO xenHost = createMockHost(10L, "xen-host", Status.Up, Hypervisor.HypervisorType.XenServer);
+        HostVO kvmHost = createMockHost(HOST_ID_1, "kvm-host", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(xenHost, kvmHost));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "kvm-host", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(agentMgr, never()).send(eq(10L), any(ClvmLockTransferCommand.class));
+        verify(agentMgr, times(1)).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_SkipsDownHosts() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO downHost = createMockHost(10L, "down-host", Status.Down, Hypervisor.HypervisorType.KVM);
+        HostVO upHost = createMockHost(HOST_ID_1, "up-host", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(downHost, upHost));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "up-host", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(agentMgr, never()).send(eq(10L), any(ClvmLockTransferCommand.class));
+        verify(agentMgr, times(1)).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+    }
+
+    @Test
+    public void testQueryCurrentLockHolder_PathWithLeadingSlash() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn("/" + VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host));
+
+        ClvmLockTransferAnswer answer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(answer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+    }
+
+    /**
+     * Fast path: DB has the correct host, single query confirms isActive=true.
+     * No fan-out should occur.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_FastPath_HitOnDbHost() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO host = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host);
+
+        ClvmLockTransferAnswer activeAnswer = new ClvmLockTransferAnswer(null, true, null, "host1", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(activeAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        // Only one agent call, no cluster host lookup, no fan-out
+        verify(agentMgr, times(1)).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+        verify(hostDao, never()).findByClusterId(anyLong(), any());
+        verify(hostDao, never()).findByDataCenterId(anyLong());
+    }
+
+    /**
+     * Fast path miss: DB has HOST_ID_1 but it's inactive. Fan-out finds HOST_ID_2.
+     * HOST_ID_1 should NOT be queried again during fan-out.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_FastPath_MissDbHost_FanOutFindsOther() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO host1 = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        HostVO host2 = createMockHost(HOST_ID_2, "host2", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host1);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(host1, host2));
+
+        // Fast path: HOST_ID_1 inactive
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, "host1", false, false, null);
+        // Fan-out: HOST_ID_2 active (HOST_ID_1 skipped)
+        ClvmLockTransferAnswer activeAnswer   = new ClvmLockTransferAnswer(null, true, null, "host2", true,  false, null);
+        when(agentMgr.send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class))).thenReturn(inactiveAnswer);
+        when(agentMgr.send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class))).thenReturn(activeAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_2, result);
+        // HOST_ID_1 queried once (fast path only), HOST_ID_2 queried once (fan-out)
+        verify(agentMgr, times(1)).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+        verify(agentMgr, times(1)).send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class));
+    }
+
+    /**
+     * Fast path skip: DB host is DOWN. Fan-out proceeds to all UP hosts.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_FastPath_DbHostDown_FanOut() throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO downHost = createMockHost(HOST_ID_1, "host1", Status.Down, Hypervisor.HypervisorType.KVM);
+        HostVO upHost   = createMockHost(HOST_ID_2, "host2", Status.Up,   Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(downHost);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(downHost, upHost));
+
+        ClvmLockTransferAnswer activeAnswer = new ClvmLockTransferAnswer(null, true, null, "host2", true, false, null);
+        when(agentMgr.send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class))).thenReturn(activeAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertEquals(HOST_ID_2, result);
+        // No query to the down host at all
+        verify(agentMgr, never()).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+        verify(agentMgr, times(1)).send(eq(HOST_ID_2), any(ClvmLockTransferCommand.class));
+    }
+
+
+    /**
+     * Inactive everywhere, DB host is UP: recovery activates exclusively on the DB host.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_InactiveEverywhere_ActivatesOnDbHost()
+            throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        VolumeDetailVO detail = Mockito.mock(VolumeDetailVO.class);
+        when(detail.getId()).thenReturn(99L);
+        when(detail.getValue()).thenReturn(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO host1 = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(host1);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host1));
+
+        // Fast path QUERY → inactive
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        // Recovery ACTIVATE_EXCLUSIVE → succeeds
+        Answer activateAnswer = new Answer(null, true, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE)))
+                .thenReturn(activateAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(detail, times(1)).setValue(String.valueOf(HOST_ID_1));
+        verify(volsDetailsDao, times(1)).update(eq(99L), eq(detail));
+        verify(volsDetailsDao, never()).remove(anyLong());
+    }
+
+    /**
+     * Inactive everywhere, no DB record: recovery falls back to the first UP KVM host in cluster.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_InactiveEverywhere_ActivatesOnClusterHostWhenNoDbRecord()
+            throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host1 = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host1));
+
+        // Fan-out QUERY → inactive
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        // Recovery ACTIVATE_EXCLUSIVE → succeeds
+        Answer activateAnswer = new Answer(null, true, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE)))
+                .thenReturn(activateAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_1, result);
+        verify(volsDetailsDao, times(1)).addDetail(eq(VOLUME_ID), eq(ClvmPoolManager.CLVM_LOCK_HOST_ID),
+                eq(String.valueOf(HOST_ID_1)), eq(false));
+    }
+
+    /**
+     * Inactive everywhere, DB host is DOWN: selectActivationTargetHost skips it and picks
+     * the first UP host from the cluster list.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_InactiveEverywhere_SkipsDownDbHost_ActivatesOnClusterHost()
+            throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        VolumeDetailVO detail = new VolumeDetailVO();
+        detail.setValue(String.valueOf(HOST_ID_1));
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(detail);
+
+        HostVO downHost = createMockHost(HOST_ID_1, "host1", Status.Down, Hypervisor.HypervisorType.KVM);
+        HostVO upHost   = createMockHost(HOST_ID_2, "host2", Status.Up,   Hypervisor.HypervisorType.KVM);
+        when(hostDao.findById(HOST_ID_1)).thenReturn(downHost);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Arrays.asList(downHost, upHost));
+
+        // Fan-out QUERY on HOST_ID_2 → inactive (HOST_ID_1 filtered by Status.Down)
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_2), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        // Recovery ACTIVATE_EXCLUSIVE on HOST_ID_2 → succeeds
+        Answer activateAnswer = new Answer(null, true, null);
+        when(agentMgr.send(eq(HOST_ID_2), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE)))
+                .thenReturn(activateAnswer);
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, true);
+
+        Assert.assertEquals(HOST_ID_2, result);
+        verify(agentMgr, never()).send(eq(HOST_ID_1), any(ClvmLockTransferCommand.class));
+    }
+
+    /**
+     * Inactive everywhere, recovery activation throws AgentUnavailableException: returns null,
+     * no crash, no DB side-effects (updateDatabase=false).
+     */
+    @Test
+    public void testQueryCurrentLockHolder_InactiveEverywhere_ActivationThrows_ReturnsNull()
+            throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        HostVO host1 = createMockHost(HOST_ID_1, "host1", Status.Up, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(host1));
+
+        ClvmLockTransferAnswer inactiveAnswer = new ClvmLockTransferAnswer(null, true, null, null, false, false, null);
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.QUERY_LOCK_STATE)))
+                .thenReturn(inactiveAnswer);
+
+        when(agentMgr.send(eq(HOST_ID_1), Mockito.<Command>argThat(cmd ->
+                cmd instanceof ClvmLockTransferCommand
+                        && ((ClvmLockTransferCommand) cmd).getOperation()
+                                == ClvmLockTransferCommand.Operation.ACTIVATE_EXCLUSIVE)))
+                .thenThrow(new AgentUnavailableException("Host unreachable during recovery", HOST_ID_1));
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+        verify(volsDetailsDao, never()).remove(anyLong());
+        verify(volsDetailsDao, never()).addDetail(anyLong(), any(), any(), Mockito.anyBoolean());
+    }
+
+    /**
+     * Inactive everywhere, no UP KVM host available: selectActivationTargetHost returns null,
+     * no activation is attempted, returns null immediately.
+     */
+    @Test
+    public void testQueryCurrentLockHolder_InactiveEverywhere_NoEligibleHost_ReturnsNull()
+            throws AgentUnavailableException, OperationTimedoutException {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        when(pool.getClusterId()).thenReturn(10L);
+        Mockito.lenient().when(pool.getName()).thenReturn("cluster-pool");
+        when(pool.getPath()).thenReturn(VG_NAME);
+
+        when(volsDetailsDao.findDetail(VOLUME_ID, ClvmPoolManager.CLVM_LOCK_HOST_ID)).thenReturn(null);
+
+        // Only a DOWN host exists — selectActivationTargetHost finds no eligible host
+        HostVO downHost = createMockHost(HOST_ID_1, "host1", Status.Down, Hypervisor.HypervisorType.KVM);
+        when(hostDao.findByClusterId(10L, Host.Type.Routing)).thenReturn(Collections.singletonList(downHost));
+
+        Long result = clvmPoolManager.queryCurrentLockHolder(VOLUME_ID, VOLUME_UUID, VOLUME_PATH, pool, false);
+
+        Assert.assertNull(result);
+        verify(agentMgr, never()).send(anyLong(), any(ClvmLockTransferCommand.class));
+    }
+
+    // Helper method to create mock hosts
+    private HostVO createMockHost(Long id, String name, Status status, Hypervisor.HypervisorType hypervisor) {
+        HostVO host = Mockito.mock(HostVO.class);
+        Mockito.lenient().when(host.getId()).thenReturn(id);
+        Mockito.lenient().when(host.getName()).thenReturn(name);
+        Mockito.lenient().when(host.getStatus()).thenReturn(status);
+        Mockito.lenient().when(host.getType()).thenReturn(Host.Type.Routing);
+        Mockito.lenient().when(host.getHypervisorType()).thenReturn(hypervisor);
+        return host;
+    }
+}
diff --git a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
index 77e321ab8591..b4153e31cfe0 100644
--- a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
+++ b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
@@ -46,6 +46,7 @@
 import com.cloud.resourcelimit.CheckedReservation;
 import com.cloud.service.ServiceOfferingVO;
 import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.clvm.ClvmPoolManager;
 import com.cloud.vm.snapshot.VMSnapshot;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
@@ -102,6 +103,7 @@
 import com.cloud.configuration.ConfigurationManager;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenter;
 import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.HostPodVO;
 import com.cloud.dc.dao.ClusterDao;
@@ -112,6 +114,7 @@
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.offering.DiskOffering;
 import com.cloud.org.Grouping;
 import com.cloud.projects.Project;
 import com.cloud.projects.ProjectManager;
@@ -226,6 +229,8 @@ public class VolumeApiServiceImplTest {
     ClusterDao clusterDao;
     @Mock
     VolumeOrchestrationService volumeOrchestrationService;
+    @Mock
+    ClvmPoolManager clvmPoolManager;
 
 
     private DetachVolumeCmd detachCmd = new DetachVolumeCmd();
@@ -467,6 +472,111 @@ public void setup() throws InterruptedException, ExecutionException {
         when(_jobMgr.submitAsyncJob(any(AsyncJobVO.class), any(String.class), any(Long.class))).thenReturn(1L);
     }
 
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsDefaultOfferingWhenAccessibleAndEncryptionNotRequired() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(11L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
+
+        Assert.assertEquals(Long.valueOf(11L), result);
+        Mockito.verify(_diskOfferingDao, Mockito.never()).listCustomDiskOfferings();
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsDefaultOfferingWhenEncryptedOnlyAndDefaultOfferingIsEncrypted() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(12L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.when(_diskOfferingDao.findById(12L)).thenReturn(defaultOffering);
+        Mockito.when(defaultOffering.getEncrypt()).thenReturn(true);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertEquals(Long.valueOf(12L), result);
+        Mockito.verify(_diskOfferingDao, Mockito.never()).listCustomDiskOfferings();
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadFallsBackToEncryptedCustomOfferingWhenDefaultOfferingNotEncrypted() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO nonEncryptedOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO encryptedOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(13L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.when(_diskOfferingDao.findById(13L)).thenReturn(defaultOffering);
+        Mockito.when(defaultOffering.getEncrypt()).thenReturn(false);
+
+        Mockito.when(nonEncryptedOffering.getEncrypt()).thenReturn(false);
+        Mockito.when(encryptedOffering.getEncrypt()).thenReturn(true);
+        Mockito.when(encryptedOffering.getId()).thenReturn(23L);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(nonEncryptedOffering, encryptedOffering));
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertEquals(Long.valueOf(23L), result);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, encryptedOffering, zone);
+        Mockito.verify(_configMgr, Mockito.never()).checkDiskOfferingAccess(owner, nonEncryptedOffering, zone);
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadFallsBackWhenDefaultOfferingIsNotAccessible() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO deniedOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO allowedOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.doThrow(new PermissionDeniedException("default denied")).when(_configMgr).checkDiskOfferingAccess(owner, defaultOffering, zone);
+
+        Mockito.when(allowedOffering.getId()).thenReturn(24L);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(deniedOffering, allowedOffering));
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, deniedOffering, zone);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
+
+        Assert.assertEquals(Long.valueOf(24L), result);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, deniedOffering, zone);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, allowedOffering, zone);
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsNullWhenNoAccessibleEligibleCustomOfferingExists() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO firstEncrypted = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO secondEncrypted = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Inactive);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+
+        Mockito.when(firstEncrypted.getEncrypt()).thenReturn(true);
+        Mockito.when(secondEncrypted.getEncrypt()).thenReturn(true);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(firstEncrypted, secondEncrypted));
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, firstEncrypted, zone);
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, secondEncrypted, zone);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertNull(result);
+    }
+
     /**
      * TESTS FOR DETACH ROOT VOLUME, COUNT=4
      */
@@ -601,26 +711,22 @@ public void testTakeSnapshotF2() throws ResourceAllocationException {
 
     @Test
     public void testNullGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn(null);
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(null));
     }
 
     @Test
     public void testEmptyGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("");
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(""));
     }
 
     @Test
     public void testBlankGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("   ");
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand("   "));
     }
 
     @Test
     public void testNonEmptyGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("abc");
-        Assert.assertSame(volumeApiServiceImpl.getVolumeNameFromCommand(createVol), "abc");
+        Assert.assertSame(volumeApiServiceImpl.getVolumeNameFromCommand("abc"), "abc");
     }
 
     @Test
@@ -2193,7 +2299,7 @@ public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ThrowsEx
     }
 
     @Test
-    public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ReturnSameVolumeInfo() {
+    public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ReturnsSameVolumeInfo() {
         VolumeInfo volumeToAttach = Mockito.mock(VolumeInfo.class);
         Mockito.when(volumeToAttach.getState()).thenReturn(Volume.State.Allocated);
         UserVmVO vm = Mockito.mock(UserVmVO.class);
@@ -2320,4 +2426,290 @@ private List<VMSnapshotVO> generateVmSnapshotVoList(VMSnapshot.Type t1, VMSnapsh
         Mockito.doReturn(1L).when(mock2).getId();
         return List.of(mock1, mock2);
     }
+
+    @Test
+    public void testIsClvmLightweightMigrationNeeded_SameVG() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 200L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(volumePool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(volumePool.getPath()).thenReturn("/vg1");
+        Mockito.when(vmPool.getPath()).thenReturn("/vg1");
+
+        Mockito.when(volumeServiceMock.isLightweightMigrationNeeded(
+                Storage.StoragePoolType.CLVM, Storage.StoragePoolType.CLVM,
+                "/vg1", "/vg1")).thenReturn(true);
+
+        boolean result = invokePrivateMethod("isClvmLightweightMigrationNeeded",
+                new Class[]{VolumeInfo.class, VolumeVO.class},
+                volumeInfo, vmExistingVolume);
+
+        Assert.assertTrue(result);
+        Mockito.verify(volumeServiceMock).isLightweightMigrationNeeded(
+                Storage.StoragePoolType.CLVM, Storage.StoragePoolType.CLVM, "/vg1", "/vg1");
+    }
+
+    @Test
+    public void testIsClvmLightweightMigrationNeeded_DifferentVG() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 200L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(volumePool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(volumePool.getPath()).thenReturn("/vg1");
+        Mockito.when(vmPool.getPath()).thenReturn("/vg2");
+
+        Mockito.when(volumeServiceMock.isLightweightMigrationNeeded(
+                Storage.StoragePoolType.CLVM, Storage.StoragePoolType.CLVM,
+                "/vg1", "/vg2")).thenReturn(false);
+
+        boolean result = invokePrivateMethod("isClvmLightweightMigrationNeeded",
+                new Class[]{VolumeInfo.class, VolumeVO.class},
+                volumeInfo, vmExistingVolume);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testIsClvmLightweightMigrationNeeded_CLVM_NG_SameVG() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 200L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(volumePool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM_NG);
+        Mockito.when(volumePool.getPath()).thenReturn("/vg1");
+        Mockito.when(vmPool.getPath()).thenReturn("/vg1");
+
+        Mockito.when(volumeServiceMock.isLightweightMigrationNeeded(
+                Storage.StoragePoolType.CLVM_NG, Storage.StoragePoolType.CLVM_NG,
+                "/vg1", "/vg1")).thenReturn(true);
+
+        boolean result = invokePrivateMethod("isClvmLightweightMigrationNeeded",
+                new Class[]{VolumeInfo.class, VolumeVO.class},
+                volumeInfo, vmExistingVolume);
+
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_DifferentHosts() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 100L; // Same pool
+        Long vmHostId = 10L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(vm.getHostId()).thenReturn(vmHostId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getId()).thenReturn(vmPoolId);
+
+        Mockito.when(volumeServiceMock.isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(vmHostId))).thenReturn(true);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, vm);
+
+        Assert.assertTrue(result);
+        Mockito.verify(volumeServiceMock).isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(vmHostId));
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_SameHost() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 100L;
+        Long vmHostId = 10L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(vm.getHostId()).thenReturn(vmHostId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getId()).thenReturn(vmPoolId);
+
+        Mockito.when(volumeServiceMock.isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(vmHostId))).thenReturn(false);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, vm);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_DifferentPools() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 200L; // Different pool
+        Long vmHostId = 10L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(vm.getHostId()).thenReturn(vmHostId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(volumePool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(volumePool.getId()).thenReturn(volumePoolId);
+        Mockito.when(vmPool.getId()).thenReturn(vmPoolId);
+
+        Mockito.when(volumeServiceMock.isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(vmHostId))).thenReturn(false);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, vm);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_NonCLVMPool() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 100L;
+        Long vmHostId = 10L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(vm.getHostId()).thenReturn(vmHostId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getId()).thenReturn(vmPoolId);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, vm);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_NullVM() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, null);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testIsClvmLockTransferRequired_VMStoppedUsesLastHostId() {
+        VolumeInfo volumeInfo = Mockito.mock(VolumeInfo.class);
+        VolumeVO vmExistingVolume = Mockito.mock(VolumeVO.class);
+        UserVmVO vm = Mockito.mock(UserVmVO.class);
+        StoragePoolVO volumePool = Mockito.mock(StoragePoolVO.class);
+        StoragePoolVO vmPool = Mockito.mock(StoragePoolVO.class);
+
+        Long volumePoolId = 100L;
+        Long vmPoolId = 100L;
+        Long lastHostId = 10L;
+
+        Mockito.when(volumeInfo.getPoolId()).thenReturn(volumePoolId);
+        Mockito.when(vmExistingVolume.getPoolId()).thenReturn(vmPoolId);
+        Mockito.when(vm.getHostId()).thenReturn(null); // VM is stopped
+        Mockito.when(vm.getLastHostId()).thenReturn(lastHostId);
+        Mockito.when(primaryDataStoreDaoMock.findById(volumePoolId)).thenReturn(volumePool);
+        Mockito.when(primaryDataStoreDaoMock.findById(vmPoolId)).thenReturn(vmPool);
+
+        Mockito.when(vmPool.getPoolType()).thenReturn(Storage.StoragePoolType.CLVM);
+        Mockito.when(vmPool.getId()).thenReturn(vmPoolId);
+
+        Mockito.when(volumeServiceMock.isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(lastHostId))).thenReturn(true);
+
+        boolean result = invokePrivateMethod("isClvmLockTransferRequired",
+                new Class[]{VolumeInfo.class, VolumeVO.class, UserVmVO.class},
+                volumeInfo, vmExistingVolume, vm);
+
+        Assert.assertTrue(result);
+        Mockito.verify(volumeServiceMock).isLockTransferRequired(
+                eq(volumeInfo), eq(Storage.StoragePoolType.CLVM), eq(Storage.StoragePoolType.CLVM),
+                eq(volumePoolId), eq(vmPoolId), eq(lastHostId));
+    }
+
+
+    private <T> T invokePrivateMethod(String methodName, Class<?>[] paramTypes, Object... params) {
+        try {
+            java.lang.reflect.Method method = VolumeApiServiceImpl.class.getDeclaredMethod(methodName, paramTypes);
+            method.setAccessible(true);
+            return (T) method.invoke(volumeApiServiceImpl, params);
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to invoke method: " + methodName, e);
+        }
+    }
 }
diff --git a/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java b/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
index ff0888c184c0..4dc5a1f3bdfb 100644
--- a/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
+++ b/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
@@ -26,6 +26,7 @@
 import com.cloud.org.Grouping;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.Snapshot;
+import com.cloud.storage.Storage.StoragePoolType;
 import com.cloud.storage.SnapshotPolicyVO;
 import com.cloud.storage.SnapshotVO;
 import com.cloud.storage.VolumeVO;
@@ -55,8 +56,10 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotResult;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotService;
 import org.apache.cloudstack.framework.async.AsyncCallFuture;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 
 import org.junit.Assert;
 import org.junit.After;
@@ -105,6 +108,8 @@ public class SnapshotManagerImplTest {
     SnapshotScheduler snapshotScheduler;
     @Mock
     TaggedResourceService taggedResourceService;
+    @Mock
+    PrimaryDataStoreDao primaryDataStoreDao;
     @InjectMocks
     SnapshotManagerImpl snapshotManager = new SnapshotManagerImpl();
 
@@ -115,6 +120,7 @@ public void setUp() {
         snapshotManager._accountMgr = accountManager;
         snapshotManager._snapSchedMgr = snapshotScheduler;
         snapshotManager.taggedResourceService = taggedResourceService;
+        snapshotManager._storagePoolDao = primaryDataStoreDao;
     }
 
     @After
@@ -610,4 +616,57 @@ public void testDeleteSnapshotPoliciesManualPolicyId() {
 
         snapshotManager.deleteSnapshotPolicies(cmd);
     }
+
+    @Test
+    public void testRemoveClvmPrimarySnapshotStoreRefIfNeeded_ClvmPool() {
+        SnapshotInfo snapshot = Mockito.mock(SnapshotInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class);
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+
+        Mockito.when(snapshot.getDataStore()).thenReturn(dataStore);
+        Mockito.when(snapshot.getId()).thenReturn(1L);
+        Mockito.when(dataStore.getId()).thenReturn(2L);
+        Mockito.when(dataStore.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(primaryDataStoreDao.findById(2L)).thenReturn(pool);
+        Mockito.when(pool.getPoolType()).thenReturn(StoragePoolType.CLVM);
+
+        snapshotManager.removeClvmPrimarySnapshotStoreRefIfNeeded(snapshot);
+
+        Mockito.verify(snapshotStoreDao).removeBySnapshotStore(1L, 2L, DataStoreRole.Primary);
+    }
+
+    @Test
+    public void testRemoveClvmPrimarySnapshotStoreRefIfNeeded_ClvmNgPool() {
+        SnapshotInfo snapshot = Mockito.mock(SnapshotInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class);
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+
+        Mockito.when(snapshot.getDataStore()).thenReturn(dataStore);
+        Mockito.when(snapshot.getId()).thenReturn(3L);
+        Mockito.when(dataStore.getId()).thenReturn(4L);
+        Mockito.when(dataStore.getRole()).thenReturn(DataStoreRole.Primary);
+        Mockito.when(primaryDataStoreDao.findById(4L)).thenReturn(pool);
+        Mockito.when(pool.getPoolType()).thenReturn(StoragePoolType.CLVM_NG);
+
+        snapshotManager.removeClvmPrimarySnapshotStoreRefIfNeeded(snapshot);
+
+        Mockito.verify(snapshotStoreDao).removeBySnapshotStore(3L, 4L, DataStoreRole.Primary);
+    }
+
+    @Test
+    public void testRemoveClvmPrimarySnapshotStoreRefIfNeeded_NonClvmPool() {
+        SnapshotInfo snapshot = Mockito.mock(SnapshotInfo.class);
+        DataStore dataStore = Mockito.mock(DataStore.class);
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+
+        Mockito.when(snapshot.getDataStore()).thenReturn(dataStore);
+        Mockito.when(dataStore.getId()).thenReturn(5L);
+        Mockito.when(primaryDataStoreDao.findById(5L)).thenReturn(pool);
+        Mockito.when(pool.getPoolType()).thenReturn(StoragePoolType.NetworkFilesystem);
+
+        snapshotManager.removeClvmPrimarySnapshotStoreRefIfNeeded(snapshot);
+
+        Mockito.verify(snapshotStoreDao, Mockito.never()).removeBySnapshotStore(
+                Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+    }
 }
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 93a06ef2097f..75779cc4c96b 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -85,20 +85,19 @@
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
-import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.Scope;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.template.VnfTemplateManager;
 import org.apache.cloudstack.userdata.UserDataManager;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
-
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -851,9 +850,7 @@ public void configureCustomRootDiskSizeTestEmptyParametersAndOfferingRootSize()
 
     private void prepareAndRunConfigureCustomRootDiskSizeTest(Map<String, String> customParameters, long expectedRootDiskSize, int timesVerifyIfHypervisorSupports, Long offeringRootDiskSize) {
         VMTemplateVO template = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(template.getId()).thenReturn(1L);
         Mockito.when(template.getSize()).thenReturn(99L * GiB_TO_BYTES);
-        Mockito.when(templateDao.findById(Mockito.anyLong())).thenReturn(template);
 
         DiskOfferingVO diskfferingVo = Mockito.mock(DiskOfferingVO.class);
 
diff --git a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
index e4bc2096b9da..99f0d7fe294a 100644
--- a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
@@ -904,7 +904,7 @@ public boolean isSecondaryIpSetForNic(long nicId) {
     }
 
     @Override
-    public NicSecondaryIp allocateSecondaryGuestIP(long nicId, IpAddresses requestedIpPair) {
+    public NicSecondaryIp allocateSecondaryGuestIP(long nicId, IpAddresses requestedIpPair, String description) {
         // TODO Auto-generated method stub
         return null;
     }
diff --git a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
index 8a0bec56df7b..ea822e7eec8b 100644
--- a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
+++ b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
@@ -16,6 +16,11 @@
 // under the License.
 package com.cloud.vpc.dao;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import com.cloud.network.Network;
 import com.cloud.network.Network.GuestType;
 import com.cloud.network.Networks.TrafficType;
@@ -23,14 +28,10 @@
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.utils.db.DB;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 @DB()
 public class MockNetworkDaoImpl extends GenericDaoBase<NetworkVO, Long> implements NetworkDao {
 
@@ -160,11 +161,22 @@ public boolean update(final Long networkId, final NetworkVO network, final Map<S
         return false;
     }
 
+    @Override
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType, Filter filter) {
+        return null;
+    }
+
     @Override
     public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
         return null;
     }
 
+    @Override
+    public List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType, List<Long> accountIds,
+                                                           List<Long> domainIds, Filter filter) {
+        return null;
+    }
+
     @Override
     public void setCheckForGc(final long networkId) {
     }
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index 27dd630e470f..d1817047499e 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -42,22 +42,6 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.MockedStatic;
-import org.mockito.Mockito;
-import org.mockito.MockitoAnnotations;
-import org.mockito.Spy;
-import org.mockito.junit.MockitoJUnitRunner;
-import org.mockito.stubbing.Answer;
-import org.springframework.test.util.ReflectionTestUtils;
-
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.admin.backup.CloneBackupOfferingCmd;
@@ -71,8 +55,8 @@
 import org.apache.cloudstack.api.response.BackupResponse;
 import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.backup.dao.BackupDetailsDao;
-import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.framework.config.ConfigKey;
@@ -83,6 +67,21 @@
 import org.apache.cloudstack.reservation.dao.ReservationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.mockito.stubbing.Answer;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.alert.AlertManager;
 import com.cloud.api.query.dao.UserVmJoinDao;
@@ -274,6 +273,7 @@ public class BackupManagerTest {
     private String[] datastoresPossibleValues = {"e9804933-8609-4de3-bccc-6278072a496c", "datastore-name"};
     private AutoCloseable closeable;
     private ConfigDepotImpl configDepotImpl;
+    private ConfigKey backupFrameworkConfigKey = BackupManager.BackupFrameworkEnabled;
     private boolean updatedConfigKeyDepot = false;
     private MockedStatic<DbUtil> dbUtilMockedStatic;
     private final List<String> mockedGlobalLocks = new ArrayList<>();
@@ -341,7 +341,10 @@ public void tearDown() throws Exception {
         dbUtilMockedStatic.close();
         closeable.close();
         if (updatedConfigKeyDepot) {
-            ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "s_depot", configDepotImpl);
+            ConfigKey configKey = BackupManager.BackupFrameworkEnabled;
+            ReflectionTestUtils.setField(configKey, "s_depot", configDepotImpl);
+            ReflectionTestUtils.setField(configKey, "_value", null);
+            updatedConfigKeyDepot = false;
         }
         CallContext.unregister();
     }
@@ -350,6 +353,7 @@ private void overrideBackupFrameworkConfigValue() {
         ConfigKey configKey = BackupManager.BackupFrameworkEnabled;
         this.configDepotImpl = (ConfigDepotImpl) ReflectionTestUtils.getField(configKey, "s_depot");
         ConfigDepotImpl configDepot = Mockito.mock(ConfigDepotImpl.class);
+        ReflectionTestUtils.setField(configKey, "_value", null);
         Mockito.when(configDepot.getConfigStringValue(Mockito.eq(BackupManager.BackupFrameworkEnabled.key()),
                 Mockito.eq(ConfigKey.Scope.Global), Mockito.isNull())).thenReturn("true");
         Mockito.when(configDepot.getConfigStringValue(Mockito.eq(BackupManager.BackupFrameworkEnabled.key()),
diff --git a/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java
new file mode 100644
index 000000000000..507658318509
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java
@@ -0,0 +1,467 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.ScopeType;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.VirtualMachine.State;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class KVMBackupExportServiceImplTest {
+
+    @InjectMocks
+    KVMBackupExportServiceImpl service;
+
+    @Mock
+    VolumeDao volumeDao;
+
+    @Mock
+    VMInstanceDao vmInstanceDao;
+
+    @Mock
+    VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Mock
+    BackupDao backupDao;
+
+    @Mock
+    ImageTransferDao imageTransferDao;
+
+    @Mock
+    AgentManager agentManager;
+
+    @Mock
+    HostDao hostDao;
+
+    @Mock
+    PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Mock
+    AccountService accountService;
+
+    @Mock
+    VirtualMachineManager virtualMachineManager;
+
+    @Mock
+    BackupVO backup;
+
+    @Mock
+    VolumeVO volume;
+
+    @Mock
+    HostVO hostVO;
+
+    @Mock
+    VolumeDataFactory volumeDataFactory;
+
+    @Mock
+    CallContext callContext;
+
+    @Mock
+    User user;
+
+    VMInstanceVO vm;
+
+    @Before
+    public void setUp() {
+        vm = mock(VMInstanceVO.class);
+        when(vm.getId()).thenReturn(1L);
+        when(vm.getUuid()).thenReturn("vm-uuid");
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_noNonReadyVolumes_doesNotThrow() {
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+
+        service.validateVmVolumesForBackup(vm);
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_oneVolumeNotReady_throwsWithVolumeAndInstanceId() {
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getUuid()).thenReturn("vol-not-ready");
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(List.of(vol));
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.validateVmVolumesForBackup(vm));
+
+        assert ex.getMessage().contains("vol-not-ready");
+        assert ex.getMessage().contains("vm-uuid");
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_multipleVolumesNotReady_throwsWithAllVolumeIds() {
+        VolumeVO vol1 = mock(VolumeVO.class);
+        VolumeVO vol2 = mock(VolumeVO.class);
+        when(vol1.getUuid()).thenReturn("vol-a");
+        when(vol2.getUuid()).thenReturn("vol-b");
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(List.of(vol1, vol2));
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.validateVmVolumesForBackup(vm));
+
+        assert ex.getMessage().contains("vol-a");
+        assert ex.getMessage().contains("vol-b");
+        assert ex.getMessage().contains("vm-uuid");
+    }
+
+    private StartBackupCmd mockCmd(Long vmId, String name, String description) {
+        StartBackupCmd cmd = mock(StartBackupCmd.class);
+        when(cmd.getVmId()).thenReturn(vmId);
+        when(cmd.getName()).thenReturn(name);
+        when(cmd.getDescription()).thenReturn(description);
+        return cmd;
+    }
+
+    private void stubVmRunningWithHost(Long vmId, VMInstanceVO vmInstance, Long hostId) {
+        when(vmInstanceDao.findById(vmId)).thenReturn(vmInstance);
+        when(vmInstance.getState()).thenReturn(State.Running);
+        when(vmInstance.getDataCenterId()).thenReturn(10L);
+        when(vmInstance.getAccountId()).thenReturn(100L);
+        when(vmInstance.getDomainId()).thenReturn(200L);
+        when(backupDao.findByVmId(vmId)).thenReturn(null);
+        when(volumeDao.findByInstanceAndNotStates(vmId, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vmInstance, false))
+                .thenReturn(new Pair<>(5L, hostId));
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(vmId)).thenReturn(new HashMap<>());
+    }
+
+    @Test
+    public void createBackup_instanceNotFound_throws() {
+        when(vmInstanceDao.findById(99L)).thenReturn(null);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(99L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_instanceNotRunningOrStopped_throws() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Migrating);
+        when(vm.getDataCenterId()).thenReturn(10L);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_backupAlreadyInProgress_throws() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Running);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        BackupVO existing = mock(BackupVO.class);
+        when(existing.getStatus()).thenReturn(Backup.Status.BackingUp);
+        when(backupDao.findByVmId(1L)).thenReturn(existing);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_hostCannotBeDetermined_throws() {
+        stubVmRunningWithHost(1L, vm, null);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_happyPath_persistsBackupWithQueuedStatus() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        BackupVO persisted = mock(BackupVO.class);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(persisted);
+
+        Backup result = service.createBackup(mockCmd(1L, "my-backup", "desc"));
+
+        assertNotNull(result);
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertEquals(Backup.Status.Queued, captor.getValue().getStatus());
+        assertEquals("my-backup", captor.getValue().getName());
+        assertEquals("desc", captor.getValue().getDescription());
+        assertEquals(Long.valueOf(42L), captor.getValue().getHostId());
+        assertEquals(Long.valueOf(1L), captor.getValue().getVmId());
+    }
+
+    @Test
+    public void createBackup_noNameProvided_generatesNameFromVmId() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, null, null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertNotNull(captor.getValue().getName());
+        assert captor.getValue().getName().startsWith("1-");
+    }
+
+    @Test
+    public void createBackup_existingBackupNotInProgress_proceedsNormally() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Stopped);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        when(vm.getAccountId()).thenReturn(100L);
+        when(vm.getDomainId()).thenReturn(200L);
+        BackupVO existing = mock(BackupVO.class);
+        when(existing.getStatus()).thenReturn(Backup.Status.BackedUp);
+        when(backupDao.findByVmId(1L)).thenReturn(existing);
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(5L, 42L));
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(1L)).thenReturn(new HashMap<>());
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        Backup result = service.createBackup(mockCmd(1L, "backup", null));
+
+        assertNotNull(result);
+    }
+
+    @Test
+    public void createBackup_withActiveCheckpoint_setsFromCheckpointId() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Running);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        when(vm.getAccountId()).thenReturn(100L);
+        when(vm.getDomainId()).thenReturn(200L);
+        when(backupDao.findByVmId(1L)).thenReturn(null);
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(5L, 42L));
+        Map<String, String> details = new HashMap<>();
+        details.put("active.checkpoint.id", "ckp-abc123");
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(1L)).thenReturn(details);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, "backup", null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertEquals("ckp-abc123", captor.getValue().getFromCheckpointId());
+    }
+
+    @Test
+    public void createBackup_noActiveCheckpoint_fromCheckpointIdIsNull() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, "backup", null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assert captor.getValue().getFromCheckpointId() == null;
+        assertNotNull(captor.getValue().getToCheckpointId());
+        assert captor.getValue().getToCheckpointId().startsWith("ckp-");
+    }
+
+    @Test
+    public void removeFailedBackup_setsErrorStatusAndRemovesRecord() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getId()).thenReturn(10L);
+
+        service.removeFailedBackup(backup);
+
+        verify(backup).setStatus(Backup.Status.Error);
+        verify(backupDao).update(10L, backup);
+        verify(backupDao).remove(10L);
+    }
+
+    @Test
+    public void finalizeImageTransfer_downloadStoppedVm_stopNbdFails_throwsAndDoesNotUpdate() throws Exception {
+        ImageTransferVO transfer = new ImageTransferVO("tx-download-fail", 11L, 21L, 31L, "sock",
+                ImageTransferVO.Phase.transferring, ImageTransfer.Direction.download, 1L, 1L, 1L);
+        ReflectionTestUtils.setField(transfer, "id", 501L);
+        when(imageTransferDao.findById(501L)).thenReturn(transfer);
+        when(backupDao.findById(11L)).thenReturn(backup);
+        when(backup.getHostId()).thenReturn(31L);
+        when(backup.getVmId()).thenReturn(41L);
+        when(vmInstanceDao.findById(41L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Stopped);
+        when(agentManager.send(eq(31L), any(Command.class))).thenReturn(
+                new Answer(null, true, null),
+                new Answer(null, false, "stop failed")
+        );
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.finalizeImageTransfer(501L));
+
+        assert ex.getMessage().contains("Failed to stop the nbd server");
+        verify(imageTransferDao, never()).update(eq(501L), any(ImageTransferVO.class));
+        verify(imageTransferDao, never()).remove(501L);
+    }
+
+    @Test
+    public void createImageTransfer_uploadFileBackend_success() throws Exception {
+        ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "_value", Boolean.FALSE);
+        try (MockedStatic<CallContext> mocked = mockStatic(CallContext.class)) {
+            mocked.when(CallContext::current).thenReturn(callContext);
+            when(callContext.getCallingUser()).thenReturn(user);
+
+            when(volumeDao.findById(601L)).thenReturn(volume);
+            when(volume.getId()).thenReturn(601L);
+            when(volume.getState()).thenReturn(Volume.State.Ready);
+            when(volume.getDataCenterId()).thenReturn(1L);
+            when(volume.getPoolId()).thenReturn(701L);
+            when(volume.getPath()).thenReturn("vol-601.qcow2");
+            when(volume.getAccountId()).thenReturn(11L);
+            when(volume.getDomainId()).thenReturn(12L);
+            when(imageTransferDao.findByVolume(601L)).thenReturn(null);
+
+            StoragePoolVO pool = new StoragePoolVO();
+            pool.setId(701L);
+            pool.setScope(ScopeType.ZONE);
+            pool.setDataCenterId(1L);
+            pool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+            pool.setUuid("pool-701");
+            pool.setPath("/primary");
+            when(primaryDataStoreDao.findById(701L)).thenReturn(pool);
+
+            when(hostDao.findByDataCenterId(1L)).thenReturn(List.of(hostVO));
+            when(hostVO.getId()).thenReturn(801L);
+            when(hostVO.getDataCenterId()).thenReturn(1L);
+            when(agentManager.send(eq(801L), any(Command.class)))
+                    .thenReturn(new CreateImageTransferAnswer(null, true, null, "ticket-1", "https://transfer/file"));
+
+            final ImageTransferVO[] persisted = new ImageTransferVO[1];
+            when(imageTransferDao.persist(any(ImageTransferVO.class))).thenAnswer(i -> {
+                persisted[0] = i.getArgument(0);
+                ReflectionTestUtils.setField(persisted[0], "id", 901L);
+                return persisted[0];
+            });
+            when(imageTransferDao.findById(901L)).thenAnswer(i -> persisted[0]);
+
+            ImageTransfer created = service.createImageTransfer(601L, null, ImageTransfer.Direction.upload, ImageTransfer.Format.cow);
+
+            assertNotNull(created);
+            assertEquals(901L, created.getId());
+            assertEquals(ImageTransfer.Direction.upload, created.getDirection());
+            verify(volumeDao).updateState(eq(Volume.State.Ready), eq(Volume.Event.RestoreRequested), eq(Volume.State.Restoring), eq(volume), isNull());
+            verify(agentManager, times(1)).send(eq(801L), any(Command.class));
+        }
+    }
+
+    @Test
+    public void createImageTransfer_downloadStoppedVm_startsNbdAndCreatesTransfer() throws Exception {
+        ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "_value", Boolean.FALSE);
+        try (MockedStatic<CallContext> mocked = mockStatic(CallContext.class)) {
+            mocked.when(CallContext::current).thenReturn(callContext);
+            when(callContext.getCallingUser()).thenReturn(user);
+
+            when(volumeDao.findById(602L)).thenReturn(volume);
+            when(volume.getId()).thenReturn(602L);
+            when(volume.getUuid()).thenReturn("vol-602");
+            when(volume.getDataCenterId()).thenReturn(1L);
+            when(volume.getPoolId()).thenReturn(702L);
+            when(volume.getPath()).thenReturn("vol-602.raw");
+            when(imageTransferDao.findByVolume(602L)).thenReturn(null);
+
+            StoragePoolVO pool = new StoragePoolVO();
+            pool.setId(702L);
+            pool.setScope(ScopeType.ZONE);
+            pool.setDataCenterId(1L);
+            pool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+            pool.setUuid("pool-702");
+            when(primaryDataStoreDao.findById(702L)).thenReturn(pool);
+
+            when(backupDao.findById(612L)).thenReturn(backup);
+            when(backup.getVmId()).thenReturn(55L);
+            when(backup.getHostId()).thenReturn(802L);
+            when(backup.getUuid()).thenReturn("backup-612");
+            when(backup.getFromCheckpointId()).thenReturn("ckp-prev");
+            when(backup.getAccountId()).thenReturn(11L);
+            when(backup.getDomainId()).thenReturn(12L);
+            when(backup.getZoneId()).thenReturn(1L);
+            when(vmInstanceDao.findById(55L)).thenReturn(vm);
+            when(vm.getState()).thenReturn(State.Stopped);
+            when(vmInstanceDetailsDao.listDetailsKeyPairs(55L)).thenReturn(Map.of(VmDetailConstants.ACTIVE_CHECKPOINT_ID, "ckp-active"));
+            when(hostDao.findById(802L)).thenReturn(hostVO);
+            when(hostVO.getDataCenterId()).thenReturn(1L);
+            when(volumeDataFactory.getVolume(602L)).thenReturn(mock(VolumeInfo.class));
+
+            when(agentManager.send(eq(802L), any(Command.class))).thenReturn(
+                    new StartNBDServerAnswer(null, true, null),
+                    new CreateImageTransferAnswer(null, true, null, "ticket-2", "https://transfer/nbd")
+            );
+
+            final ImageTransferVO[] persisted = new ImageTransferVO[1];
+            when(imageTransferDao.persist(any(ImageTransferVO.class))).thenAnswer(i -> {
+                persisted[0] = i.getArgument(0);
+                ReflectionTestUtils.setField(persisted[0], "id", 902L);
+                return persisted[0];
+            });
+            when(imageTransferDao.findById(902L)).thenAnswer(i -> persisted[0]);
+
+            ImageTransfer created = service.createImageTransfer(602L, 612L, ImageTransfer.Direction.download, ImageTransfer.Format.raw);
+
+            assertNotNull(created);
+            assertEquals(902L, created.getId());
+            assertEquals(ImageTransfer.Direction.download, created.getDirection());
+            verify(agentManager, times(2)).send(eq(802L), any(Command.class));
+        }
+    }
+}
diff --git a/services/console-proxy/server/pom.xml b/services/console-proxy/server/pom.xml
index 3f5b9db68c2e..6e18a13bc57b 100644
--- a/services/console-proxy/server/pom.xml
+++ b/services/console-proxy/server/pom.xml
@@ -80,7 +80,7 @@
             <resource>
                 <directory>certs</directory>
                 <excludes>
-                    <exclude>realhostip.csr</exclude>
+                    <exclude>systemvm.csr</exclude>
                 </excludes>
             </resource>
         </resources>
diff --git a/services/secondary-storage/server/pom.xml b/services/secondary-storage/server/pom.xml
index e6aec8a42f70..ca26bf2bbbe9 100644
--- a/services/secondary-storage/server/pom.xml
+++ b/services/secondary-storage/server/pom.xml
@@ -107,7 +107,7 @@
                     <systemProperties>
                         <systemProperty>
                             <key>javax.net.ssl.trustStore</key>
-                            <value>certs/realhostip.keystore</value>
+                            <value>certs/systemvm.keystore</value>
                             <key>log.home</key>
                             <value>${PWD}/</value>
                         </systemProperty>
diff --git a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
index 3a5ea8b0252b..3c3f1f5747b8 100644
--- a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
+++ b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
@@ -55,7 +55,6 @@
 
 import javax.naming.ConfigurationException;
 
-import com.cloud.agent.api.ConvertSnapshotCommand;
 import org.apache.cloudstack.framework.security.keystore.KeystoreManager;
 import org.apache.cloudstack.storage.NfsMountManagerImpl.PathParser;
 import org.apache.cloudstack.storage.command.CopyCmdAnswer;
@@ -98,8 +97,8 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.utils.URLEncodedUtils;
 import org.apache.http.impl.client.DefaultHttpClient;
-import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.joda.time.DateTime;
 import org.joda.time.format.ISODateTimeFormat;
 
@@ -109,6 +108,7 @@
 import com.cloud.agent.api.CheckHealthCommand;
 import com.cloud.agent.api.Command;
 import com.cloud.agent.api.ComputeChecksumCommand;
+import com.cloud.agent.api.ConvertSnapshotCommand;
 import com.cloud.agent.api.DeleteSnapshotsDirCommand;
 import com.cloud.agent.api.GetStorageStatsAnswer;
 import com.cloud.agent.api.GetStorageStatsCommand;
diff --git a/systemvm/agent/certs/realhostip.crt b/systemvm/agent/certs/systemvm.crt
similarity index 100%
rename from systemvm/agent/certs/realhostip.crt
rename to systemvm/agent/certs/systemvm.crt
diff --git a/systemvm/agent/certs/realhostip.csr b/systemvm/agent/certs/systemvm.csr
similarity index 100%
rename from systemvm/agent/certs/realhostip.csr
rename to systemvm/agent/certs/systemvm.csr
diff --git a/systemvm/agent/certs/realhostip.key b/systemvm/agent/certs/systemvm.key
similarity index 100%
rename from systemvm/agent/certs/realhostip.key
rename to systemvm/agent/certs/systemvm.key
diff --git a/systemvm/agent/certs/realhostip.keystore b/systemvm/agent/certs/systemvm.keystore
similarity index 100%
rename from systemvm/agent/certs/realhostip.keystore
rename to systemvm/agent/certs/systemvm.keystore
diff --git a/systemvm/agent/scripts/_run.sh b/systemvm/agent/scripts/_run.sh
index 11158ecf5bd1..bb024f71c08b 100755
--- a/systemvm/agent/scripts/_run.sh
+++ b/systemvm/agent/scripts/_run.sh
@@ -60,4 +60,4 @@ if [ "$(uname -m | grep '64')" == "" ]; then
   fi
 fi
 
-java -Djavax.net.ssl.trustStore=./certs/realhostip.keystore -Djdk.tls.ephemeralDHKeySize=2048 -Dlog.home=$LOGHOME -mx${maxmem}m -cp $CP com.cloud.agent.AgentShell $keyvalues $@
+java -Djavax.net.ssl.trustStore=./certs/systemvm.keystore -Djdk.tls.ephemeralDHKeySize=2048 -Dlog.home=$LOGHOME -mx${maxmem}m -cp $CP com.cloud.agent.AgentShell $keyvalues $@
diff --git a/systemvm/agent/scripts/config_ssl.sh b/systemvm/agent/scripts/config_ssl.sh
index e9340b099f62..3968b2617f21 100755
--- a/systemvm/agent/scripts/config_ssl.sh
+++ b/systemvm/agent/scripts/config_ssl.sh
@@ -52,13 +52,13 @@ cflag=
 cpkflag=
 cpcflag=
 cccflag=
-customPrivKey=$(dirname $0)/certs/realhostip.key
-customPrivCert=$(dirname $0)/certs/realhostip.crt
+customPrivKey=$(dirname $0)/certs/systemvm.key
+customPrivCert=$(dirname $0)/certs/systemvm.crt
 customCertChain=
 customCACert=
 publicIp=
 hostName=
-keyStore=$(dirname $0)/certs/realhostip.keystore
+keyStore=$(dirname $0)/certs/systemvm.keystore
 defaultJavaKeyStoreFile=/etc/ssl/certs/java/cacerts
 defaultJavaKeyStorePass="changeit"
 aliasName="CPVMCertificate"
diff --git a/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh b/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
index f7c071c8cc0e..c601f6ad2210 100755
--- a/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
@@ -65,7 +65,7 @@ patch_systemvm() {
   fi
   rm -fr $backupfolder
   # Import global cacerts into 'cloud' service's keystore
-  keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/realhostip.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt || true
+  keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/systemvm.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt || true
   return 0
 }
 
diff --git a/systemvm/patch-sysvms.sh b/systemvm/patch-sysvms.sh
index 8d96de9ba3b8..e8fa06018ed4 100755
--- a/systemvm/patch-sysvms.sh
+++ b/systemvm/patch-sysvms.sh
@@ -126,25 +126,25 @@ patch_systemvm() {
 
   if [ "$TYPE" = "consoleproxy" ] || [ "$TYPE" = "secstorage" ]; then
     # Import global cacerts into 'cloud' service's keystore
-    REALHOSTIP_KS_FILE="/usr/local/cloud/systemvm/certs/realhostip.keystore"
-    REALHOSTIP_PASS="vmops.com"
+    SYSTEMVM_KS_FILE="/usr/local/cloud/systemvm/certs/systemvm.keystore"
+    SYSTEMVM_PASS="vmops.com"
 
     keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts \
-        -destkeystore "$REALHOSTIP_KS_FILE" -srcstorepass changeit -deststorepass \
-        "$REALHOSTIP_PASS" -noprompt 2>/dev/null || true
+        -destkeystore "$SYSTEMVM_KS_FILE" -srcstorepass changeit -deststorepass \
+        "$SYSTEMVM_PASS" -noprompt 2>/dev/null || true
 
-    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
+    # Import CA cert(s) into systemvm.keystore so the SSVM JVM
     # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
     # can trust servers signed by the CloudStack CA
     CACERT_FILE="/usr/local/share/ca-certificates/cloudstack/ca.crt"
 
-    if [ -f "$CACERT_FILE" ] && [ -f "$REALHOSTIP_KS_FILE" ]; then
+    if [ -f "$CACERT_FILE" ] && [ -f "$SYSTEMVM_KS_FILE" ]; then
         awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
         for caChain in $(ls cloudca.* 2>/dev/null); do
-            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
-                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -delete -noprompt -alias "$caChain" -keystore "$SYSTEMVM_KS_FILE" \
+                -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1 || true
             keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
-                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+                -keystore "$SYSTEMVM_KS_FILE" -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1
         done
         rm -f cloudca.*
     fi
diff --git a/systemvm/pom.xml b/systemvm/pom.xml
index 9bffc45cf4eb..ca9176ee85f9 100644
--- a/systemvm/pom.xml
+++ b/systemvm/pom.xml
@@ -205,7 +205,7 @@
                             <systemProperties>
                                 <systemProperty>
                                     <key>javax.net.ssl.trustStore</key>
-                                    <value>certs/realhostip.keystore</value>
+                                    <value>certs/systemvm.keystore</value>
                                     <key>log.home</key>
                                     <value>${PWD}/</value>
                                 </systemProperty>
diff --git a/tools/apidoc/gen_toc.py b/tools/apidoc/gen_toc.py
index 292f52d809bf..ead8f0620ba6 100644
--- a/tools/apidoc/gen_toc.py
+++ b/tools/apidoc/gen_toc.py
@@ -223,6 +223,10 @@
     'Management': 'Management',
     'Backup' : 'Backup and Recovery',
     'Restore' : 'Backup and Recovery',
+    'startBackup' : 'Backup and Recovery',
+    'finalizeBackup' : 'Backup and Recovery',
+    'ImageTransfer' : 'Backup and Recovery',
+    'VmCheckpoint' : 'Backup and Recovery',
     'UnmanagedInstance': 'Virtual Machine',
     'KubernetesSupportedVersion': 'Kubernetes Service',
     'KubernetesCluster': 'Kubernetes Service',
diff --git a/ui/public/assets/keycloak.svg b/ui/public/assets/keycloak.svg
new file mode 100644
index 000000000000..3e8115efc160
--- /dev/null
+++ b/ui/public/assets/keycloak.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 512 512"><style>.st9{fill:#d0d0d0}.st11{fill:#d9d9d9}.st13{fill:#d8d8d8}.st14{fill:#e2e2e2}.st16{fill:#dedede}.st21{fill:#00b8e3}.st22{fill:#33c6e9}.st23{fill:#008aaa}</style><g id="g2460" transform="translate(.714 .07)"><path id="path1588" d="M432.9 149.2c-1.4 0-2.7-.7-3.4-2L370.1 44.1c-.7-1.2-2-2-3.5-2H124.2c-1.4 0-2.7.7-3.4 2L58.9 150.9l23.9 34.9c-.7 1.2-6.2 24-5.5 25.2L58.9 360.9l61.9 106.9c.7 1.2 2 2 3.4 2h242.4c1.4 0 2.7-.7 3.5-2l59.4-103.2c.7-1.2 2-2 3.4-2h73.8c2.4 0 4.4-2 4.4-4.4V153.6c0-2.4-2-4.4-4.4-4.4z" style="fill:#4d4d4d"/><path id="path1594" d="M72.7 245.3 6.4 269.4l-6.6-11.3c-.7-1.2-.7-2.7 0-3.9l30-52z" style="fill:#e1e1e1"/><path id="polygon1794" d="M511.3 258.3V309l-43.7-44.5z" style="fill:#c8c8c8"/><path id="path1798" d="m467.5 264.5 43.7 44.5v49.6c0 2.4-2 4.4-4.4 4.4H456z" style="fill:#c2c2c2"/><path id="polygon1802" d="M467.5 264.5 456 362.9h-61.2l-18.5-44.7z" style="fill:#c7c7c7"/><path id="polygon1804" d="M511.3 211.2v47l-43.7 6.2z" style="fill:#cecece"/><path id="path1808" d="M511.3 153.6v57.6l-43.7 53.2-33.1-115.3h72.2c2.4-.1 4.5 1.8 4.6 4.3z" style="fill:#d3d3d3"/><path id="polygon1812" d="M394.8 362.9h-32.3l-8.4-12 22.1-32.7z" style="fill:#c6c6c6"/><path id="polygon1814" d="m467.5 264.5-121.1-51.2 63.7-64.1h24.4z" style="fill:#d5d5d5"/><path id="path1816" d="m346.5 213.3 29.8 105 91.2-53.8z" class="st9"/><path id="polygon1818" d="m353.8 362.9.4-12 8.4 12z" style="fill:#bfbfbf"/><path id="polygon1820" d="m410.1 149.2-63.7 64.1-11.4-57.4 24.6-6.8h50.5z" class="st11"/><path id="path1822" d="m346.5 213.3-147 33.9 154.7 103.7z" style="fill:#d4d4d4"/><path id="path1824" d="m346.5 213.3 7.7 137.6 22.1-32.7z" class="st9"/><path id="path1826" d="m335 155.9-135.5 91.2 147-33.9z" class="st11"/><path id="polygon1828" d="m199.5 247.2-63.7 115.7H99.6L72.7 245.3z" class="st13"/><path id="path1830" d="m134.3 149.2-61.5 96.1L57.3 155l2.2-3.8c.7-1.2 2-1.9 3.4-1.9z" class="st14"/><path id="path1832" d="M99.6 362.9H62.7c-1.4 0-2.8-.8-3.5-2L6.4 269.4l66.4-24.1z" class="st13"/><path id="polygon1834" d="M29.9 202.1 57.1 155l15.7 90.3z" style="fill:#e4e4e4"/><path id="polygon1836" d="m335 155.9-40.8-6.8H159.4l40.1 98z" class="st16"/><path id="polygon1838" d="m199.5 247.2-40.1-98h-25.1l-61.5 96.1z" class="st16"/><path id="polygon1840" d="M324.7 362.9h29.1l.4-12z" style="fill:#c5c5c5"/><path id="polygon1842" d="M266.7 362.9h58l29.5-12-154.7-103.7 27.9 115.7z" class="st9"/><path id="polygon1844" d="m227.4 362.9-27.9-115.7-63.7 115.7z" style="fill:#d1d1d1"/><path id="polygon1856" d="m335.4 149.2-.4 6.8 24.6-6.8z" style="fill:#ddd"/><path id="polygon1858" d="m335 155.9-3.8-6.8h-37z" style="fill:#e3e3e3"/><path id="polygon1860" d="m335 155.9.4-6.8h-4.2z" class="st14"/><path id="path1862" d="m223.9 151-59.7 103.4c-.3.5-.4 1.1-.4 1.7h-41.7l82-142q.75.45 1.2 1.2l18.6 32.3c.5 1.1.5 2.4 0 3.4" class="st21"/><path id="path1864" d="M223.8 364.9 205.3 397q-.45.75-1.2 1.2l-82-142.2h41.7c0 .6.1 1.1.4 1.6l59.6 103.2c.8 1.2.9 2.9 0 4.1" class="st22"/><path id="path1866" d="m204 114.2-82 141.9-20.6 35.6-19.6-34c-.3-.5-.4-1-.4-1.6s.1-1.2.4-1.7l19.9-34.4 60.4-104.5c.6-1.1 1.8-1.8 3-1.8h37.2c.6 0 1.2.2 1.7.5" class="st23"/><path id="path1868" d="M204 398.2c-.5.3-1.1.5-1.8.5h-37.1c-1.3 0-2.4-.7-3-1.8l-55.2-95.6-5.5-9.5 20.6-35.6z" class="st21"/><path id="path1870" d="m368.9 256.1-82 142q-.75-.45-1.2-1.2L267 364.7c-.5-1-.5-2.3 0-3.3L326.7 258c.3-.5.5-1.2.5-1.8z" class="st23"/><path id="path1872" d="M409.4 256.1c0 .6-.2 1.3-.5 1.8l-80.3 139.3c-.6 1-1.8 1.7-3 1.6h-37c-.6 0-1.2-.2-1.8-.5L368.9 256l20.6-35.6 19.5 33.8c.3.7.4 1.3.4 1.9" class="st21"/><path id="path1874" d="M368.9 256.1h-41.7c0-.6-.2-1.2-.5-1.8L267 151.2c-.6-1.1-.6-2.5 0-3.6l18.6-32.2q.45-.75 1.2-1.2z" class="st21"/><path id="path1876" d="m389.4 220.5-20.6 35.6-82-142c.6-.3 1.2-.5 1.8-.5h37.1c1.2 0 2.3.6 3 1.6z" class="st22"/></g></svg>
\ No newline at end of file
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 3a16d613f37a..14f2fe6597fa 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -62,6 +62,7 @@
 "label.action.attach.disk": "Attach Disk",
 "label.action.attach.iso": "Attach ISO",
 "label.action.attach.to.instance": "Attach to Instance",
+"label.action.bulk.delete.api.keys": "Bulk delete API key pairs",
 "label.action.bulk.delete.egress.firewall.rules": "Bulk delete egress firewall rules",
 "label.action.bulk.delete.firewall.rules": "Bulk delete firewall rules",
 "label.action.bulk.delete.ip.v6.firewall.rules": "Bulk remove IPv6 firewall rules",
@@ -82,6 +83,7 @@
 "label.action.copy.iso": "Copy ISO",
 "label.action.copy.snapshot": "Copy Snapshot",
 "label.action.copy.template": "Copy Template",
+"label.action.create.api.key": "Create API key pair for user",
 "label.action.create.backup.schedule": "Create Backup Schedule",
 "label.action.create.recurring.snapshot": "Create Recurring Snapshot",
 "label.action.create.snapshot.from.vmsnapshot": "Create Snapshot from Instance Snapshot",
@@ -116,6 +118,7 @@
 "label.action.delete.snapshot": "Delete Snapshot",
 "label.action.delete.template": "Delete Template",
 "label.action.delete.tungsten.router.table": "Remove Tungsten Fabric route table from Network",
+"label.action.delete.keypair": "Delete API key pair",
 "label.action.delete.user": "Delete User",
 "label.action.delete.vgpu.profile": "Delete vGPU profile",
 "label.action.delete.volume": "Delete Volume",
@@ -409,6 +412,11 @@
 "label.api.docs.count": "APIs available for your account",
 "label.api.version": "API version",
 "label.apikey": "API key",
+"label.apikeypairs": "API Key Pairs",
+"label.apikeypair.description": "Description of the API key pair",
+"label.apikeypair.name": "Name of the API key pair",
+"label.apikeypair.startdate": "API key pair valid from",
+"label.apikeypair.enddate": "API key pair valid until",
 "label.app.cookie": "AppCookie",
 "label.app.name": "CloudStack",
 "label.application.policy.set": "Application Policy Set",
@@ -438,6 +446,7 @@
 "label.attaching": "Attaching",
 "label.authentication.method": "Authentication Method",
 "label.authentication.sshkey": "System SSH Key",
+"label.authorizeurl": "Authorize URL",
 "label.use.existing.vcenter.credentials.from.zone": "Use existing vCenter credentials from the Zone",
 "label.autoscale": "AutoScale",
 "label.autoscalevmgroupname": "AutoScaling Group",
@@ -624,6 +633,7 @@
 "label.configure.ldap": "Configure LDAP",
 "label.configure.ovs": "Configure Ovs",
 "label.configure.sticky.policy": "Configure sticky policy",
+"label.confirm.delete.api.keys": "Please confirm you wish to delete the selected API key pairs",
 "label.confirm.delete.egress.firewall.rules": "Please confirm you wish to delete the selected egress firewall rules.",
 "label.confirm.delete.firewall.rules": "Please confirm you wish to delete the selected firewall rules.",
 "label.confirm.delete.ip.v6.firewall.rules": "Please confirm you wish to delete the selected IPv6 firewall rules",
@@ -786,6 +796,7 @@
 "label.delete.alerts": "Delete alerts",
 "label.delete.asnrange": "Delete AS Range",
 "label.delete.autoscale.vmgroup": "Delete AutoScaling Group",
+"label.delete.all.rules": "Delete all API key pair rules",
 "label.delete.backup": "Delete backup",
 "label.delete.backup.schedule": "Delete backup schedule",
 "label.delete.bgp.peer": "Delete BGP peer",
@@ -843,6 +854,7 @@
 "label.deleting": "Deleting",
 "label.deleting.failed": "Deleting failed",
 "label.deleting.iso": "Deleting ISO",
+"label.deleting.keypair": "Deleting API key pair",
 "label.deleting.snapshot": "Deleting Snapshot",
 "label.deleting.template": "Deleting Template",
 "label.deleteprotection": "Delete protection",
@@ -1219,6 +1231,8 @@
 "label.guestnetwork": "Guest Network",
 "label.guestnetworkid": "Network ID",
 "label.guestnetworkname": "Network name",
+"label.guestosasrule": "Guest OS as rule",
+"label.guestosrule": "Guest OS rule",
 "label.gueststartip": "Guest start IP",
 "label.guest.vlan": "Guest VLAN",
 "label.guestvlanrange": "VLAN range(s)",
@@ -1641,6 +1655,7 @@
 "message.memory.usage.info.hypervisor.additionals": "The data shown may not reflect the actual memory usage if the Instance does not have the additional hypervisor tools installed",
 "message.memory.usage.info.negative.value": "If the Instance's memory usage cannot be obtained from the hypervisor, the lines for free memory in the raw data graph and memory usage in the percentage graph will be disabled",
 "message.migrate.volume.tooltip": "Volume can be migrated to any suitable storage pool. Admin has to choose the appropriate disk offering to replace, that supports the new storage pool",
+"message.register.keypair.failed": "Failed to register API key pair",
 "label.migrate.with.storage": "Migrate with storage",
 "label.migrating": "Migrating",
 "label.migrating.data": "Migrating data",
@@ -1742,6 +1757,7 @@
 "label.new.password": "New password",
 "label.new.project": "New Project",
 "label.new.secondaryip.description": "Enter new secondary IP address",
+"label.new.secondaryip.description.description": "Enter a description for the new secondary IP address",
 "label.new.tag": "New tag",
 "label.new.vm": "New Instance",
 "label.new.version.available": "New version available",
@@ -2080,12 +2096,14 @@
 "label.redundantvpcrouter": "Redundant VPC",
 "label.refresh": "Refresh",
 "label.region": "Region",
+"label.register.api.key": "Register API key pair",
 "label.register.extension": "Register Extension",
 "label.register.oauth": "Register OAuth",
 "label.register.template": "Register Template",
 "label.register.user.data": "Register User Data",
 "label.register.cni.config": "Register CNI Configuration",
 "label.register.user.data.details": "Enter the User Data in plain text or in Base64 encoding. Up to 32KB of Base64 encoded User Data can be sent by default. The setting vm.userdata.max.length can be used to increase the limit to upto 1MB.",
+"label.registering.keypair": "Registering API key pair for user \"{user}\"",
 "label.reinstall.vm": "Reinstall Instance",
 "label.reject": "Reject",
 "label.related": "Related",
@@ -2251,6 +2269,7 @@
 "label.secondary.storage": "Secondary Storage",
 "label.secondary.storage.vm": "Secondary Storage VM",
 "label.secondaryips": "Secondary IPs",
+"label.secondaryip.description": "Description",
 "label.secondarystoragelimit": "Secondary Storage limits (GiB)",
 "label.secretkey": "Secret key",
 "label.secured": "Secured",
@@ -2399,6 +2418,7 @@
 "label.unregister.extension": "Unregister Extension",
 "label.usediops": "IOPS used",
 "label.userdata": "User Data",
+"label.user.api.key.rules": "API key pair rules",
 "label.user.data.id": "User Data ID",
 "label.user.data.name": "User Data name",
 "label.user.data.details": "User Data details",
@@ -2584,6 +2604,7 @@
 "label.to": "to",
 "label.token": "Token",
 "label.token.for.dashboard.login": "Token for dashboard login can be retrieved using following command",
+"label.tokenurl": "Token URL",
 "label.tools": "Tools",
 "label.total": "Total",
 "label.total.network": "Total Networks",
@@ -2932,7 +2953,7 @@
 "label.versioning": "Versioning",
 "label.objectlocking": "Object Lock",
 "label.bucket.policy": "Bucket Policy",
-"label.usersecretkey": "Secret Key",
+"label.usersecretkey": "API Secret Key",
 "label.create.bucket": "Create Bucket",
 "label.cniconfiguration": "CNI Configuration",
 "label.cniconfigname": "Associated CNI Configuration",
@@ -3346,6 +3367,8 @@
 "message.delete.failed": "Delete fail",
 "message.delete.gateway": "Please confirm you want to delete the gateway.",
 "message.delete.ip.v6.prefix.processing": "Deleting IPv6 prefix...",
+"message.delete.keypair": "Please confirm that you would like to delete this API key pair.",
+"message.delete.keypair.failed": "Failed to delete API key pair",
 "message.delete.port.forward.processing": "Deleting port forwarding rule...",
 "message.delete.project": "Are you sure you want to delete this project?",
 "message.delete.rule.processing": "Deleting rule...",
@@ -3751,6 +3774,8 @@
 "message.new.version.available": "A new version of CloudStack is available. Click here to check the details",
 "message.no.data.to.show.for.period": "No data to show for the selected period.",
 "message.no.description": "No description entered.",
+"message.note.about.keypair.permissions.title": "Note about API key pair rule permissions",
+"message.note.about.keypair.permissions.body": "During the creation of API key pairs, it is possible to define a corresponding set of rule permissions. If a rule set is defined, the API key pair will only have access to APIs for which access has been explicitly granted (i.e., APIs whose corresponding rules are marked as allowed). On the other hand, if no rule set is specified, the API key pair permissions will follow and adapt to the permission set of the user's account role.",
 "message.offering.internet.protocol.warning": "WARNING: IPv6 supported Networks use static routing and will require upstream routes to be configured manually.",
 "message.offering.ipv6.warning": "Please refer documentation for creating IPv6 enabled Network/VPC offering <a href='http://docs.cloudstack.apache.org/en/latest/plugins/ipv6.html#isolated-network-and-vpc-tier'>IPv6 support in CloudStack - Isolated Networks and VPC Network Tiers</a>",
 "message.oobm.configured": "Successfully configured out-of-band management for host",
@@ -3959,6 +3984,7 @@
 "message.success.delete.gpu.devices": "Successfully deleted GPU device(s)",
 "message.success.delete.icon": "Successfully deleted icon of",
 "message.success.delete.interface.static.route": "Successfully removed interface Static Route",
+"message.success.delete.keypair": "Success deleting API key pair",
 "message.success.delete.ipv4.subnet": "Successfully removed IPv4 subnet",
 "message.success.delete.network.static.route": "Successfully removed Network Static Route",
 "message.success.delete.node": "Successfully deleted node",
@@ -3990,6 +4016,7 @@
 "message.success.register.keypair": "Successfully registered SSH key pair",
 "message.success.register.template": "Successfully registered Template",
 "message.success.register.user.data": "Successfully registered User Data",
+"message.success.register.user.keypair": "Successfully registered API key pair for user \"{user}\"",
 "message.success.release.ip": "Successfully released IP",
 "message.success.release.dedicated.bgp.peer": "Successfully released dedicated BGP peer",
 "message.success.release.dedicated.ipv4.subnet": "Successfully released dedicated IPv4 subnet",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 91f0fd895e58..c0d66280d7c5 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -51,6 +51,7 @@
 "label.action": "A\u00e7\u00e3o",
 "label.action.attach.disk": "Anexar disco",
 "label.action.attach.iso": "Anexar ISO",
+"label.action.bulk.delete.api.keys": "Apagar em massa as chaves de acesso \u00e0 API.",
 "label.action.bulk.delete.egress.firewall.rules": "Apagar em massa as regras de sa\u00edda do firewall.",
 "label.action.bulk.delete.firewall.rules": "Apagar em massa as regras do firewall.",
 "label.action.bulk.delete.ip.v6.firewall.rules": "Apagar em massa as regras de firewall IPv6.",
@@ -70,6 +71,7 @@
 "label.action.copy.iso": "Copiar ISO",
 "label.action.copy.snapshot": "Copiar Snapshot",
 "label.action.copy.template": "Copiar template",
+"label.action.create.api.key": "Criar um par de chaves de API para usu\u00e1rio",
 "label.action.create.snapshot.from.vmsnapshot": "Criar snapshot a partir de uma snapshot de VM",
 "label.action.create.template.from.volume": "Criar template a partir do disco",
 "label.action.create.volume": "Criar disco",
@@ -86,6 +88,7 @@
 "label.action.delete.interface.static.route": "Remover rota est\u00e1tica da interface Tungsten Fabric",
 "label.action.delete.ip.range": "Remover intervalo de IPs",
 "label.action.delete.iso": "Remover ISO",
+"label.action.delete.keypair": "Remover par de chaves",
 "label.action.delete.load.balancer": "Remover regra do balanceador de carga",
 "label.action.delete.network": "Remover rede",
 "label.action.delete.network.permission": "Excluir permiss\u00e3o de Rede",
@@ -379,6 +382,11 @@
 "label.api.docs.count": "APIs dispon\u00edveis para sua conta",
 "label.api.version": "Vers\u00e3o da API",
 "label.apikey": "Chave da API",
+"label.apikeypairs": "Par de chaves de API",
+"label.apikeypair.description": "Descri\u00e7\u00e3o do par de chaves de API",
+"label.apikeypair.name": "Nome do par de chaves de API",
+"label.apikeypair.startdate": "Data de in\u00edcio da validade do par de chaves de API",
+"label.apikeypair.enddate": "Data de expira\u00e7\u00e3o do par de chaves de API",
 "label.app.cookie": "AppCookie",
 "label.app.name": "CloudStack",
 "label.application.policy.set": "Conjunto de Pol\u00edticas de Aplica\u00e7\u00e3o",
@@ -564,6 +572,7 @@
 "label.configure.ldap": "Configurar LDAP",
 "label.configure.ovs": "Configure Ovs",
 "label.configure.sticky.policy": "Configurar sticky policy",
+"label.confirm.delete.api.keys": "Por favor, confirme se deseja apagar as chaves de acesso \u00e0 API selecionadas",
 "label.confirm.delete.egress.firewall.rules": "Por favor, confirme se deseja apagar as regras de firewall de sa\u00edda selecionadas",
 "label.confirm.delete.firewall.rules": "Por favor, confirme se deseja apagar as regras de firewall selecionadas",
 "label.confirm.delete.ip.v6.firewall.rules": "Por favor, confirme que deseja excluir as regras de firewall IPv6 selecionadas",
@@ -709,6 +718,7 @@
 "label.delete.acl": "Apagar lista ACL",
 "label.delete.affinity.group": "Apagar grupo de afinidade",
 "label.delete.alerts": "Remover alertas",
+"label.delete.all.rules": "Apagar todas as regras",
 "label.delete.asnrange": "Excluir Faixa AS",
 "label.delete.autoscale.vmgroup": "Excluir grupo de auto escalonamento horizontal",
 "label.delete.backup": "Apagar backup",
@@ -763,6 +773,7 @@
 "label.deleteconfirm": "Por favor, confirme que voc\u00ea deseja apagar isto",
 "label.deleting": "Removendo",
 "label.deleting.failed": "Falha ao remover",
+"label.deleting.keypair": "Deletando uma chave de API",
 "label.deleting.iso": "Removendo ISO",
 "label.deleting.template": "Remover template",
 "label.deleting.snapshot": "Excluindo Snapshot",
@@ -1090,6 +1101,8 @@
 "label.guestnetwork": "Rede guest",
 "label.guestnetworkid": "ID de rede",
 "label.guestnetworkname": "Nome da rede",
+"label.guestosasrule": "SO guest como regra JS",
+"label.guestosrule": "Regra SO guest",
 "label.gueststartip": "IP de in\u00edcio do guest",
 "label.guestvlanrange": "Intervalo(s) de VLAN",
 "label.guestvmcidr": "CIDR",
@@ -1569,6 +1582,7 @@
 "label.new.password": "Nova senha",
 "label.new.project": "Novo projeto",
 "label.new.secondaryip.description": "Insira um novo endere\u00e7o IP secund\u00e1rio",
+"label.new.secondaryip.description.description": "Insira uma descri\u00e7\u00e3o para o novo endere\u00e7o IP secund\u00e1rio",
 "label.new.tag": "Nova etiqueta",
 "label.new.version.available": "Nova vers\u00e3o dispon\u00edvel",
 "label.new.vm": "Nova VM",
@@ -1887,6 +1901,7 @@
 "label.register.oauth": "Registrar OAuth",
 "label.register.user.data": "Registrar dados de usu\u00e1rio",
 "label.register.template": "Registrar template",
+"label.registering.keypair": "Registrando par de chaves de API para o usu\u00e1rio \"{user}\"",
 "label.reinstall.vm": "Reinstalar VM",
 "label.reject": "Rejeitar",
 "label.related": "Relacionado",
@@ -2043,9 +2058,11 @@
 "label.secondary.storage": "Armazenamento secund\u00e1rio",
 "label.secondary.storage.vm": "VM de armazenamento secund\u00e1rio",
 "label.secondaryips": "IPs secund\u00e1rios",
+"label.secondaryip.description": "Descri\u00e7\u00e3o",
 "label.secondarystoragelimit": "Limites do armazenamento secund\u00e1rio (GiB)",
 "label.secretkey": "Chave secreta",
 "label.secret.key": "Chave secreta",
+"label.apikeyaccess": "Acesso a pares de chaves de API",
 "label.secured": "Protegido",
 "label.security.groups": "Grupos de seguran\u00e7a",
 "label.securitygroup": "Grupo de seguran\u00e7a",
@@ -2462,10 +2479,12 @@
 "label.usenewdiskoffering": "Substituir a oferta de disco?",
 "label.user": "Usu\u00e1rio",
 "label.user.conflict": "Conflito",
+"label.usersecretkey": "Chave Secreta de API",
 "label.user.data": "Dados de usu\u00e1rio",
 "label.username": "Nome de usu\u00e1rio",
 "label.users": "Usu\u00e1rios",
 "label.usersource": "Tipo de usu\u00e1rio",
+"label.user.api.key.rules": "Regras do par de chaves de API",
 "label.using.cli": "Usando CLI",
 "label.utilization": "Utiliza\u00e7\u00e3o",
 "label.uuid": "ID",
@@ -3361,6 +3380,8 @@
 "message.nfs.mount.options.description": "Lista separada por v\u00edrgulas de op\u00e7\u00f5es de montagem NFS para hosts KVM. Op\u00e7\u00f5es suportadas : vers=[3,4.0,4.1,4.2], nconnect=[1...16]",
 "message.no.data.to.show.for.period": "Nenhum dado para mostrar no per\u00edodo selecionado.",
 "message.no.description": "Nenhuma descri\u00e7\u00e3o inserida.",
+"message.note.about.keypair.permissions.title": "Observa\u00e7\u00e3o sobre as permiss\u00f5es de regras de pares de chaves de API",
+"message.note.about.keypair.permissions.body": "Durante a cria\u00e7\u00e3o de pares de chaves de API, é possível definir um conjunto correspondente de permiss\u00f5es de regras. Se um conjunto de regras for definido, o par de chaves de API terá acesso apenas às APIs para as quais o acesso foi explicitamente concedido (ou seja, APIs cujas regras correspondentes estejam marcadas como permitidas). Por outro lado, se nenhum conjunto de regras for especificado, as permiss\u00f5es do par de chaves de API seguir\u00e3o e se adaptar\u00e3o ao conjunto de permiss\u00f5es da role da conta do usu\u00e1rio.",
 "message.offering.internet.protocol.warning": "AVISO: Redes suportadas por IPv6 usam roteamento est\u00e1tico e exigir\u00e3o que rotas upstream sejam configuradas manualmente.",
 "message.offering.ipv6.warning": "Por favor, consulte a documenta\u00e7\u00e3o para criar oferta de Rede/VPC habilitada para IPv6 <a href='http://docs.cloudstack.apache.org/en/latest/plugins/ipv6.html#isolated-network-and-vpc-tier'>Suporte IPv6 no CloudStack - Redes Isoladas e Camadas de VPC</a>",
 "message.ovf.configurations": "H\u00e1 propriedades OVF dispon\u00edveis para a personaliza\u00e7\u00e3o do aparelho selecionado. Por favor, edite os valores de forma apropriada.As ofertas incompat\u00edveis de computa\u00e7\u00e3o ser\u00e3o desativadas.",
@@ -3387,6 +3408,7 @@
 "message.read.accept.license.agreements": "Leia e aceite os termos dos contratos de licen\u00e7a.",
 "message.read.admin.guide.scaling.up": "Por favor leia a sess\u00e3o sobre escalonamento din\u00e2mico no guia do administrador antes de escalonar.",
 "message.recover.vm": "Por favor, confirme a recupera\u00e7\u00e3o desta VM.",
+"message.register.keypair.failed": "Falha ao registrar par de chave de API",
 "message.reinstall.vm": "NOTA: proceda com cuidado. Isso far\u00e1 com que a m\u00e1quina virtual seja re-instalada a partir do template. Todos os dados do disco root ser\u00e3o perdidos. Se houver volumes de dados adicionais, eles n\u00e3o ser\u00e3o alterados.",
 "message.release.ip.failed": "Falha ao liberar IP",
 "message.releasing.dedicated.cluster": "Liberando cluster dedicado...",
@@ -3538,7 +3560,6 @@
 "message.success.create.keypair": "Par de chaves SSH criado com sucesso",
 "message.success.create.kubernetes.cluster": "Cluster Kubernetes criado com sucesso",
 "message.success.create.l2.network": "Rede L2 criada com sucesso",
-"message.success.create.password": "Par de chave de acesso \u00e0 API criada com sucesso",
 "message.success.create.sharedfs": "Sistema de Arquivos Compartilhado criado com sucesso",
 "message.success.create.snapshot.from.vmsnapshot": "Snapshot de volume a partir da snapshot de VM criada com sucesso",
 "message.success.create.template": "Template criado com sucesso",
@@ -3582,7 +3603,7 @@
 "message.success.register.keypair": "Par de chaves SSH registrado com sucesso",
 "message.success.register.template": "Template cadastrado com sucesso",
 "message.success.register.user.data": "Userdata registrado com sucesso",
-"message.success.register.user.keypair": "Novo par de chave de API criado com sucesso",
+"message.success.register.user.keypair": "Novo par de chaves de API registrado com sucesso para o usu\u00e1rio \"{user}\"",
 "message.success.release.dedicated.bgp.peer": "Par BGP dedicado liberado com sucesso",
 "message.success.release.dedicated.ipv4.subnet": "Sub-rede IPv4 dedicada liberada com sucesso",
 "message.success.release.ip": "IP liberado com sucesso",
diff --git a/ui/src/components/view/ApiKeyPairsTab.vue b/ui/src/components/view/ApiKeyPairsTab.vue
new file mode 100644
index 000000000000..87feda59d992
--- /dev/null
+++ b/ui/src/components/view/ApiKeyPairsTab.vue
@@ -0,0 +1,451 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <a-spin :spinning="fetchLoading">
+      <a-button
+        v-if="'registerUserKeys' in $store.getters.apis"
+        type="dashed"
+        style="width: 100%; margin-bottom: 15px"
+        @click="onShowAddKeyPair()">
+        <template #icon><plus-outlined /></template>
+        {{ $t('label.register.api.key') }}
+      </a-button>
+      <a-button
+        v-if="this.selectedRowKeys.length > 0 && ('deleteUserKeys' in $store.getters.apis)"
+        type="primary"
+        danger
+        style="width: 100%; margin-bottom: 15px"
+        @click="bulkActionConfirmation()">
+        <template #icon><delete-outlined /></template>
+        {{ $t('label.action.bulk.delete.api.keys') }}
+      </a-button>
+      <a-table
+        size="small"
+        style="overflow-y: auto"
+        :columns="columns"
+        :dataSource="keypairs"
+        :rowKey="item => item.id"
+        :rowSelection="rowSelection()"
+        :pagination="false" >
+        <template #name="{ record }">
+          <div>
+            <router-link :to="{ path: '/keypair/' + record.id }" >
+              {{ record.name }}
+            </router-link>
+          </div>
+        </template>
+        <template #apikey="{ record }">
+          <strong>
+            <tooltip-button
+              tooltipPlacement="right"
+              :tooltip="$t('label.copy')"
+              icon="CopyOutlined"
+              type="dashed"
+              size="small"
+              @onClick="$message.success($t('label.copied.clipboard'))"
+              :copyResource="record.apikey" />
+          </strong>
+          <div>
+            {{ record.apikey.substring(0, 20) }}...
+          </div>
+        </template>
+
+        <template #secretkey="{ record }">
+          <strong>
+            <tooltip-button
+              tooltipPlacement="right"
+              :tooltip="$t('label.copy')"
+              icon="CopyOutlined"
+              type="dashed"
+              size="small"
+              @onClick="$message.success($t('label.copied.clipboard'))"
+              :copyResource="record.secretkey" />
+          </strong>
+          <div>
+            {{ record.secretkey.substring(0, 20) }}...
+          </div>
+        </template>
+
+        <template #startdate="{ record }">
+          <div> {{ $toLocaleDate(record.startdate) }} </div>
+        </template>
+
+        <template #enddate="{ record }">
+          <div> {{ $toLocaleDate(record.enddate)}} </div>
+        </template>
+
+        <template #created="{ record }">
+          <div> {{ $toLocaleDate(record.created) }} </div>
+        </template>
+
+      </a-table>
+      <a-divider/>
+      <a-pagination
+        class="row-element pagination"
+        size="small"
+        :current="page"
+        :pageSize="pageSize"
+        :total="totalKeypairs"
+        :showTotal="total => `${$t('label.total')} ${total} ${$t('label.items')}`"
+        :pageSizeOptions="['10', '20', '40', '80', '100']"
+        @change="changePage"
+        @showSizeChange="changePageSize"
+        showSizeChanger>
+        <template #buildOptionText="props">
+          <span>{{ props.value }} / {{ $t('label.page') }}</span>
+        </template>
+      </a-pagination>
+    </a-spin>
+    <bulk-action-view
+      v-if="(showConfirmationAction || showGroupActionModal)"
+      :showConfirmationAction="showConfirmationAction"
+      :showGroupActionModal="showGroupActionModal"
+      :items="keypairs"
+      :selectedRowKeys="selectedRowKeys"
+      :selectedItems="selectedItems"
+      :columns="columns"
+      :selectedColumns="selectedColumns"
+      action="eraseKeypairs"
+      :loading="loading"
+      :message="bulkDeleteMessage"
+      @group-action="eraseKeypairs"
+      @handle-cancel="handleCancelBulk"
+      @close-modal="closeModalBulk" />
+    <generate-api-key-pair
+      :showAddKeyPair="showAddKeyPair"
+      :resource="resource"
+      @fetch-data="fetchData"
+      @refresh-data="handleRefreshData"
+      @close-modal="closeModalAddKeyPair" />
+  </div>
+</template>
+<script>
+import { getAPI, postAPI } from '@/api'
+import TooltipButton from '@/components/widgets/TooltipButton'
+import BulkActionView from '@/components/view/BulkActionView.vue'
+import eventBus from '@/config/eventBus'
+import GenerateApiKeyPair from '@/views/iam/GenerateApiKeyPair.vue'
+
+export default {
+  name: 'ApiKeyPairsTab',
+  components: {
+    TooltipButton,
+    BulkActionView,
+    GenerateApiKeyPair
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    },
+    loading: {
+      type: Boolean,
+      default: false
+    }
+  },
+  data () {
+    return {
+      fetchLoading: false,
+      keypairs: [],
+      page: 1,
+      pageSize: 10,
+      totalKeypairs: 0,
+      selectedRowKeys: [],
+      selectedItems: [],
+      selectedColumns: [],
+      filterColumns: ['Action'],
+      showConfirmationAction: false,
+      showAddKeyPair: false,
+      showGroupActionModal: false,
+      bulkDeleteMessage: {
+        title: this.$t('label.action.bulk.delete.api.keys'),
+        confirmMessage: this.$t('label.confirm.delete.api.keys')
+      },
+      columns: [
+        {
+          title: this.$t('label.name'),
+          dataIndex: 'name',
+          slots: { customRender: 'name' }
+        },
+        {
+          title: this.$t('label.apikey'),
+          dataIndex: 'apikey',
+          slots: { customRender: 'apikey' }
+        },
+        {
+          title: this.$t('label.secretkey'),
+          dataIndex: 'secretkey',
+          slots: { customRender: 'secretkey' }
+        },
+        {
+          title: this.$t('label.start.date'),
+          dataIndex: 'startdate',
+          slots: { customRender: 'startdate' }
+        },
+        {
+          title: this.$t('label.end.date'),
+          dataIndex: 'enddate',
+          slots: { customRender: 'enddate' }
+        },
+        {
+          title: this.$t('label.created'),
+          dataIndex: 'created',
+          slots: { customRender: 'created' }
+        }
+      ]
+    }
+  },
+  created () {
+    this.fetchData()
+  },
+  watch: {
+    resource: {
+      deep: true,
+      handler (newItem) {
+        if (!newItem || !newItem.id) {
+          return
+        }
+        this.fetchData()
+      }
+    }
+  },
+  inject: ['parentFetchData'],
+  methods: {
+    fetchData () {
+      const params = {
+        listall: true,
+        page: this.page,
+        pagesize: this.pageSize,
+        userid: this.resource.id
+      }
+      this.fetchLoading = true
+      getAPI('listUserKeys', params).then(json => {
+        this.totalKeypairs = json.listuserkeysresponse.count || 0
+        this.keypairs = json.listuserkeysresponse.userapikey || []
+      }).finally(() => {
+        this.fetchLoading = false
+      })
+    },
+    setSelection (selection) {
+      this.selectedRowKeys = selection
+      this.$emit('selection-change', this.selectedRowKeys)
+      this.selectedItems = (this.keypairs.filter(function (item) {
+        return selection.indexOf(item.id) !== -1
+      }))
+    },
+    changePage (page, pageSize) {
+      this.page = page
+      this.pageSize = pageSize
+      this.fetchData()
+    },
+    changePageSize (currentPage, pageSize) {
+      this.page = currentPage
+      this.pageSize = pageSize
+      this.fetchData()
+    },
+    onShowAddKeyPair () {
+      this.showAddKeyPair = true
+    },
+    eraseKeypairs () {
+      this.selectedColumns.splice(0, 0, {
+        dataIndex: 'status',
+        title: this.$t('label.operation.status'),
+        slots: { customRender: 'status' },
+        filters: [
+          { text: this.$t('state.inprogress'), value: 'InProgress' },
+          { text: this.$t('label.success'), value: 'success' },
+          { text: this.$t('label.failed'), value: 'failed' }
+        ]
+      })
+      if (this.selectedRowKeys.length > 0) {
+        this.showGroupActionModal = true
+      }
+      this.deleteKeypairs(this.selectedItems)
+    },
+    async deleteKeypairs (keypairs) {
+      if (!keypairs || keypairs.length === 0) {
+        this.fetchLoading = false
+        return
+      }
+
+      this.fetchLoading = true
+      try {
+        await Promise.all(keypairs.map(async keypair => {
+          try {
+            const jobId = await this.deleteKeyPair({
+              keypairid: keypair.id
+            })
+            await this.$pollJob({
+              jobId,
+              action: {
+                isFetchData: false
+              },
+              successMethod: () => {
+                eventBus.emit('update-resource-state', { selectedItems: this.selectedItems, resource: keypair.id, state: 'success' })
+              },
+              catchMethod: () => {
+                eventBus.emit('update-resource-state', { selectedItems: this.selectedItems, resource: keypair.id, state: 'failed' })
+              }
+            })
+          } catch (e) {
+            eventBus.emit('update-resource-state', { selectedItems: this.selectedItems, resource: keypair.id, state: 'failed' })
+          }
+        }))
+      } finally {
+        this.fetchLoading = false
+      }
+    },
+    async deleteKeyPair (args) {
+      const response = await postAPI('deleteUserKeys', args)
+      return response.deleteuserkeysresponse.jobid
+    },
+    bulkActionConfirmation () {
+      this.showConfirmationAction = true
+      this.selectedColumns = this.columns.filter(column => {
+        return !this.filterColumns.includes(column.title)
+      })
+      this.selectedItems = this.selectedItems.map(v => ({ ...v, status: 'InProgress' }))
+    },
+    handleCancelBulk () {
+      eventBus.emit('update-bulk-job-status', { items: this.selectedItems, action: false })
+      this.showGroupActionModal = false
+      this.selectedItems = []
+      this.selectedColumns = []
+      this.selectedRowKeys = []
+      this.parentFetchData()
+    },
+    closeModalBulk () {
+      this.showConfirmationAction = false
+    },
+    closeModalAddKeyPair () {
+      this.showAddKeyPair = false
+    },
+    handleRefreshData () {
+      this.$emit('refresh-data')
+    },
+    rowSelection () {
+      if ('deleteUserKeys' in this.$store.getters.apis) {
+        return {
+          selectedRowKeys: this.selectedRowKeys,
+          onChange: this.setSelection
+        }
+      }
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+.list {
+  max-height: 95vh;
+  width: 95vw;
+  overflow-y: scroll;
+  margin: -24px;
+
+  @media (min-width: 1000px) {
+    max-height: 70vh;
+    width: 900px;
+  }
+
+  &__header,
+  &__footer {
+    padding: 20px;
+  }
+
+  &__header {
+    display: flex;
+
+    .ant-select {
+      min-width: 200px;
+    }
+
+    &__col {
+
+      &:not(:last-child) {
+        margin-right: 20px;
+      }
+
+      &--full {
+        flex: 1;
+      }
+
+    }
+
+  }
+
+  &__footer {
+    display: flex;
+    justify-content: flex-end;
+
+    button {
+      &:not(:last-child) {
+        margin-right: 10px;
+      }
+    }
+  }
+
+  &__item {
+    padding-right: 20px;
+    padding-left: 20px;
+
+    &--selected {
+      background-color: #e6f7ff;
+    }
+
+  }
+
+  &__title {
+    font-weight: bold;
+  }
+
+  &__outer-container {
+    width: 100%;
+    display: flex;
+    flex-direction: column;
+  }
+
+  &__container {
+    display: flex;
+    flex-direction: column;
+    width: 100%;
+    cursor: pointer;
+
+    @media (min-width: 760px) {
+      flex-direction: row;
+      align-items: center;
+    }
+
+  }
+
+  &__row {
+    margin-bottom: 10px;
+
+    @media (min-width: 760px) {
+      margin-right: 20px;
+      margin-bottom: 0;
+    }
+  }
+
+  &__radio {
+    display: flex;
+    justify-content: flex-end;
+  }
+
+}
+</style>
diff --git a/ui/src/components/view/DetailsTab.vue b/ui/src/components/view/DetailsTab.vue
index 4145eeb9be6d..ecff34b2949d 100644
--- a/ui/src/components/view/DetailsTab.vue
+++ b/ui/src/components/view/DetailsTab.vue
@@ -97,7 +97,7 @@
             <span v-if="['USER.LOGIN', 'USER.LOGOUT', 'ROUTER.HEALTH.CHECKS', 'FIREWALL.CLOSE', 'ALERT.SERVICE.DOMAINROUTER'].includes(dataResource[item])">{{ $t(dataResource[item].toLowerCase()) }}</span>
             <span v-else>{{ dataResource[item] }}</span>
           </div>
-          <div v-else-if="['created', 'sent', 'lastannotated', 'collectiontime', 'lastboottime', 'lastserverstart', 'lastserverstop', 'removed', 'effectiveDate', 'endDate'].includes(item)">
+          <div v-else-if="['created', 'sent', 'lastannotated', 'collectiontime', 'lastboottime', 'lastserverstart', 'lastserverstop', 'removed', 'effectiveDate', 'endDate', 'startdate', 'enddate'].includes(item)">
             {{ $toLocaleDate(dataResource[item]) }}
           </div>
           <div style="white-space: pre-wrap;" v-else-if="$route.meta.name === 'quotatariff' && item === 'description'">{{ dataResource[item] }}</div>
@@ -168,7 +168,7 @@
           <div>{{ dataResource[item] }}</div>
         </div>
       </a-list-item>
-      <a-list-item v-else-if="['startdate', 'enddate'].includes(item)">
+      <a-list-item v-else-if="['startdate', 'enddate'].includes(item) && dataResource[item]">
         <div>
           <strong>{{ $t('label.' + item.replace('date', '.date.and.time'))}}</strong>
           <br/>
diff --git a/ui/src/components/view/InfoCard.vue b/ui/src/components/view/InfoCard.vue
index 996e30ead3b5..41c822de238d 100644
--- a/ui/src/components/view/InfoCard.vue
+++ b/ui/src/components/view/InfoCard.vue
@@ -120,12 +120,18 @@
 
             <a-divider/>
 
-            <div class="resource-detail-item" v-if="(resource.state || resource.status) && $route.meta.name !== 'zone'">
+            <div class="resource-detail-item" v-if="(resource.state || resource.status) && !['zone', 'keypair'].includes($route.meta.name)">
               <div class="resource-detail-item__label">{{ $t('label.status') }}</div>
               <div class="resource-detail-item__details">
                 <status class="status" :text="resource.state || resource.status" displayText/>
               </div>
             </div>
+            <div class="resource-detail-item" v-if="resource.apikeyaccess && $route.meta.name === 'accountuser'">
+              <div class="resource-detail-item__label">{{ $t('label.apikeyaccess') }}</div>
+              <div class="resource-detail-item__details">
+                <status class="status" :text="resource.apikeyaccess" displayText/>
+              </div>
+            </div>
             <div class="resource-detail-item" v-if="resource.allocationstate">
               <div class="resource-detail-item__label">{{ $t('label.allocationstate') }}</div>
               <div class="resource-detail-item__details">
@@ -159,6 +165,42 @@
                 <span style="margin-left: 10px;"><copy-label :label="resource.id" /></span>
               </div>
             </div>
+            <div class="resource-detail-item" v-if="resource.apikey && resource.secretkey">
+              <div class="user-keys">
+                <key-outlined />
+                <strong>
+                  {{ $t('label.apikey') }}
+                  <tooltip-button
+                    tooltipPlacement="right"
+                    :tooltip="$t('label.copy') + ' ' + $t('label.apikey')"
+                    icon="CopyOutlined"
+                    type="dashed"
+                    size="small"
+                    @onClick="$message.success($t('label.copied.clipboard'))"
+                    :copyResource="resource.apikey" />
+                </strong>
+                <div>
+                  {{ resource.apikey.substring(0, 20) }}...
+                </div>
+              </div> <br/>
+              <div class="user-keys">
+                <lock-outlined />
+                <strong>
+                  {{ $t('label.secretkey') }}
+                  <tooltip-button
+                    tooltipPlacement="right"
+                    :tooltip="$t('label.copy') + ' ' + $t('label.secretkey')"
+                    icon="CopyOutlined"
+                    type="dashed"
+                    size="small"
+                    @onClick="$message.success($t('label.copied.clipboard'))"
+                    :copyResource="resource.secretkey" />
+                </strong>
+                <div>
+                  {{ resource.secretkey.substring(0, 20) }}...
+                </div>
+              </div>
+            </div>
             <div class="resource-detail-item" v-if="(resource.ostypename || resource.osdisplayname) && resource.ostypeid">
               <div class="resource-detail-item__label">{{ $t('label.ostypename') }}</div>
               <div class="resource-detail-item__details">
@@ -609,7 +651,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="images.template || images.guestoscategory" :image="images.template || images.guestoscategory" size="1x" style="margin-right: 5px"/>
                 <SaveOutlined v-else />
-                <router-link :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <router-link v-if="validLinks.template" :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <span v-else>{{ resource.templatedisplaytext || resource.templatename || resource.templateid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.isoid">
@@ -617,7 +660,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="images.iso || (resource.isoid === resource.templateid && images.guestoscategory)" :image="images.iso || images.guestoscategory" size="1x" style="margin-right: 5px"/>
                 <UsbOutlined v-else />
-                  <router-link :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <router-link v-if="validLinks.iso" :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <span v-else>{{ resource.isodisplaytext || resource.isoname || resource.isoid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.serviceofferingname && resource.serviceofferingid">
@@ -794,6 +838,14 @@
                 <span v-else>{{ resource.account }}</span>
               </div>
             </div>
+            <div class="resource-detail-item" v-if="resource.userid && $route.meta.name === 'keypair'">
+              <div class="resource-detail-item__label">{{ $t('label.user') }}</div>
+              <div class="resource-detail-item__details">
+                <user-outlined />
+                <router-link v-if="!isStatic && $router.resolve('/accountuser/' + resource.userid).matched[0].redirect !== '/exception/404'" :to="{ path: '/accountuser/' + resource.userid }">{{ resource.username }}</router-link>
+                <span v-else>{{ resource.username }}</span>
+              </div>
+            </div>
             <div class="resource-detail-item" v-if="resource.roleid">
               <div class="resource-detail-item__label">{{ $t('label.role') }}</div>
               <div class="resource-detail-item__details">
@@ -881,54 +933,6 @@
               :osCategoryId="osCategoryId" />
           </div>
 
-          <div class="account-center-tags" v-if="showKeys || resource.apikeyaccess">
-            <a-divider/>
-          </div>
-          <div class="account-center-tags" v-if="resource.apikeyaccess && resource.account">
-            <div class="resource-detail-item">
-              <div class="resource-detail-item__label">{{ $t('label.apikeyaccess') }}</div>
-              <div class="resource-detail-item__details">
-                <status class="status" :text="resource.apikeyaccess" displayText/>
-              </div>
-            </div>
-          </div>
-          <div class="account-center-tags" v-if="showKeys">
-            <div class="user-keys">
-              <key-outlined />
-              <strong>
-                {{ $t('label.apikey') }}
-                <tooltip-button
-                  tooltipPlacement="right"
-                  :tooltip="$t('label.copy') + ' ' + $t('label.apikey')"
-                  icon="CopyOutlined"
-                  type="dashed"
-                  size="small"
-                  @onClick="$message.success($t('label.copied.clipboard'))"
-                  :copyResource="resource.apikey" />
-              </strong>
-              <div>
-                {{ resource.apikey.substring(0, 20) }}...
-              </div>
-            </div> <br/>
-            <div class="user-keys">
-              <lock-outlined />
-              <strong>
-                {{ $t('label.secretkey') }}
-                <tooltip-button
-                  tooltipPlacement="right"
-                  :tooltip="$t('label.copy') + ' ' + $t('label.secretkey')"
-                  icon="CopyOutlined"
-                  type="dashed"
-                  size="small"
-                  @onClick="$message.success($t('label.copied.clipboard'))"
-                  :copyResource="resource.secretkey" />
-              </strong>
-              <div>
-                {{ resource.secretkey.substring(0, 20) }}...
-              </div>
-            </div>
-          </div>
-
           <div class="account-center-tags" v-if="!isStatic && resourceType && tagsSupportingResourceTypes.includes(this.resourceType) && 'listTags' in $store.getters.apis">
             <a-divider/>
             <a-spin :spinning="loadingTags">
@@ -980,7 +984,7 @@
 <script>
 import { getAPI, postAPI } from '@/api'
 import { createPathBasedOnVmType } from '@/utils/plugins'
-import { validateLinks } from '@/utils/links'
+import { validateLinksAsync } from '@/utils/links'
 import Console from '@/components/widgets/Console'
 import OsLogo from '@/components/widgets/OsLogo'
 import Status from '@/components/widgets/Status'
@@ -1068,14 +1072,14 @@ export default {
     },
     resource: {
       deep: true,
-      handler (newData, oldData) {
+      async handler (newData, oldData) {
         if (newData === oldData) return
         this.newResource = newData
         this.showKeys = false
         this.setData()
-        this.validLinks = validateLinks(this.$router, this.isStatic, this.resource)
+        this.validLinks = await validateLinksAsync(this.$router, this.isStatic, this.resource)
 
-        if ('apikey' in this.resource) {
+        if (this.$route.meta.name === 'accountuser' && 'apikey' in this.resource) {
           this.getUserKeys()
         }
         this.updateResourceAdditionalData()
@@ -1254,8 +1258,6 @@ export default {
         return
       }
       getAPI('getUserKeys', { id: this.resource.id }).then(json => {
-        this.showKeys = true
-        this.newResource.secretkey = json.getuserkeysresponse.userkeys.secretkey
         if (!this.isAdmin()) {
           this.newResource.apikeyaccess = json.getuserkeysresponse.userkeys.apikeyaccess ? 'Enabled' : 'Disabled'
         }
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index b03293efacae..56fe109099d2 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -795,7 +795,7 @@
         {{ record.enabled ? 'Enabled' : 'Disabled' }}
       </template>
       <template
-        v-if="['created', 'sent', 'removed', 'effectiveDate', 'endDate', 'allocated'].includes(column.key) || (['startdate'].includes(column.key) && ['webhook'].includes($route.path.split('/')[1])) || (column.key === 'allocated' && ['asnumbers', 'publicip', 'ipv4subnets'].includes($route.meta.name) && text)"
+        v-if="['created', 'sent', 'removed', 'effectiveDate', 'endDate', 'allocated', 'startdate', 'enddate'].includes(column.key) || (['startdate'].includes(column.key) && ['webhook'].includes($route.path.split('/')[1])) || (column.key === 'allocated' && ['asnumbers', 'publicip', 'ipv4subnets'].includes($route.meta.name) && text)"
       >
         {{ text && $toLocaleDate(text) }}
       </template>
diff --git a/ui/src/components/view/SettingsTab.vue b/ui/src/components/view/SettingsTab.vue
index 0e0ee33f2800..0bb8a1569cca 100644
--- a/ui/src/components/view/SettingsTab.vue
+++ b/ui/src/components/view/SettingsTab.vue
@@ -106,6 +106,9 @@ export default {
       case 'imagestore':
         this.scopeKey = 'imagestoreuuid'
         break
+      case 'managementserver':
+        this.scopeKey = 'managementserverid'
+        break
       default:
         this.scopeKey = ''
     }
diff --git a/ui/src/config/router.js b/ui/src/config/router.js
index 43e8efd7b5d3..78346d13cacb 100644
--- a/ui/src/config/router.js
+++ b/ui/src/config/router.js
@@ -31,6 +31,7 @@ import image from '@/config/section/image'
 import project from '@/config/section/project'
 import event from '@/config/section/event'
 import user from '@/config/section/user'
+import keyPair from '@/config/section/keypair'
 import account from '@/config/section/account'
 import domain from '@/config/section/domain'
 import role from '@/config/section/role'
@@ -221,6 +222,7 @@ export function asyncRouterMap () {
       generateRouterMap(event),
       generateRouterMap(project),
       generateRouterMap(user),
+      generateRouterMap(keyPair),
       generateRouterMap(role),
       generateRouterMap(account),
       generateRouterMap(domain),
diff --git a/ui/src/config/section/config.js b/ui/src/config/section/config.js
index e190515855e6..2a83b25c002f 100644
--- a/ui/src/config/section/config.js
+++ b/ui/src/config/section/config.js
@@ -80,7 +80,7 @@ export default {
       docHelp: 'adminguide/accounts.html#using-an-ldap-server-for-user-authentication',
       permission: ['listOauthProvider'],
       columns: ['provider', 'enabled', 'description', 'clientid', 'secretkey', 'redirecturi'],
-      details: ['provider', 'description', 'enabled', 'clientid', 'secretkey', 'redirecturi'],
+      details: ['provider', 'description', 'enabled', 'clientid', 'secretkey', 'redirecturi', 'authorizeurl', 'tokenurl'],
       actions: [
         {
           api: 'registerOauthProvider',
@@ -89,11 +89,11 @@ export default {
           listView: true,
           dataView: false,
           args: [
-            'provider', 'description', 'clientid', 'redirecturi', 'secretkey'
+            'provider', 'description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl'
           ],
           mapping: {
             provider: {
-              options: ['google', 'github']
+              options: ['google', 'github', 'keycloak']
             }
           }
         },
@@ -103,7 +103,7 @@ export default {
           label: 'label.edit',
           dataView: true,
           popup: true,
-          args: ['description', 'clientid', 'redirecturi', 'secretkey']
+          args: ['description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl']
         },
         {
           api: 'updateOauthProvider',
diff --git a/ui/src/config/section/infra/managementServers.js b/ui/src/config/section/infra/managementServers.js
index d2d11d5b25d0..4bf54943fd85 100644
--- a/ui/src/config/section/infra/managementServers.js
+++ b/ui/src/config/section/infra/managementServers.js
@@ -39,6 +39,10 @@ export default {
       name: 'details',
       component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
     },
+    {
+      name: 'settings',
+      component: shallowRef(defineAsyncComponent(() => import('@/components/view/SettingsTab.vue')))
+    },
     {
       name: 'management.server.peers',
       component: shallowRef(defineAsyncComponent(() => import('@/views/infra/ManagementServerPeerTab.vue')))
diff --git a/ui/src/config/section/keypair.js b/ui/src/config/section/keypair.js
new file mode 100644
index 000000000000..86486db19c38
--- /dev/null
+++ b/ui/src/config/section/keypair.js
@@ -0,0 +1,69 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import { shallowRef, defineAsyncComponent } from 'vue'
+import store from '@/store'
+
+export default {
+  name: 'keypair',
+  identifier: 'keypairid',
+  title: 'label.apikeypairs',
+  icon: 'key-outlined',
+  hidden: true,
+  docHelp: 'adminguide/accounts.html#keypairs',
+  permission: ['listUserKeys'],
+  columns: [
+    'name',
+    { field: 'startdate', customTitle: 'apikeypair.startdate' },
+    { field: 'enddate', customTitle: 'apikeypair.enddate' },
+    'username', 'rolename'
+  ],
+  details: [
+    'id', 'name', 'description',
+    'domain', 'role', 'roletype',
+    { field: 'accountname', customTitle: 'account' }, 'username',
+    { field: 'startdate', customTitle: 'apikeypair.startdate' },
+    { field: 'enddate', customTitle: 'apikeypair.enddate' },
+    'created'
+  ],
+  tabs: [{
+    name: 'details',
+    component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
+  }, {
+    name: 'rules',
+    component: shallowRef(defineAsyncComponent(() => import('@/views/iam/ApiKeyPairPermissionTable.vue'))),
+    show: () => { return 'listUserKeyRules' in store.getters.apis }
+  }],
+  actions: [
+    {
+      api: 'deleteUserKeys',
+      icon: 'delete-outlined',
+      label: 'label.action.delete.keypair',
+      message: 'message.delete.keypair',
+      dataView: true,
+      args: ['keypairid'],
+      mapping: {
+        keypairid: {
+          value: (record) => { return record.id }
+        }
+      },
+      show: () => {
+        return 'deleteUserKeys' in store.getters.apis
+      }
+    }
+  ]
+}
diff --git a/ui/src/config/section/user.js b/ui/src/config/section/user.js
index eaaca983dc0a..a2808356233e 100644
--- a/ui/src/config/section/user.js
+++ b/ui/src/config/section/user.js
@@ -63,6 +63,12 @@ export default {
       resourceType: 'User',
       component: shallowRef(defineAsyncComponent(() => import('@/components/view/EventsTab.vue'))),
       show: () => { return 'listEvents' in store.getters.apis }
+    },
+    {
+      name: 'apikeypairs',
+      resourceType: 'User',
+      component: shallowRef(defineAsyncComponent(() => import('@/components/view/ApiKeyPairsTab.vue'))),
+      show: () => { return 'listUserKeys' in store.getters.apis }
     }
   ],
   actions: [
diff --git a/ui/src/utils/links.js b/ui/src/utils/links.js
index fa650cdd7b8b..9beafc4a9869 100644
--- a/ui/src/utils/links.js
+++ b/ui/src/utils/links.js
@@ -15,6 +15,27 @@
 // specific language governing permissions and limitations
 // under the License.
 
+import { getAPI } from '@/api'
+
+async function isValidObject (apiName, id, params) {
+  try {
+    const allParams = { ...params, listAll: true, id }
+    const json = await getAPI(apiName, allParams)
+    const responseName = Object.keys(json).find(key => key.endsWith('response')) || apiName.toLowerCase() + 'response'
+    const response = json?.[responseName]
+    if (!response) {
+      return false
+    }
+    const objectName = Object.keys(response).find(key => key !== 'count')
+    if (!objectName || !Array.isArray(response[objectName])) {
+      return false
+    }
+    return response[objectName].some(item => item.id === id)
+  } catch (e) {
+    return false
+  }
+}
+
 export function validateLinks (router, isStatic, resource) {
   const validLinks = {
     volume: false
@@ -34,3 +55,54 @@ export function validateLinks (router, isStatic, resource) {
 
   return validLinks
 }
+
+export async function validateLinksAsync (router, isStatic, resource) {
+  const validLinks = {
+    volume: false,
+    template: false,
+    iso: false
+  }
+  const pendingChecks = []
+
+  if (isStatic) {
+    return validLinks
+  }
+
+  if (resource.volumeid && router.resolve('/volume/' + resource.volumeid).matched[0].redirect !== '/exception/404') {
+    if (resource.volumestate) {
+      validLinks.volume = resource.volumestate !== 'Expunged'
+    } else {
+      validLinks.volume = true
+    }
+  }
+
+  if (resource.templateid) {
+    const templatePath = (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid
+    if (router.resolve(templatePath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listTemplates', resource.templateid, { templatefilter: 'executable' }).then(result => {
+          validLinks.template = result
+        })
+      )
+    }
+  }
+
+  if (resource.isoid) {
+    const isoPath = '/iso/' + resource.isoid
+    if (router.resolve(isoPath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listIsos', resource.isoid, { isofilter: 'executable' }).then(result => {
+          validLinks.iso = result
+        })
+      )
+    }
+  }
+
+  if (pendingChecks.length) {
+    await Promise.all(pendingChecks).catch(error => {
+      console.error('Error validating links:', error)
+    })
+  }
+
+  return validLinks
+}
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index 436f61a37da3..c0603445b57f 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -1119,7 +1119,6 @@ export default {
       this.loading = true
       if (this.$route.path.startsWith('/cniconfiguration')) {
         params.forcks = true
-        console.log('here')
       }
       if (this.$route.params && this.$route.params.id) {
         params.id = this.$route.params.id
@@ -1132,6 +1131,10 @@ export default {
             params.name = this.$route.params.id
           }
         }
+        if (['listUserKeys'].includes(this.apiName)) {
+          delete params.listall
+          params.keypairid = this.$route.params.id
+        }
         if (['listPublicIpAddresses'].includes(this.apiName)) {
           params.allocatedonly = false
         }
@@ -1253,7 +1256,7 @@ export default {
         if (this.items.length <= 0 && this.dataView) {
           this.$router.push({ path: '/exception/404' })
         }
-        if (!this.showAction || this.dataView) {
+        if (!this.showAction || this.dataView || (this.items.length === 1 && this.apiName === 'getUserKeys')) {
           this.resource = this.items?.[0] || {}
           this.$emit('change-resource', this.resource)
         }
diff --git a/ui/src/views/auth/Login.vue b/ui/src/views/auth/Login.vue
index 24065f47b1aa..acb874dc75be 100644
--- a/ui/src/views/auth/Login.vue
+++ b/ui/src/views/auth/Login.vue
@@ -186,8 +186,8 @@
           :href="getGitHubUrl(from)"
           class="auth-btn github-auth"
           style="height: 38px; width: 185px; padding: 0; margin-bottom: 5px;" >
-          <img src="/assets/github.svg" style="width: 32px; padding: 5px" />
-          <a-typography-text>Sign in with Github</a-typography-text>
+          <img src="/assets/github.svg" alt="GitHub" style="width: 32px; padding: 5px" />
+          <a-typography-text>Sign in with GitHub</a-typography-text>
         </a-button>
       </div>
       <div class="social-auth" v-if="googleprovider">
@@ -198,10 +198,22 @@
           :href="getGoogleUrl(from)"
           class="auth-btn google-auth"
           style="height: 38px; width: 185px; padding: 0" >
-          <img src="/assets/google.svg" style="width: 32px; padding: 5px" />
+          <img src="/assets/google.svg" alt="Google" style="width: 32px; padding: 5px" />
           <a-typography-text>Sign in with Google</a-typography-text>
         </a-button>
       </div>
+      <div class="social-auth" v-if="keycloakprovider">
+        <a-button
+          @click="handleKeycloakProviderAndDomain"
+          tag="a"
+          color="primary"
+          :href="getKeycloakUrl(from)"
+          class="auth-btn keycloak-auth"
+          style="height: 38px; width: 185px; padding: 0" >
+          <img src="/assets/keycloak.svg" alt="Keycloak" style="width: 32px; padding: 5px" />
+          <a-typography-text>Sign in with Keycloak</a-typography-text>
+        </a-button>
+      </div>
     </div>
   </a-form>
 </template>
@@ -231,10 +243,14 @@ export default {
       socialLogin: false,
       googleprovider: false,
       githubprovider: false,
+      keycloakprovider: false,
       googleredirecturi: '',
       githubredirecturi: '',
+      keycloakredirecturi: '',
       googleclientid: '',
       githubclientid: '',
+      keycloakclientid: '',
+      keycloakauthorizeurl: '',
       loginType: 0,
       state: {
         time: 60,
@@ -325,8 +341,14 @@ export default {
               this.githubclientid = item.clientid
               this.githubredirecturi = item.redirecturi
             }
+            if (item.provider === 'keycloak') {
+              this.keycloakprovider = item.enabled
+              this.keycloakclientid = item.clientid
+              this.keycloakredirecturi = item.redirecturi
+              this.keycloakauthorizeurl = item.authorizeurl
+            }
           })
-          this.socialLogin = this.googleprovider || this.githubprovider
+          this.socialLogin = this.googleprovider || this.githubprovider || this.keycloakprovider
         }
       })
       postAPI('forgotPassword', {}).then(response => {
@@ -362,6 +384,10 @@ export default {
       this.handleDomain()
       this.$store.commit('SET_OAUTH_PROVIDER_USED_TO_LOGIN', 'google')
     },
+    handleKeycloakProviderAndDomain () {
+      this.handleDomain()
+      this.$store.commit('SET_OAUTH_PROVIDER_USED_TO_LOGIN', 'keycloak')
+    },
     handleDomain () {
       const values = toRaw(this.form)
       if (!values.domain) {
@@ -401,6 +427,20 @@ export default {
 
       return `${rootUrl}?${qs.toString()}`
     },
+    getKeycloakUrl (from) {
+      const rootURl = this.keycloakauthorizeurl
+      const options = {
+        redirect_uri: this.keycloakredirecturi,
+        client_id: this.keycloakclientid,
+        response_type: 'code',
+        scope: 'openid email',
+        state: 'cloudstack'
+      }
+
+      const qs = new URLSearchParams(options)
+
+      return `${rootURl}?${qs.toString()}`
+    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.state.loginBtn) return
diff --git a/ui/src/views/iam/AddAccount.vue b/ui/src/views/iam/AddAccount.vue
index 25b45cded4ec..a211fd2d8c3d 100644
--- a/ui/src/views/iam/AddAccount.vue
+++ b/ui/src/views/iam/AddAccount.vue
@@ -36,6 +36,7 @@
             v-focus="true"
             showSearch
             optionFilterProp="label"
+            @change="onRoleChange"
             :filterOption="(input, option) => {
               return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
             }">
@@ -211,6 +212,7 @@ export default {
       domain: { id: null, loading: false },
       domainsList: [],
       dom: null,
+      roleManuallySelected: false,
       roleLoading: false,
       roles: [],
       timeZoneLoading: false,
@@ -299,8 +301,13 @@ export default {
         })
       }
     },
+    onRoleChange (newRoleId) {
+      if (newRoleId) {
+        this.roleManuallySelected = true
+      }
+    },
     setDefaultRole () {
-      if (this.roles.length === 0) return
+      if (this.roles.length === 0 || this.roleManuallySelected) return
 
       let targetRoleType = null
 
diff --git a/ui/src/views/iam/ApiKeyPairPermissionTable.vue b/ui/src/views/iam/ApiKeyPairPermissionTable.vue
new file mode 100644
index 000000000000..a3670aa5578b
--- /dev/null
+++ b/ui/src/views/iam/ApiKeyPairPermissionTable.vue
@@ -0,0 +1,518 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <loading-outlined v-if="loadingTable" class="main-loading-spinner" />
+  <div v-else>
+    <div v-if="!disabled" class="rules-list ant-list ant-list-bordered">
+      <div class="rules-table-item ant-list-item">
+        <div class="rules-table__col rules-table__col--grab" />
+        <div class="rules-table__col rules-table__col--rule rules-table__col--new">
+          <a-auto-complete
+            :key="autocompleteKey"
+            v-focus="true"
+            :filterOption="filterOption"
+            :options="apis"
+            v-model:value="newRule"
+            :placeholder="$t('label.rule')" />
+        </div>
+        <div class="rules-table__col rules-table__col--permission">
+          <permission-editable
+            :default-value="newRulePermission"
+            :value="newRulePermission"
+            @onChange="updateNewPermission()" />
+        </div>
+        <div class="rules-table__col rules-table__col--description">
+          <a-input v-model:value="newRuleDescription" :placeholder="$t('label.description')" />
+        </div>
+        <div class="rules-table__col rules-table__col--actions">
+          <tooltip-button
+            tooltipPlacement="bottom"
+            :tooltip="$t('label.save.new.rule')"
+            icon="plus-outlined"
+            type="primary"
+            @onClick="onRuleSave" />
+        </div>
+      </div>
+
+      <draggable
+        v-model="rules"
+        @change="updateRules"
+        handle=".drag-handle"
+        ghostClass="drag-ghost"
+        :component-data="{type: 'transition'}"
+        item-key="rule">
+        <template #item="{element, index}">
+          <div class="rules-table-item ant-list-item">
+            <div class="rules-table__col rules-table__col--grab drag-handle">
+              <drag-outlined />
+            </div>
+            <div class="rules-table__col rules-table__col--rule">
+              {{ element.rule }}
+            </div>
+            <div class="rules-table__col rules-table__col--permission">
+              <permission-editable
+                :default-value="element.permission"
+                @onChange="onPermissionChange(element, $event, index)" />
+            </div>
+            <div class="rules-table__col rules-table__col--description">
+              <div v-if="element.description">
+                {{ element.description }}
+              </div>
+              <div v-else class="no-description">
+                {{ $t('message.no.description') }}
+              </div>
+            </div>
+            <div class="rules-table__col rules-table__col--actions">
+              <tooltip-button
+                :tooltip="$t('label.delete.rule')"
+                tooltipPlacement="bottom"
+                type="primary"
+                :danger="true"
+                icon="delete-outlined"
+                :disabled="false"
+                @onClick="onRuleDelete(element.rule, index)" />
+            </div>
+          </div>
+        </template>
+      </draggable>
+    </div>
+
+    <div :style="{width: '100%', display: 'flex', marginTop: this.rules.length > 0 ? '12px' : '0'}" v-if="this.rules.length > 0 && !disabled">
+      <a-button
+        style="width: 100%;"
+        danger
+        @click="deleteAllRules()">
+        <template #icon><delete-outlined /></template>
+        {{ $t('label.delete.all.rules') }}
+      </a-button>
+    </div>
+
+    <a-table
+      v-else-if="disabled"
+      :columns="columns"
+      :dataSource="rules"
+      rowKey="rule"
+      size="large"
+      :pagination="pagination"
+      @change="handlePaginationChange">
+      <template #customFilterDropdown="{ setSelectedKeys, selectedKeys, confirm, clearFilters, column }">
+        <div style="padding: 8px">
+          <a-input
+            ref="searchInput"
+            :placeholder="$t('label.search')"
+            :value="selectedKeys[0]"
+            style="width: 100%; margin-bottom: 8px; display: block"
+            @change="e => setSelectedKeys(e.target.value ? [e.target.value] : [])"
+            @pressEnter="handleSearch(selectedKeys, confirm, column.dataIndex)"
+          />
+          <div style="display: flex; gap: 8px">
+            <a-button
+              type="primary"
+              size="small"
+              style="width: 112px;"
+              @click="handleSearch(selectedKeys, confirm, column.dataIndex)">
+              <template #icon>
+                <search-outlined />
+              </template>
+              {{ $t('label.search') }}
+            </a-button>
+
+            <a-button
+              size="small"
+              style="width: 112px;"
+              @click="handleReset(clearFilters)">
+              {{ $t('label.reset') }}
+            </a-button>
+          </div>
+        </div>
+      </template>
+
+      <template #customFilterIcon="{ filtered }">
+        <search-outlined :style="{ color: filtered ? '#1890ff' : '', fontSize: '14px' }" />
+      </template>
+
+      <template #bodyCell="{ column, record }">
+        <template v-if="column.key === 'permission'">
+          <a-tag
+            class="permission-tag"
+            :style="{
+              backgroundColor: record.permission === 'allow' ? '#d9f7be' : '#fff2f0',
+              color: record.permission === 'allow' ? '#135200' : '#cf1322'
+            }">
+            <check-outlined v-if="record.permission === 'allow'" />
+            <close-outlined v-else />
+            {{ record.permission === 'allow' ? $t('label.allow') : $t('label.deny') }}
+          </a-tag>
+        </template>
+
+        <template v-else-if="column.key === 'description' && record.description">
+          {{ record.description }}
+        </template>
+      </template>
+    </a-table>
+  </div>
+</template>
+
+<script>
+import { getAPI } from '@/api'
+import draggable from 'vuedraggable'
+import PermissionEditable from './PermissionEditable'
+import TooltipButton from '@/components/widgets/TooltipButton'
+import { genericCompare } from '@/utils/sort'
+
+export default {
+  name: 'ApiKeyPairPermissionTable',
+  components: {
+    PermissionEditable,
+    draggable,
+    TooltipButton
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
+  data () {
+    return {
+      loadingTable: true,
+      disabled: false,
+      rules: [],
+      newRule: '',
+      newRulePermission: 'allow',
+      newRuleDescription: '',
+      drag: false,
+      apis: [],
+      currRules: new Set(),
+      searchText: '',
+      searchedColumn: '',
+      columns: [
+        {
+          title: this.$t('label.rule'),
+          dataIndex: 'rule',
+          key: 'rule',
+          ellipsis: true,
+          customFilterDropdown: true,
+          onFilter: (value, record) => {
+            return record.rule.toString().toLowerCase().includes(value.toLowerCase())
+          },
+          sorter: (a, b) => { return genericCompare(a.rule || '', b.rule || '') },
+          width: 480
+        },
+        {
+          title: this.$t('label.permission'),
+          dataIndex: 'permission',
+          key: 'permission',
+          width: 160,
+          align: 'center',
+          sorter: (a, b) => { return genericCompare(a.permission || '', b.permission || '') }
+        },
+        {
+          title: this.$t('label.description'),
+          dataIndex: 'description',
+          key: 'description'
+        }
+      ],
+      pagination: {
+        pageSize: this.$store.getters.defaultListViewPageSize,
+        pageSizeOptions: ['10', '20', '40', '80', '100', '200'],
+        showSizeChanger: true
+      },
+      autocompleteKey: 0
+    }
+  },
+  async created () {
+    if (this.$route.path.startsWith('/keypair')) {
+      await this.fetchKeyData()
+      this.disabled = true
+    } else {
+      this.getApis()
+    }
+    this.loadingTable = false
+  },
+  methods: {
+    handleSearch (selectedKeys, confirm, dataIndex) {
+      confirm()
+      this.searchText = selectedKeys[0]
+      this.searchedColumn = dataIndex
+    },
+    handleReset (clearFilters) {
+      clearFilters()
+      this.searchText = ''
+    },
+    handlePaginationChange (pagination) {
+      this.pagination.pageSize = pagination.pageSize
+      this.pagination.current = pagination.current
+    },
+    filterOption (input, option) {
+      return option.value.toUpperCase().indexOf(input.toUpperCase()) >= 0
+    },
+    async fetchKeyData () {
+      try {
+        const response = await getAPI('listUserKeyRules', { keypairid: this.resource.id })
+        this.rules = response?.listuserkeyrulesresponse?.keypermission ?? []
+      } catch (e) {
+        this.$notifyError(e)
+      }
+    },
+    getApis () {
+      this.apis = Object.keys(this.$store.getters.apis).sort((a, b) => a.localeCompare(b)).map(value => { return { value: value } })
+    },
+    onRuleDelete (rule, idx) {
+      this.rules.splice(idx, 1)
+      this.currRules.delete(rule)
+      this.updateRules()
+    },
+    onRuleSave () {
+      if (!this.newRule || this.currRules.has(this.newRule)) {
+        return
+      }
+      this.rules.push({
+        rule: this.newRule,
+        permission: this.newRulePermission,
+        description: this.newRuleDescription,
+        roleid: this.resource.id
+      })
+      this.currRules.add(this.newRule)
+      this.newRule = ''
+      this.newRuleDescription = ''
+      this.autocompleteKey += 1
+      this.updateRules()
+    },
+    async deleteAllRules () {
+      this.loadingTable = true
+      return new Promise((resolve) => {
+        setTimeout(() => {
+          this.rules = []
+          this.currRules = new Set()
+          this.updateRules()
+          resolve()
+          this.loadingTable = false
+        })
+      })
+    },
+    updateRules () {
+      this.$emit('update-rules', this.rules)
+    },
+    updateNewPermission () {
+      this.newRulePermission = (this.newRulePermission === 'allow') ? 'deny' : 'allow'
+    },
+    onPermissionChange (record, value, idx) {
+      if (!record) return
+      this.rules[idx].permission = value
+      record.permission = value
+      this.updateRules()
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+.main-loading-spinner {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 30px;
+}
+.role-add-btn {
+  margin-bottom: 15px;
+}
+.new-role-controls {
+  display: flex;
+
+  button {
+    &:not(:last-child) {
+      margin-right: 5px;
+    }
+  }
+}
+
+.rules-list {
+  max-height: 600px;
+  overflow: auto;
+
+  &--overflow-hidden {
+    overflow: hidden;
+  }
+}
+
+.rules-table {
+  &-item {
+    position: relative;
+    display: flex;
+    align-items: stretch;
+    padding: 0;
+    flex-wrap: wrap;
+
+    @media (min-width: 760px) {
+      flex-wrap: nowrap;
+      padding-right: 25px;
+    }
+  }
+
+  &__col {
+    display: flex;
+    align-items: center;
+    padding: 15px;
+
+    @media (min-width: 760px) {
+      padding: 15px 0;
+
+      &:not(:first-child) {
+        padding-left: 20px;
+      }
+
+      &:not(:last-child) {
+        border-right: 1px solid #e8e8e8;
+        padding-right: 20px;
+      }
+    }
+
+    &--grab {
+      position: absolute;
+      top: 4px;
+      left: 0;
+      width: 100%;
+
+      @media (min-width: 760px) {
+        position: relative;
+        top: auto;
+        width: 35px;
+        padding-left: 25px;
+        justify-content: center;
+      }
+    }
+
+    &--rule,
+    &--description {
+      word-break: break-all;
+      flex: 1;
+      width: 100%;
+
+      @media (min-width: 760px) {
+        width: auto;
+      }
+    }
+
+    &--rule {
+      padding-left: 60px;
+      background-color: rgba(#e6f7ff, 0.7);
+
+      @media (min-width: 760px) {
+        padding-left: 20px;
+        background: none;
+      }
+    }
+
+    &--permission {
+      justify-content: center;
+      width: 100%;
+
+      .ant-select {
+        width: 100%;
+      }
+
+      @media (min-width: 760px) {
+        width: auto;
+
+        .ant-select {
+          width: auto;
+        }
+      }
+    }
+
+    &--actions {
+      max-width: 60px;
+      width: 100%;
+      padding-right: 0;
+
+      @media (min-width: 760px) {
+        width: auto;
+        max-width: 70px;
+        padding-right: 15px;
+      }
+    }
+
+    &--new {
+      padding-left: 15px;
+      background-color: transparent;
+
+      div {
+        width: 100%;
+      }
+    }
+  }
+}
+
+.no-description {
+  opacity: 0.4;
+  font-size: 0.7rem;
+
+  @media (min-width: 760px) {
+    display: none;
+  }
+
+}
+
+.drag-handle {
+  cursor: pointer;
+}
+
+.drag-ghost {
+  opacity: 0.5;
+  background: #f0f2f5;
+}
+
+.loading-overlay {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 5;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 3rem;
+  color: #39A7DE;
+  background-color: rgba(#fff, 0.8);
+}
+
+.permission-tag {
+  border: none;
+  border-radius: 999px;
+  padding: 2px 10px;
+  font-size: 14px;
+  font-weight: 500;
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.rules-table__col--new {
+  .ant-select {
+    width: 100%;
+  }
+}
+
+.rule-dropdown-error {
+  .ant-input {
+    border-color: #ff0000
+  }
+}
+</style>
diff --git a/ui/src/views/iam/GenerateApiKeyPair.vue b/ui/src/views/iam/GenerateApiKeyPair.vue
new file mode 100644
index 000000000000..bc0b2bb475e6
--- /dev/null
+++ b/ui/src/views/iam/GenerateApiKeyPair.vue
@@ -0,0 +1,226 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div class="form-layout" v-ctrl-enter="handleSubmit">
+    <a-modal
+      v-if="showAddKeyPair"
+      :visible="showAddKeyPair"
+      :closable="true"
+      :maskClosable="false"
+      :okText="$t('label.ok')"
+      :cancelText="$t('label.cancel')"
+      style="top: 20px;"
+      width="50vw"
+      @cancel="closeModal"
+      @ok="handleSubmit"
+      :ok-button-props="{props: { type: 'default' } }"
+      :cancel-button-props="{props: { type: 'primary' } }"
+      centered>
+      <template #title>
+        {{ $t('label.action.create.api.key') }}
+      </template>
+      <a-spin :spinning="loading">
+        <a-form
+          :ref="formRef"
+          :model="form"
+          layout="vertical"
+          @finish="handleSubmit">
+          <a-alert
+            style="margin-bottom: 10px; "
+            :message="$t('message.note.about.keypair.permissions.title')"
+            :description="$t('message.note.about.keypair.permissions.body')"
+            type="info"
+            show-icon
+          />
+          <a-form-item name="name" ref="name">
+            <template #label>
+              <tooltip-label :title="$t('label.name')" :tooltip="apiParams.name.description"/>
+            </template>
+            <a-input
+              v-focus="true"
+              :placeholder="$t('label.apikeypair.name')"
+              v-model:value="form.name" />
+          </a-form-item>
+          <a-form-item name="description" ref="description">
+            <template #label>
+              <tooltip-label :title="$t('label.description')" :tooltip="apiParams.description.description"/>
+            </template>
+            <a-input
+              v-model:value="form.description"
+              :placeholder="$t('label.apikeypair.description')" />
+          </a-form-item>
+          <a-row>
+            <a-form-item ref="startDate" name="startDate">
+              <template #label>
+                <tooltip-label :title="$t('label.start.date')" :tooltip="apiParams.startdate.description"/>
+              </template>
+              <a-date-picker
+                v-model:value="form.startDate"
+                :disabled-date="disabledStartDate"
+                show-time
+              />
+            </a-form-item>
+            <a-form-item ref="endDate" name="endDate" style="margin: 0 8px">
+              <template #label>
+                <tooltip-label :title="$t('label.end.date')" :tooltip="apiParams.enddate.description"/>
+              </template>
+              <a-date-picker
+                :disabled-date="disabledEndDate"
+                v-model:value="form.endDate"
+                show-time />
+            </a-form-item>
+          </a-row>
+          <a-form-item>
+            <template #label>
+              <tooltip-label :title="$t('label.rules')" :tooltip="apiParams.rules.description"/>
+            </template>
+            <api-key-pair-permission-table
+              :resource="resource"
+              @update-rules="updateRules"/>
+          </a-form-item>
+        </a-form>
+      </a-spin>
+    </a-modal>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import ApiKeyPairPermissionTable from '@/views/iam/ApiKeyPairPermissionTable.vue'
+import { dayjs, parseDayJsObject } from '@/utils/date'
+
+export default {
+  name: 'GenerateApiKeyPair',
+  components: {
+    TooltipLabel,
+    ApiKeyPairPermissionTable
+  },
+  props: {
+    showAddKeyPair: {
+      type: Boolean,
+      default: false
+    },
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
+  data () {
+    return {
+      rules: [],
+      loading: false
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('registerUserKeys')
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({})
+    },
+    buildRequestParams () {
+      const values = toRaw(this.form)
+      this.loading = true
+      const params = {
+        name: values.name,
+        id: this.resource.id,
+        description: values.description ? values.description : null,
+        startdate: values.startDate ? parseDayJsObject({ value: values.startDate }) : null,
+        enddate: values.endDate ? parseDayJsObject({ value: values.endDate }) : null
+      }
+      for (const i in this.rules) {
+        const rule = this.rules[i]
+        params['rules[' + i + '].rule'] = rule.rule ? rule.rule : ''
+        params['rules[' + i + '].permission'] = rule.permission ? rule.permission : 'deny'
+        params['rules[' + i + '].description'] = rule.description ? rule.description : ''
+      }
+      return params
+    },
+    handleSubmit (e) {
+      if (e && typeof e.preventDefault === 'function') {
+        e.preventDefault()
+      }
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const params = this.buildRequestParams()
+        this.loading = true
+        postAPI('registerUserKeys', params).then(response => {
+          this.$pollJob({
+            jobId: response.registeruserkeysresponse.jobid,
+            successMessage: this.$t('message.success.register.user.keypair', { user: this.resource.username }),
+            successMethod: () => {
+              this.fetchData()
+            },
+            errorMessage: this.$t('message.register.keypair.failed'),
+            errorMethod: () => {
+              this.fetchData()
+            },
+            loadingMessage: this.$t('label.registering.keypair', { user: this.resource.username }),
+            catchMessage: this.$t('error.fetching.async.job.result')
+          })
+        }).catch(error => {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: (error.response && error.response.headers && error.response.headers['x-description']) || error.message,
+            duration: 0
+          })
+        }).finally(() => {
+          this.loading = false
+          this.closeModal()
+        })
+      })
+    },
+    closeModal () {
+      this.form.name = null
+      this.form.description = null
+      this.form.startDate = null
+      this.form.endDate = null
+      this.rules = []
+      this.$emit('close-modal')
+    },
+    fetchData () {
+      this.$emit('fetch-data')
+    },
+    updateRules (rules) {
+      this.rules = rules
+    },
+    disabledStartDate (current) {
+      return current < dayjs().startOf('day')
+    },
+    disabledEndDate (current) {
+      return current < (this.form.startDate || dayjs().startOf('day'))
+    }
+  }
+}
+</script>
+
+<style scoped lang="less">
+.form-layout {
+  width: 80vw;
+
+  @media (min-width: 600px) {
+    width: 450px;
+  }
+}
+</style>
diff --git a/ui/src/views/infra/AddPrimaryStorage.vue b/ui/src/views/infra/AddPrimaryStorage.vue
index d46396bbb3a5..48dd363e0df0 100644
--- a/ui/src/views/infra/AddPrimaryStorage.vue
+++ b/ui/src/views/infra/AddPrimaryStorage.vue
@@ -383,7 +383,7 @@
             <a-input v-model:value="form.radossecret" :placeholder="$t('label.rados.secret')" />
           </a-form-item>
         </div>
-        <div v-if="form.protocol === 'CLVM'">
+        <div v-if="form.protocol === 'CLVM' || form.protocol === 'CLVM_NG'">
           <a-form-item name="volumegroup" ref="volumegroup" :label="$t('label.volumegroup')">
             <a-input v-model:value="form.volumegroup" :placeholder="$t('label.volumegroup')" />
           </a-form-item>
@@ -607,7 +607,7 @@ export default {
       const cluster = this.clusters.find(cluster => cluster.id === this.form.cluster)
       this.hypervisorType = cluster.hypervisortype
       if (this.hypervisorType === 'KVM') {
-        this.protocols = ['nfs', 'SharedMountPoint', 'RBD', 'CLVM', 'Gluster', 'Linstor', 'custom', 'FiberChannel']
+        this.protocols = ['nfs', 'SharedMountPoint', 'RBD', 'CLVM', 'CLVM_NG', 'Gluster', 'Linstor', 'custom', 'FiberChannel']
         if (this.form.scope === 'host') {
           this.protocols.push('Filesystem')
         }
@@ -729,6 +729,15 @@ export default {
       }
       return url
     },
+    clvmNgURL (vgname) {
+      var url
+      if (vgname.indexOf('://') === -1) {
+        url = 'clvm_ng://localhost/' + vgname
+      } else {
+        url = vgname
+      }
+      return url
+    },
     vmfsURL (server, path) {
       var url
       if (server.indexOf('://') === -1) {
@@ -853,6 +862,9 @@ export default {
         } else if (values.protocol === 'CLVM') {
           var vg = (values.volumegroup.substring(0, 1) !== '/') ? ('/' + values.volumegroup) : values.volumegroup
           url = this.clvmURL(vg)
+        } else if (values.protocol === 'CLVM_NG') {
+          vg = (values.volumegroup.substring(0, 1) !== '/') ? ('/' + values.volumegroup) : values.volumegroup
+          url = this.clvmNgURL(vg)
         } else if (values.protocol === 'RBD') {
           url = this.rbdURL(values.radosmonitor, values.radospool, values.radosuser, values.radossecret)
           if (values.datapool) {
diff --git a/ui/src/views/infra/HostUpdate.vue b/ui/src/views/infra/HostUpdate.vue
index 1fee7a6846c0..5ef762443e9d 100644
--- a/ui/src/views/infra/HostUpdate.vue
+++ b/ui/src/views/infra/HostUpdate.vue
@@ -64,7 +64,22 @@
           </a-select-option>
         </a-select>
       </a-form-item>
-      <a-form-item name="oscategoryid" ref="oscategoryid">
+      <a-form-item name="guestosasrule" ref="guestosasrule">
+        <template #label>
+          <tooltip-label :title="$t('label.guestosasrule')"/>
+        </template>
+        <a-switch v-model:checked="form.guestosasrule"/>
+      </a-form-item>
+      <a-form-item v-if="form.guestosasrule" name="guestosrule" ref="guestosrule">
+        <template #label>
+          <tooltip-label :title="$t('label.guestosrule')" :tooltip="apiParams.guestosrule.description"/>
+        </template>
+        <a-textarea
+          v-model:value="form.guestosrule"
+          :placeholder="apiParams.guestosrule.name">
+        </a-textarea>
+      </a-form-item>
+      <a-form-item v-if="!form.guestosasrule" name="oscategoryid" ref="oscategoryid">
         <template #label>
           <tooltip-label :title="$t('label.oscategoryid')" :tooltip="apiParams.oscategoryid.description"/>
         </template>
@@ -149,6 +164,7 @@ export default {
   methods: {
     initForm () {
       this.formRef = ref()
+      const guestOsRule = this.resource?.guestosrule
       this.form = reactive({
         name: this.resource.name,
         hosttags: this.resource.explicithosttags,
@@ -157,7 +173,9 @@ export default {
           ? this.resource.storageaccessgroups.split(',')
           : [],
         oscategoryid: this.resource.oscategoryid,
-        externaldetails: this.resourceExternalDetails
+        externaldetails: this.resourceExternalDetails,
+        guestosasrule: guestOsRule !== undefined,
+        guestosrule: guestOsRule
       })
       this.rules = reactive({})
     },
@@ -194,7 +212,11 @@ export default {
         params.id = this.resource.id
         params.name = values.name
         params.hosttags = values.hosttags
-        params.oscategoryid = values.oscategoryid
+        if (values.guestosasrule === true) {
+          params.guestosrule = values.guestosrule
+        } else {
+          params.oscategoryid = values.oscategoryid || this.osCategories.opts.filter(os => os.name === 'None')[0]?.id
+        }
         if (values.istagarule !== undefined) {
           params.istagarule = values.istagarule
         }
@@ -205,9 +227,11 @@ export default {
         } else {
           params.cleanupexternaldetails = true
         }
+
+        Object.keys(params).forEach((key) => (params[key] == null) && delete params[key])
         this.loading = true
 
-        postAPI('updateHost', params).then(json => {
+        postAPI('updateHost', params).then(() => {
           this.$message.success({
             content: `${this.$t('label.action.update.host')} - ${values.name}`,
             duration: 2
diff --git a/ui/src/views/network/NicsTab.vue b/ui/src/views/network/NicsTab.vue
index 4c99f4f1c511..8e21db5b34d8 100644
--- a/ui/src/views/network/NicsTab.vue
+++ b/ui/src/views/network/NicsTab.vue
@@ -222,6 +222,10 @@
             :placeholder="$t('label.new.secondaryip.description')"
             v-model:value="newSecondaryIp"
             v-focus="editNicResource.type!=='Shared'"></a-input>
+          <p class="modal-form__label">{{ $t('label.secondaryip.description') }}:</p>
+          <a-input
+            :placeholder="$t('label.new.secondaryip.description.description')"
+            v-model:value="newSecondaryIpDescription"></a-input>
         </div>
 
         <div style="margin-top: 10px; display: flex; justify-content:flex-end;">
@@ -326,6 +330,7 @@ export default {
       secondaryIPs: [],
       selectedNicId: '',
       newSecondaryIp: '',
+      newSecondaryIpDescription: '',
       editNicResource: {},
       listIps: {
         loading: false,
@@ -401,6 +406,7 @@ export default {
       this.addNetworkData.makedefault = false
       this.editIpAddressValue = ''
       this.newSecondaryIp = ''
+      this.newSecondaryIpDescription = ''
     },
     onChangeIPAddress (record) {
       this.editNicResource = record.nic
@@ -589,6 +595,7 @@ export default {
       if (this.newSecondaryIp) {
         params.ipaddress = this.newSecondaryIp
       }
+      params.description = this.newSecondaryIpDescription
 
       postAPI('addIpToNic', params).then(response => {
         this.$pollJob({
@@ -616,6 +623,7 @@ export default {
         this.loadingNic = false
       }).finally(() => {
         this.newSecondaryIp = null
+        this.newSecondaryIpDescription = null
         this.fetchPublicIps(this.editNetworkId)
       })
     },
diff --git a/ui/src/views/network/NicsTable.vue b/ui/src/views/network/NicsTable.vue
index 11ba135e39a2..ec4a25afb3d0 100644
--- a/ui/src/views/network/NicsTable.vue
+++ b/ui/src/views/network/NicsTable.vue
@@ -39,7 +39,7 @@
           {{ record.traffictype }}
         </a-descriptions-item>
         <a-descriptions-item :label="$t('label.secondaryips')" v-if="record.secondaryip && record.secondaryip.length > 0 && record.type !== 'L2'">
-          {{ record.secondaryip.map(x => x.ipaddress).join(', ') }}
+          {{ record.secondaryip.map(secondaryIp => secondaryIp.description ? (secondaryIp.ipaddress + ': ' + secondaryIp.description) : secondaryIp.ipaddress).join(', ') }}
         </a-descriptions-item>
         <a-descriptions-item :label="$t('label.ip6address')" v-if="record.ip6address">
           {{ record.ip6address }}
diff --git a/utils/src/main/java/com/cloud/utils/UriUtils.java b/utils/src/main/java/com/cloud/utils/UriUtils.java
index a4654091e0cb..afbaa386c1ea 100644
--- a/utils/src/main/java/com/cloud/utils/UriUtils.java
+++ b/utils/src/main/java/com/cloud/utils/UriUtils.java
@@ -641,6 +641,9 @@ public static UriInfo getUriInfo(String url) {
             if (url.startsWith("rbd://")) {
                 return getRbdUrlInfo(url);
             }
+            if (url.toLowerCase().startsWith("clvm://") || url.toLowerCase().startsWith("clvm_ng://")) {
+                return getClvmUrlInfo(url);
+            }
             URI uri = new URI(UriUtils.encodeURIComponent(url));
             return new UriInfo(uri.getScheme(), uri.getHost(), uri.getPath(), uri.getUserInfo(), uri.getPort());
         } catch (URISyntaxException e) {
@@ -678,6 +681,36 @@ private static UriInfo getRbdUrlInfo(String url) {
         }
     }
 
+    private static UriInfo getClvmUrlInfo(String url) {
+        if (url == null || (!url.toLowerCase().startsWith("clvm://") && !url.toLowerCase().startsWith("clvm_ng://"))) {
+            throw new CloudRuntimeException("CLVM URL must start with \"clvm://\" or \"clvm_ng://\"");
+        }
+
+        String scheme;
+        String remainder;
+        if (url.toLowerCase().startsWith("clvm_ng://")) {
+            scheme = "clvm_ng";
+            remainder = url.substring(10);
+        } else {
+            scheme = "clvm";
+            remainder = url.substring(7);
+        }
+
+        int firstSlash = remainder.indexOf('/');
+        String host = (firstSlash == -1) ? remainder : remainder.substring(0, firstSlash);
+        String path = (firstSlash == -1) ? "/" : remainder.substring(firstSlash);
+
+        if (host.isEmpty()) {
+            host = "localhost";
+        }
+
+        while (path.startsWith("//")) {
+            path = path.substring(1);
+        }
+
+        return new UriInfo(scheme, host, path, null, -1);
+    }
+
     public static boolean isUrlForCompressedFile(String url) {
         return UriUtils.COMPRESSION_FORMATS.stream().anyMatch(f -> url.toLowerCase().endsWith(f));
     }
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
similarity index 61%
rename from utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java
rename to utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
index b30135673524..506bbc1ea5c3 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
@@ -16,41 +16,60 @@
 //under the License.
 package org.apache.cloudstack.utils.jsinterpreter;
 
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
-import com.cloud.utils.exception.CloudRuntimeException;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
 
-public class TagAsRuleHelper {
+public class GenericRuleHelper {
 
-    protected static Logger LOGGER = LogManager.getLogger(TagAsRuleHelper.class);
+    protected static Logger LOGGER = LogManager.getLogger(GenericRuleHelper.class);
 
-    public static boolean interpretTagAsRule(String rule, String tags, long timeout) {
+    public static boolean interpretTagAsRule(String rule, String tags, long timeout, String configName) {
         List<String> tagsPresetVariable = new ArrayList<>();
         if (!StringUtils.isEmpty(tags)) {
             tagsPresetVariable.addAll(Arrays.asList(tags.split(",")));
         }
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(timeout)) {
-            jsInterpreter.injectVariable("tags", tagsPresetVariable);
-            Object scriptReturn = jsInterpreter.executeScript(rule);
+        Boolean scriptReturn = interpretRule("tags", tagsPresetVariable, timeout, rule, configName);
+
+        if (scriptReturn != null) {
+            return scriptReturn;
+        }
+
+        LOGGER.debug("Result of tag rule [{}] was not a boolean, returning false.", rule);
+        return false;
+    }
+
+    public static boolean interpretGuestOsRule(String rule, String vmGuestOs, long timeout, String configName) {
+        Boolean scriptReturn = interpretRule("vmGuestOs", vmGuestOs, timeout, rule, configName);
+
+        if (scriptReturn != null) {
+            return scriptReturn;
+        }
+
+        LOGGER.debug("Result of guest OS rule [{}] was not a boolean, returning false.", rule);
+        return false;
+    }
+
+    private static Boolean interpretRule(String variableName, Object variableValue, long timeout, String script, String configName) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(timeout, configName)) {
+            jsInterpreter.injectVariable(variableName, variableValue);
+            Object scriptReturn = jsInterpreter.executeScript(script);
             if (scriptReturn instanceof Boolean) {
-                return (Boolean)scriptReturn;
+                return (Boolean) scriptReturn;
             }
         } catch (IOException ex) {
-            String message = String.format("Error while executing script [%s].", rule);
+            String message = String.format("Error while executing script [%s].", script);
             LOGGER.error(message, ex);
             throw new CloudRuntimeException(message, ex);
         }
-
-        LOGGER.debug("Result of tag rule [{}] was not a boolean, returning false.", rule);
-        return false;
+        return null;
     }
 
 }
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
index 6e6ef2bbe599..85799e0f5614 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
@@ -86,10 +86,10 @@ static final class DenyAllClassFilter implements ClassFilter {
      */
     protected JsInterpreter() { }
 
-    public JsInterpreter(long timeout) {
+    public JsInterpreter(long timeout, String configName) {
         this.timeout = timeout;
-        this.timeoutDefaultMessage = String.format(
-                "Timeout (in milliseconds) defined in the global setting [quota.activationrule.timeout]: [%s].", this.timeout);
+        this.timeoutDefaultMessage = String.format("Timeout (in milliseconds) defined in the global setting [%s]: [%s].",
+                configName, this.timeout);
 
         if (System.getProperty("nashorn.args") == null) {
             System.setProperty("nashorn.args", "--no-java --no-syntax-extensions");
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java b/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
index 14d24dbb6410..52642cf03707 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
@@ -30,8 +30,11 @@
 
 public class ServerPropertiesUtil {
     private static final Logger logger = LoggerFactory.getLogger(ServerPropertiesUtil.class);
+
     protected static final String PROPERTIES_FILE = "server.properties";
     protected static final AtomicReference<Properties> propertiesRef = new AtomicReference<>();
+    protected static final String KEYSTORE_FILE = "https.keystore";
+    protected static final String KEYSTORE_PASSWORD = "https.keystore.password";
 
     public static String getProperty(String name) {
         Properties props = propertiesRef.get();
@@ -55,4 +58,12 @@ public static String getProperty(String name) {
         }
         return tempProps.getProperty(name);
     }
+
+    public static String getKeystoreFile() {
+        return getProperty(KEYSTORE_FILE);
+    }
+
+    public static String getKeystorePassword() {
+        return getProperty(KEYSTORE_PASSWORD);
+    }
 }
diff --git a/utils/src/test/java/com/cloud/utils/UriUtilsTest.java b/utils/src/test/java/com/cloud/utils/UriUtilsTest.java
index 8e6408f77835..c6c059b2ebe2 100644
--- a/utils/src/test/java/com/cloud/utils/UriUtilsTest.java
+++ b/utils/src/test/java/com/cloud/utils/UriUtilsTest.java
@@ -283,4 +283,180 @@ public void validateUrl() {
         Pair<String, Integer> url2 = UriUtils.validateUrl("https://www.apache.org");
         Assert.assertEquals(url2.first(), "www.apache.org");
     }
+
+    @Test
+    public void testGetClvmUriInfoBasic() {
+        String host = "10.11.12.13";
+
+        String url1 = String.format("clvm://%s/vg0/lv0", host);
+        String url2 = String.format("clvm://%s/vg0", host);
+        String url3 = String.format("clvm://%s", host);
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm", info1.getScheme());
+        Assert.assertEquals(host, info1.getStorageHost());
+        Assert.assertEquals("/vg0/lv0", info1.getStoragePath());
+        Assert.assertNull(info1.getUserInfo());
+        Assert.assertEquals(-1, info1.getPort());
+        Assert.assertEquals(url1, info1.toString());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm", info2.getScheme());
+        Assert.assertEquals(host, info2.getStorageHost());
+        Assert.assertEquals("/vg0", info2.getStoragePath());
+
+        UriUtils.UriInfo info3 = UriUtils.getUriInfo(url3);
+        Assert.assertEquals("clvm", info3.getScheme());
+        Assert.assertEquals(host, info3.getStorageHost());
+        Assert.assertEquals("/", info3.getStoragePath());
+    }
+
+    @Test
+    public void testGetClvmNgUriInfoBasic() {
+        String host = "10.11.12.13";
+
+        String url1 = String.format("clvm_ng://%s/vg0/lv0", host);
+        String url2 = String.format("clvm_ng://%s/vg0", host);
+        String url3 = String.format("clvm_ng://%s", host);
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm_ng", info1.getScheme());
+        Assert.assertEquals(host, info1.getStorageHost());
+        Assert.assertEquals("/vg0/lv0", info1.getStoragePath());
+        Assert.assertNull(info1.getUserInfo());
+        Assert.assertEquals(-1, info1.getPort());
+        Assert.assertEquals(url1, info1.toString());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm_ng", info2.getScheme());
+        Assert.assertEquals(host, info2.getStorageHost());
+        Assert.assertEquals("/vg0", info2.getStoragePath());
+
+        UriUtils.UriInfo info3 = UriUtils.getUriInfo(url3);
+        Assert.assertEquals("clvm_ng", info3.getScheme());
+        Assert.assertEquals(host, info3.getStorageHost());
+        Assert.assertEquals("/", info3.getStoragePath());
+    }
+
+    @Test
+    public void testGetClvmUriInfoNoHost() {
+        String url1 = "clvm:///vg0/lv0";
+        String url2 = "clvm_ng:///vg0/lv0";
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm", info1.getScheme());
+        Assert.assertEquals("localhost", info1.getStorageHost());
+        Assert.assertEquals("/vg0/lv0", info1.getStoragePath());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm_ng", info2.getScheme());
+        Assert.assertEquals("localhost", info2.getStorageHost());
+        Assert.assertEquals("/vg0/lv0", info2.getStoragePath());
+    }
+
+    @Test
+    public void testGetClvmUriInfoMultipleSlashes() {
+        String url1 = "clvm://host1//vg0//lv0";
+        String url2 = "clvm_ng://host2///vg1///lv1";
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm", info1.getScheme());
+        Assert.assertEquals("host1", info1.getStorageHost());
+        Assert.assertEquals("/vg0//lv0", info1.getStoragePath());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm_ng", info2.getScheme());
+        Assert.assertEquals("host2", info2.getStorageHost());
+        Assert.assertEquals("/vg1///lv1", info2.getStoragePath());
+    }
+
+    @Test
+    public void testGetClvmUriInfoComplexPaths() {
+        String host = "storage-node1";
+        String url1 = String.format("clvm://%s/vg-name-with-dashes/lv_name_with_underscores", host);
+        String url2 = String.format("clvm_ng://%s/vg.name.with.dots/lv-123-456", host);
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm", info1.getScheme());
+        Assert.assertEquals(host, info1.getStorageHost());
+        Assert.assertEquals("/vg-name-with-dashes/lv_name_with_underscores", info1.getStoragePath());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm_ng", info2.getScheme());
+        Assert.assertEquals(host, info2.getStorageHost());
+        Assert.assertEquals("/vg.name.with.dots/lv-123-456", info2.getStoragePath());
+    }
+
+    @Test
+    public void testGetClvmUriInfoHostnames() {
+        String[] hosts = {
+            "localhost",
+            "node1",
+            "storage-node-1",
+            "storage.example.com",
+            "10.0.0.1",
+            "192.168.1.100"
+        };
+
+        for (String host : hosts) {
+            String clvmUrl = String.format("clvm://%s/vg0/lv0", host);
+            String clvmNgUrl = String.format("clvm_ng://%s/vg0/lv0", host);
+
+            UriUtils.UriInfo clvmInfo = UriUtils.getUriInfo(clvmUrl);
+            Assert.assertEquals("clvm", clvmInfo.getScheme());
+            Assert.assertEquals(host, clvmInfo.getStorageHost());
+            Assert.assertEquals("/vg0/lv0", clvmInfo.getStoragePath());
+
+            UriUtils.UriInfo clvmNgInfo = UriUtils.getUriInfo(clvmNgUrl);
+            Assert.assertEquals("clvm_ng", clvmNgInfo.getScheme());
+            Assert.assertEquals(host, clvmNgInfo.getStorageHost());
+            Assert.assertEquals("/vg0/lv0", clvmNgInfo.getStoragePath());
+        }
+    }
+
+    @Test
+    public void testGetClvmUriInfoToString() {
+        String url1 = "clvm://host1/vg0/lv0";
+        String url2 = "clvm_ng://host2/vg1/lv1";
+        String url3 = "clvm://localhost/vg0";
+
+        Assert.assertEquals(url1, UriUtils.getUriInfo(url1).toString());
+        Assert.assertEquals(url2, UriUtils.getUriInfo(url2).toString());
+        Assert.assertEquals(url3, UriUtils.getUriInfo(url3).toString());
+    }
+
+    @Test
+    public void testGetClvmUriInfoCaseInsensitive() {
+        String url1 = "CLVM://host1/vg0/lv0";
+        String url2 = "ClVm://host2/vg1/lv1";
+        String url3 = "CLVM_NG://host3/vg2/lv2";
+        String url4 = "clvm_NG://host4/vg3/lv3";
+
+        UriUtils.UriInfo info1 = UriUtils.getUriInfo(url1);
+        Assert.assertEquals("clvm", info1.getScheme());
+        Assert.assertEquals("host1", info1.getStorageHost());
+
+        UriUtils.UriInfo info2 = UriUtils.getUriInfo(url2);
+        Assert.assertEquals("clvm", info2.getScheme());
+        Assert.assertEquals("host2", info2.getStorageHost());
+
+        UriUtils.UriInfo info3 = UriUtils.getUriInfo(url3);
+        Assert.assertEquals("clvm_ng", info3.getScheme());
+        Assert.assertEquals("host3", info3.getStorageHost());
+
+        UriUtils.UriInfo info4 = UriUtils.getUriInfo(url4);
+        Assert.assertEquals("clvm_ng", info4.getScheme());
+        Assert.assertEquals("host4", info4.getStorageHost());
+    }
+
+    @Test
+    public void testGetClvmUriInfoIntegration() {
+        String host = "clvm-host";
+
+        String clvmUrl = String.format("clvm://%s/vg0/lv0", host);
+        String clvmNgUrl = String.format("clvm_ng://%s/vg1/lv1", host);
+
+        testGetUriInfoInternal(clvmUrl, host);
+        testGetUriInfoInternal(clvmNgUrl, host);
+    }
 }
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java b/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
index b7df14dc85d0..e50eefd466bf 100644
--- a/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
+++ b/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
@@ -27,7 +27,7 @@ public class ImageStoreUtilTest {
 
     @Test
     public void testgenerateHttpsPostUploadUrl() throws MalformedURLException {
-        String ssvmdomain = "*.realhostip.com";
+        String ssvmdomain = "*.example.com";
         String ipAddress = "10.147.28.14";
         String uuid = UUID.randomUUID().toString();
         String protocol = "https";
@@ -47,7 +47,7 @@ public void testgenerateHttpsPostUploadUrl() throws MalformedURLException {
 
     @Test
     public void testgenerateHttpPostUploadUrl() throws MalformedURLException {
-        String ssvmdomain = "*.realhostip.com";
+        String ssvmdomain = "*.example.com";
         String ipAddress = "10.147.28.14";
         String uuid = UUID.randomUUID().toString();
         String protocol = "http";
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java b/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
index e6ef43f2fc10..e4764b2af413 100644
--- a/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
+++ b/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
@@ -161,7 +161,7 @@ public void setScriptEngineDisablingJavaLanguageTest() {
 
     @Test
     public void executeScriptTestValidScriptShouldPassWithMixedVariables() {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(1000)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(1000, "timeout.configuration")) {
             jsInterpreter.injectVariable("x", 10);
             jsInterpreter.injectVariable("y", "hello");
             jsInterpreter.injectVariable("z", true);
@@ -174,7 +174,7 @@ public void executeScriptTestValidScriptShouldPassWithMixedVariables() {
     }
 
     private void runMaliciousScriptFileTest(String script, String filename) {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(1000)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(1000, "timeout.configuration")) {
             jsInterpreter.executeScript(script);
         } catch (CloudRuntimeException ex) {
             Assert.assertTrue(ex.getMessage().contains("Unable to execute script"));